Skip to content

Commit 09be359

Browse files
argentinaluizargentinaluiz
committed
feat: add CI workflow and Docker bake configuration for improved build and test processes
1 parent 2fe839f commit 09be359

File tree

3 files changed

+155
-3
lines changed

3 files changed

+155
-3
lines changed

‎.github/workflows/ci-bake.yaml‎ renamed to ‎.github/workflows/ci-bake.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -122,11 +122,11 @@ jobs:
122122
env:
123123
github_token: ${{ secrets.GITHUB_TOKEN }}
124124
with:
125-
push: ${{ github.event_name != 'pull_request' }}
125+
push: true
126126
provenance: mode=max
127127
sbom: true
128128
targets: prod
129-
files: |
129+
files: |
130130
./src/ci/docker-bake.hcl
131131
cwd://${{ steps.meta.outputs.bake-file }}
132132
set: |

‎.github/workflows/ci.yaml‎

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [ "main" ]
6+
# Publish semver tags as releases.
7+
tags: [ 'v*.*.*' ]
8+
pull_request:
9+
branches: [ "main" ]
10+
11+
env:
12+
REGISTRY: docker.io
13+
DOCKER_USERNAME: argentinaluiz
14+
IMAGE_NAME: argentinaluiz/docker-prod-test
15+
SHA: ${{ github.event.pull_request.head.sha || github.event.after }}
16+
CLOUD_BUILDER_NAME: test-ci
17+
jobs:
18+
ci:
19+
20+
runs-on: ubuntu-latest
21+
permissions:
22+
contents: read # Ler o conteúdo do repositório
23+
packages: write # Permitir publicar pacotes no GitHub Packages
24+
pull-requests: write # Permitir criar e atualizar pull requests
25+
security-events: write # Enviar eventos de segurança para o Github Security
26+
id-token: write # Permitir emitir tokens OIDC para autenticação com provedores externos
27+
28+
steps:
29+
- name: Checkout repository
30+
uses: actions/checkout@v4
31+
32+
- name: Set up Docker Buildx
33+
uses: docker/setup-buildx-action@v3
34+
with:
35+
driver: cloud
36+
endpoint: "${{ env.DOCKER_USERNAME }}/${{ env.CLOUD_BUILDER_NAME }}"
37+
install: true
38+
39+
- name: Log into registry ${{ env.REGISTRY }}
40+
uses: docker/login-action@v3
41+
with:
42+
registry: ${{ env.REGISTRY }}
43+
username: ${{ env.DOCKER_USERNAME }}
44+
password: ${{ secrets.DOCKER_TOKEN }}
45+
46+
- name: Build for CI
47+
id: build-ci
48+
uses: docker/[email protected]
49+
with:
50+
context: ./src/ci/nestjs-project
51+
file: ./src/ci/nestjs-project/Dockerfile.prod
52+
push: false
53+
load: true # driver docker-container
54+
target: ci
55+
tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:ci
56+
cache-from: type=gha
57+
cache-to: type=gha,mode=max
58+
secrets: |
59+
github_token=${{ secrets.MY_GITHUB_TOKEN }}
60+
61+
- name: Up containers
62+
run: docker compose -f ./src/ci/nestjs-project/compose.ci.yaml up -d --wait-timeout 10
63+
64+
- name: Run tests
65+
run: echo "Running tests..."
66+
67+
- name: Build for analysis
68+
id: build-for-analysis
69+
uses: docker/[email protected]
70+
with:
71+
context: ./src/ci/nestjs-project
72+
file: ./src/ci/nestjs-project/Dockerfile.prod
73+
push: false
74+
load: true
75+
tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.SHA }}
76+
cache-from: type=gha
77+
cache-to: type=gha,mode=max
78+
secrets: |
79+
github_token=${{ secrets.MY_GITHUB_TOKEN }}
80+
81+
- name: Analyze for critical and high CVEs
82+
id: docker-scout-cves
83+
uses: docker/scout-action@v1
84+
with:
85+
command: cves
86+
image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.SHA }}
87+
only-severities: critical,high
88+
only-fixed: true
89+
summary: true # publicar github actions e pull request
90+
exit-code: true
91+
92+
- name: Analyze for all CVEs
93+
id: docker-scout-all-cves
94+
uses: docker/scout-action@v1
95+
with:
96+
command: cves
97+
image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.SHA }}
98+
summary: true
99+
sarif-file: sarif.output.json
100+
101+
- name: Upload SARIF result
102+
id: upload-sarif
103+
if: ${{ github.event_name != 'pull_request' }}
104+
uses: github/codeql-action/upload-sarif@v3
105+
with:
106+
sarif_file: sarif.output.json
107+
108+
- name: Extract Docker metadata
109+
id: meta
110+
if: github.event_name != 'pull_request'
111+
uses: docker/[email protected]
112+
with:
113+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
114+
labels: |
115+
org.opencontainers.image.revision=${{ env.SHA }}
116+
tags: |
117+
type=edge,branch=$repo.default_branch
118+
type=semver,pattern=v{{version}}
119+
type=sha,prefix=,suffix=,format=short
120+
121+
- name: Build final
122+
id: build-final
123+
if: github.event_name != 'pull_request'
124+
uses: docker/[email protected]
125+
with:
126+
context: ./src/ci/nestjs-project
127+
file: ./src/ci/nestjs-project/Dockerfile.prod
128+
push: true
129+
tags: ${{ steps.meta.outputs.tags }}
130+
labels: ${{ steps.meta.outputs.labels }}
131+
cache-from: type=gha
132+
cache-to: type=gha,mode=max
133+
provenance: mode=max
134+
sbom: true
135+
secrets: |
136+
github_token=${{ secrets.MY_GITHUB_TOKEN }}
137+
138+
- name: Install cosign
139+
if: github.event_name != 'pull_request'
140+
uses: sigstore/[email protected]
141+
with:
142+
cosign-release: 'v2.2.4'
143+
144+
- name: Sign the published Docker image
145+
if: github.event_name != 'pull_request'
146+
env:
147+
TAGS: ${{ steps.meta.outputs.tags }}
148+
DIGEST: ${{ steps.build-final.outputs.digest }}
149+
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
150+

‎src/ci/docker-bake.hcl‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,8 @@ variable "IMAGE_NAME" {
33
default = "argentinaluiz/docker-prod-test"
44
}
55

6-
target "docker-metadata-action" {}
6+
target "docker-metadata-action" {
7+
}
78

89

910
group "default" {
@@ -14,6 +15,7 @@ target "prod" {
1415
inherits = ["docker-metadata-action"]
1516
context = "./src/ci/nestjs-project"
1617
dockerfile = "./Dockerfile.prod"
18+
tags = [ "${IMAGE_NAME}:latest" ]
1719
secret = [
1820
{
1921
type = "env"

0 commit comments

Comments
 (0)