Skip to content

Commit 493c89d

Browse files
argentinaluizargentinaluiz
committed
add CI workflow for Docker image build, testing, and vulnerability analysis
1 parent 22e56b0 commit 493c89d

File tree

2 files changed

+295
-0
lines changed

2 files changed

+295
-0
lines changed

‎.github/workflows/ci-bake.yaml‎

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
name: CI Bake
2+
3+
on:
4+
push:
5+
branches: [ "main" ]
6+
# Publish semver tags as releases.
7+
tags: [ 'v*.*.*' ]
8+
pull_request:
9+
branches: [ "main" ]
10+
11+
env:
12+
REGISTRY: docker.io
13+
DOCKER_USERNAME: argentinaluiz
14+
IMAGE_NAME: argentinaluiz/docker-prod-test
15+
SHA: ${{ github.event.pull_request.head.sha || github.event.after }}
16+
jobs:
17+
ci:
18+
19+
runs-on: ubuntu-latest
20+
permissions:
21+
contents: read # Ler o conteúdo do repositório
22+
packages: write # Permitir publicar pacotes no GitHub Packages
23+
pull-requests: write # Permitir criar e atualizar pull requests
24+
security-events: write # Enviar eventos de segurança para o Github Security
25+
id-token: write # Permitir emitir tokens OIDC para autenticação com provedores externos
26+
27+
steps:
28+
- name: Checkout repository
29+
uses: actions/checkout@v4
30+
31+
- name: Set up Docker Buildx
32+
uses: docker/setup-buildx-action@v3
33+
34+
- name: Log into registry ${{ env.REGISTRY }}
35+
uses: docker/login-action@v3
36+
with:
37+
registry: ${{ env.REGISTRY }}
38+
username: ${{ env.DOCKER_USERNAME }}
39+
password: ${{ secrets.DOCKER_TOKEN }}
40+
41+
- name: Build for CI
42+
id: build-ci
43+
uses: docker/bake-action@v6
44+
env:
45+
github_token: ${{ secrets.GITHUB_TOKEN }}
46+
with:
47+
files: ./ci/nestjs-project/docker-bake.hcl
48+
push: false
49+
load: true
50+
targets: ci
51+
set: |
52+
ci.cache-from=type=gha
53+
ci.cache-to=type=gha,mode=max
54+
ci.tags=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:ci
55+
56+
- name: Up containers
57+
run: docker compose -f ./src/ci/nestjs-project/compose.ci.yaml up -d --wait-timeout 10
58+
59+
- name: Run tests
60+
run: echo "Running tests..."
61+
62+
- name: Build for analysis
63+
id: build-for-analysis
64+
uses: docker/bake-action@v6
65+
env:
66+
github_token: ${{ secrets.GITHUB_TOKEN }}
67+
with:
68+
push: false
69+
load: true
70+
targets: prod
71+
files: |
72+
./ci/nestjs-project/docker-bake.hcl
73+
cwd://${{ steps.meta.outputs.bake-file }}
74+
set: |
75+
prod.cache-from=type=gha
76+
prod.cache-to=type=gha,mode=max
77+
prod.tags=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.SHA }}
78+
79+
- name: Analyze for critical and high CVEs
80+
id: docker-scout-cves
81+
uses: docker/scout-action@v1
82+
with:
83+
command: cves
84+
image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.SHA }}
85+
only-severities: critical,high
86+
only-fixed: true
87+
summary: true # publicar github actions e pull request
88+
exit-code: true
89+
90+
- name: Analyze for all CVEs
91+
id: docker-scout-all-cves
92+
uses: docker/scout-action@v1
93+
with:
94+
command: cves
95+
image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.SHA }}
96+
summary: true
97+
sarif-file: sarif.output.json
98+
99+
- name: Upload SARIF result
100+
id: upload-sarif
101+
if: ${{ github.event_name != 'pull_request' }}
102+
uses: github/codeql-action/upload-sarif@v3
103+
with:
104+
sarif_file: sarif.output.json
105+
106+
- name: Extract Docker metadata
107+
id: meta
108+
if: github.event_name != 'pull_request'
109+
uses: docker/[email protected]
110+
with:
111+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
112+
labels: |
113+
org.opencontainers.image.revision=${{ env.SHA }}
114+
tags: |
115+
type=edge,branch=$repo.default_branch
116+
type=semver,pattern=v{{version}}
117+
type=sha,prefix=,suffix=,format=short
118+
119+
- name: Build final
120+
id: build-final
121+
if: github.event_name != 'pull_request'
122+
uses: docker/bake-action@v6
123+
env:
124+
github_token: ${{ secrets.GITHUB_TOKEN }}
125+
with:
126+
push: ${{ github.event_name != 'pull_request' }}
127+
provenance: mode=max
128+
sbom: true
129+
targets: prod
130+
files: |
131+
./ci/nestjs-project/docker-bake.hcl
132+
cwd://${{ steps.meta.outputs.bake-file }}
133+
set: |
134+
prod.cache-from=type=gha
135+
prod.cache-to=type=gha,mode=max
136+
prod.tags=${{ steps.meta.outputs.tags }}
137+
138+
- name: Install cosign
139+
if: github.event_name != 'pull_request'
140+
uses: sigstore/[email protected]
141+
with:
142+
cosign-release: 'v2.2.4'
143+
144+
- name: Sign the published Docker image
145+
if: github.event_name != 'pull_request'
146+
env:
147+
TAGS: ${{ steps.meta.outputs.tags }}
148+
DIGEST: ${{ fromJSON(steps.build-final.outputs.metadata).default['containerimage.digest'] }}
149+
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
150+

‎.github/workflows/ci.txt‎

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [ "main" ]
6+
# Publish semver tags as releases.
7+
tags: [ 'v*.*.*' ]
8+
pull_request:
9+
branches: [ "main" ]
10+
11+
env:
12+
REGISTRY: docker.io
13+
DOCKER_USERNAME: argentinaluiz
14+
IMAGE_NAME: argentinaluiz/docker-prod-test
15+
SHA: ${{ github.event.pull_request.head.sha || github.event.after }}
16+
jobs:
17+
ci:
18+
19+
runs-on: ubuntu-latest
20+
permissions:
21+
contents: read # Ler o conteúdo do repositório
22+
packages: write # Permitir publicar pacotes no GitHub Packages
23+
pull-requests: write # Permitir criar e atualizar pull requests
24+
security-events: write # Enviar eventos de segurança para o Github Security
25+
id-token: write # Permitir emitir tokens OIDC para autenticação com provedores externos
26+
27+
steps:
28+
- name: Checkout repository
29+
uses: actions/checkout@v4
30+
31+
- name: Set up Docker Buildx
32+
uses: docker/setup-buildx-action@v3
33+
34+
- name: Log into registry ${{ env.REGISTRY }}
35+
uses: docker/login-action@v3
36+
with:
37+
registry: ${{ env.REGISTRY }}
38+
username: ${{ env.DOCKER_USERNAME }}
39+
password: ${{ secrets.DOCKER_TOKEN }}
40+
41+
- name: Build for CI
42+
id: build-ci
43+
uses: docker/[email protected]
44+
with:
45+
context: ./src/ci/nestjs-project
46+
file: ./src/ci/nestjs-project/Dockerfile.prod
47+
push: false
48+
load: true # driver docker-container
49+
target: ci
50+
tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:ci
51+
cache-from: type=gha
52+
cache-to: type=gha,mode=max
53+
secrets: |
54+
github_token=${{ secrets.MY_GITHUB_TOKEN }}
55+
56+
- name: Up containers
57+
run: docker compose -f ./src/ci/nestjs-project/compose.ci.yaml up -d --wait-timeout 10
58+
59+
- name: Run tests
60+
run: echo "Running tests..."
61+
62+
- name: Build for analysis
63+
id: build-for-analysis
64+
uses: docker/[email protected]
65+
with:
66+
context: ./src/ci/nestjs-project
67+
file: ./src/ci/nestjs-project/Dockerfile.prod
68+
push: false
69+
load: true
70+
tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.SHA }}
71+
cache-from: type=gha
72+
cache-to: type=gha,mode=max
73+
secrets: |
74+
github_token=${{ secrets.MY_GITHUB_TOKEN }}
75+
76+
- name: Analyze for critical and high CVEs
77+
id: docker-scout-cves
78+
uses: docker/scout-action@v1
79+
with:
80+
command: cves
81+
image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.SHA }}
82+
only-severities: critical,high
83+
only-fixed: true
84+
summary: true # publicar github actions e pull request
85+
exit-code: true
86+
87+
- name: Analyze for all CVEs
88+
id: docker-scout-all-cves
89+
uses: docker/scout-action@v1
90+
with:
91+
command: cves
92+
image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.SHA }}
93+
summary: true
94+
sarif-file: sarif.output.json
95+
96+
- name: Upload SARIF result
97+
id: upload-sarif
98+
if: ${{ github.event_name != 'pull_request' }}
99+
uses: github/codeql-action/upload-sarif@v3
100+
with:
101+
sarif_file: sarif.output.json
102+
103+
- name: Extract Docker metadata
104+
id: meta
105+
if: github.event_name != 'pull_request'
106+
uses: docker/[email protected]
107+
with:
108+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
109+
labels: |
110+
org.opencontainers.image.revision=${{ env.SHA }}
111+
tags: |
112+
type=edge,branch=$repo.default_branch
113+
type=semver,pattern=v{{version}}
114+
type=sha,prefix=,suffix=,format=short
115+
116+
- name: Build final
117+
id: build-final
118+
if: github.event_name != 'pull_request'
119+
uses: docker/[email protected]
120+
with:
121+
context: ./src/ci/nestjs-project
122+
file: ./src/ci/nestjs-project/Dockerfile.prod
123+
push: true
124+
tags: ${{ steps.meta.outputs.tags }}
125+
labels: ${{ steps.meta.outputs.labels }}
126+
cache-from: type=gha
127+
cache-to: type=gha,mode=max
128+
provenance: mode=max
129+
sbom: true
130+
secrets: |
131+
github_token=${{ secrets.MY_GITHUB_TOKEN }}
132+
133+
- name: Install cosign
134+
if: github.event_name != 'pull_request'
135+
uses: sigstore/[email protected]
136+
with:
137+
cosign-release: 'v2.2.4'
138+
139+
- name: Sign the published Docker image
140+
if: github.event_name != 'pull_request'
141+
env:
142+
TAGS: ${{ steps.meta.outputs.tags }}
143+
DIGEST: ${{ steps.build-final.outputs.digest }}
144+
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
145+

0 commit comments

Comments
 (0)