blob: 0ed1bb8dbe0c1599a9cb9b396109415c3db5f0f3 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
|
name: Create and release development container
on:
workflow_run:
workflows: ["Build, test, security"]
types:
- completed
branches:
- dev
jobs:
Create-and-release-dev-container:
name: Build the dev docker container image and push it to dockerhub
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: dawidd6/action-download-artifact@v6
with:
github_token: ${{ secrets.TOKEN_GITHUB }}
workflow: ${{ github.workflow_run.id }}
name: dev-build-files
path: ./build
- uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
- uses: docker/build-push-action@v5
with:
push: true
context: .
file: ./docker/dev/Dockerfile
tags: ${{ secrets.DOCKERHUB_USERNAME }}/pico-web-dev:latest
Test-Trivy:
name: Scan development docker container with trivy
runs-on: ubuntu-latest
needs: Create-and-release-dev-container
steps:
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
image-ref: ${{ secrets.DOCKERHUB_USERNAME }}/pico-web-dev:latest
format: 'sarif'
output: 'trivy-results.sarif'
exit-code: 0
ignore-unfixed: true
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: 'trivy-results.sarif'
|
