Skip to content

Commit 8621199

Browse files
argentinaluizargentinaluiz
committed
chore
1 parent 8312fea commit 8621199

File tree

3 files changed

+241
-7
lines changed

3 files changed

+241
-7
lines changed

‎.github/workflows/ci_bake.yml‎

Lines changed: 203 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,203 @@
1+
name: Docker
2+
3+
# This workflow uses actions that are not certified by GitHub.
4+
# They are provided by a third-party and are governed by
5+
# separate terms of service, privacy policy, and support
6+
# documentation.
7+
8+
on:
9+
push:
10+
branches: [ "main" ]
11+
# Publish semver tags as releases.
12+
tags: [ 'v*.*.*' ]
13+
pull_request:
14+
branches: [ "main" ]
15+
16+
env:
17+
# Use docker.io for Docker Hub if empty
18+
REGISTRY: docker.io
19+
DOCKER_USERNAME: argentinaluiz
20+
# github.repository as <account>/<repo>
21+
IMAGE_NAME: argentinaluiz/docker-ci-test
22+
SHA: ${{ github.event.pull_request.head.sha || github.event.after }}
23+
COMPARE_TAG: latest
24+
25+
jobs:
26+
ci:
27+
28+
runs-on: ubuntu-latest
29+
permissions:
30+
contents: read
31+
packages: write
32+
# This is used to complete the identity challenge
33+
# with sigstore/fulcio when running outside of PRs.
34+
id-token: write
35+
pull-requests: write
36+
security-events: write
37+
actions: read
38+
39+
steps:
40+
- name: Checkout repository
41+
uses: actions/checkout@v4
42+
43+
# Install the cosign tool except on PR
44+
# https://github.com/sigstore/cosign-installer
45+
- name: Install cosign
46+
if: github.event_name != 'pull_request'
47+
uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0
48+
with:
49+
cosign-release: 'v2.2.4'
50+
51+
# Set up BuildKit Docker container builder to be able to build
52+
# multi-platform images and export cache
53+
# https://github.com/docker/setup-buildx-action
54+
- name: Set up Docker Buildx
55+
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
56+
57+
# Login against a Docker registry except on PR
58+
# https://github.com/docker/login-action
59+
- name: Log into registry ${{ env.REGISTRY }}
60+
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
61+
with:
62+
registry: ${{ env.REGISTRY }}
63+
username: ${{ env.DOCKER_USERNAME }}
64+
password: ${{ secrets.DOCKER_TOKEN }}
65+
66+
# Extract metadata (tags, labels) for Docker
67+
# https://github.com/docker/metadata-action
68+
- name: Extract Docker metadata
69+
id: meta
70+
uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
71+
with:
72+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
73+
labels: |
74+
org.opencontainers.image.revision=${{ env.SHA }}
75+
tags: |
76+
type=edge,branch=$repo.default_branch
77+
type=semver,pattern=v{{version}}
78+
type=sha,prefix=,suffix=,format=short
79+
80+
# Build and push Docker image with Buildx (don't push on PR)
81+
# https://github.com/docker/build-push-action
82+
- name: Build CI
83+
id: build-ci
84+
uses: docker/bake-action@v6
85+
env:
86+
github_token: ${{ secrets.GITHUB_TOKEN }}
87+
with:
88+
push: false
89+
load: true
90+
set: |
91+
ci.cache-from=type=gha
92+
ci.cache-to=type=gha,mode=max
93+
tags=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:ci
94+
# tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:ci
95+
# cache-from: type=gha
96+
# cache-to: type=gha,mode=max
97+
# # tem como usar secrets como valor, env e files
98+
# #github_token=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
99+
# secrets: |
100+
# github_token=${{ secrets.MY_GITHUB_TOKEN }}
101+
102+
103+
- name: Up containers
104+
run: docker compose -f ./nestjs-project/compose.ci.yaml up -d --build
105+
106+
- name: Run tests
107+
run: echo "Running tests..."
108+
109+
# - name: Build for analysis
110+
# id: build-for-analysis
111+
# if: ${{ github.event_name == 'pull_request' }}
112+
# uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
113+
# with:
114+
# context: ./nestjs-project
115+
# file: ./nestjs-project/Dockerfile.prod
116+
# push: false
117+
# load: true
118+
# tags: ${{ steps.meta.outputs.tags }}
119+
# labels: ${{ steps.meta.outputs.labels }}
120+
# cache-from: type=gha
121+
# cache-to: type=gha,mode=max
122+
# secrets: |
123+
# github_token=${{ secrets.GITHUB_TOKEN }}
124+
125+
# - name: Analyze for critical and high CVEs
126+
# id: docker-scout-cves
127+
# uses: docker/scout-action@v1
128+
# with:
129+
# command: cves
130+
# image: ${{ steps.meta.outputs.tags }}
131+
# only-severities: critical,high
132+
# summary: true
133+
# exit-code: true
134+
# only-fixed: true
135+
136+
# - name: Analyze for all CVEs
137+
# id: docker-scout-all-cves
138+
# uses: docker/scout-action@v1
139+
# with:
140+
# command: cves
141+
# image: ${{ steps.meta.outputs.tags }}
142+
# summary: true
143+
# sarif-file: sarif.output.json
144+
145+
# - name: Upload SARIF result
146+
# id: upload-sarif
147+
# if: ${{ github.event_name != 'pull_request' }}
148+
# uses: github/codeql-action/upload-sarif@v3
149+
# with:
150+
# sarif_file: sarif.output.json
151+
152+
# # - name: Check if ":latest" tag exists
153+
# # if: github.event_name == 'pull_request'
154+
# # id: check-latest-exists
155+
# # continue-on-error: true
156+
# # run: |
157+
# # docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
158+
159+
# # - name: Docker Scout
160+
# # id: docker-scout
161+
# # if: ${{ github.event_name == 'pull_request' }}
162+
# # uses: docker/scout-action@v1
163+
# # with:
164+
# # command: compare
165+
# # image: ${{ steps.meta.outputs.tags }}
166+
# # to: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.COMPARE_TAG }}
167+
# # write-comment: true
168+
# # ignore-unchanged: true
169+
# # only-severities: critical,high
170+
# # github-token: ${{ secrets.GITHUB_TOKEN }}
171+
172+
# - name: Build final
173+
# id: build-final
174+
# uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
175+
# with:
176+
# context: ./nestjs-project
177+
# file: ./nestjs-project/Dockerfile.prod
178+
# push: ${{ github.event_name != 'pull_request' }}
179+
# tags: ${{ steps.meta.outputs.tags }}
180+
# labels: ${{ steps.meta.outputs.labels }}
181+
# cache-from: type=gha
182+
# cache-to: type=gha,mode=max
183+
# provenance: mode=max
184+
# sbom: true
185+
# secrets: |
186+
# github_token=${{ secrets.GITHUB_TOKEN }}
187+
188+
189+
190+
# # Sign the resulting Docker image digest except on PRs.
191+
# # This will only write to the public Rekor transparency log when the Docker
192+
# # repository is public to avoid leaking data. If you would like to publish
193+
# # transparency data even for private images, pass --force to cosign below.
194+
# # https://github.com/sigstore/cosign
195+
# - name: Sign the published Docker image
196+
# if: ${{ github.event_name != 'pull_request' }}
197+
# env:
198+
# # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
199+
# TAGS: ${{ steps.meta.outputs.tags }}
200+
# DIGEST: ${{ steps.build-final.outputs.digest }}
201+
# # This step uses the identity token to provision an ephemeral certificate
202+
# # against the sigstore community Fulcio instance.
203+
# run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
github_token

‎docker-bake.hcl‎

Lines changed: 37 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,46 @@
1+
variable "IMAGE_NAME" {
2+
default = "argentinaluiz/docker-ci-test"
3+
}
4+
5+
variable "TAGS" {
6+
default = ""
7+
}
8+
9+
variable "CACHE_FROM" {
10+
default = null
11+
}
12+
13+
variable "CACHE_TO" {
14+
default = null
15+
}
16+
17+
18+
119
group "default" {
2-
targets = [ "nestjs-prod" ]
20+
targets = [ "prod" ]
321
}
422

5-
target "nestjs-prod" {
23+
target "prod" {
624
context = "./nestjs-project"
7-
dockerfile = "../Dockerfile"
8-
tags = ["nestjs:latest"]
25+
dockerfile = "./Dockerfile.prod"
26+
#tags = split(",", TAGS)\
27+
secret = [
28+
{
29+
type = "env"
30+
id = "github_token"
31+
}
32+
]
933
}
1034

11-
target "nestjs-ci" {
35+
target "ci" {
1236
context = "./nestjs-project"
13-
dockerfile = "../Dockerfile"
14-
tags = ["nestjs:ci"]
37+
dockerfile = "./Dockerfile.prod"
38+
tags = [ "${IMAGE_NAME}:ci" ]
1539
target = "ci"
40+
secret = [
41+
{
42+
type = "env"
43+
id = "github_token"
44+
}
45+
]
1646
}

0 commit comments

Comments
 (0)