fix: Update action versions and permissions in Docker CI workflow (#6) #15
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Docker Image CI | |
| on: | |
| push: | |
| branches: [ main ] | |
| paths-ignore: | |
| - '**/*.md' | |
| pull_request: | |
| branches: [ main ] | |
| paths-ignore: | |
| - '**/*.md' | |
| permissions: | |
| contents: read | |
| security-events: write | |
| env: | |
| REGISTRY_IMAGE: fok666/gitlab-runner | |
| GHCR_IMAGE: ghcr.io/${{ github.repository }} | |
| jobs: | |
| build-and-test: | |
| name: Build and Test (${{ matrix.profile }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| profile: | |
| - name: full | |
| docker: 1 | |
| azure_cli: 1 | |
| aws_cli: 1 | |
| powershell: 1 | |
| azure_pwsh: 1 | |
| aws_pwsh: 1 | |
| kubectl: 1 | |
| kubelogin: 1 | |
| kustomize: 1 | |
| helm: 1 | |
| jq: 1 | |
| yq: 1 | |
| terraform: 1 | |
| opentofu: 1 | |
| terraspace: 1 | |
| sudo: 1 | |
| - name: minimal | |
| docker: 0 | |
| azure_cli: 0 | |
| aws_cli: 0 | |
| powershell: 0 | |
| azure_pwsh: 0 | |
| aws_pwsh: 0 | |
| kubectl: 0 | |
| kubelogin: 0 | |
| kustomize: 0 | |
| helm: 0 | |
| jq: 0 | |
| yq: 0 | |
| terraform: 0 | |
| opentofu: 0 | |
| terraspace: 0 | |
| sudo: 1 | |
| - name: k8s | |
| docker: 1 | |
| azure_cli: 0 | |
| aws_cli: 0 | |
| powershell: 0 | |
| azure_pwsh: 0 | |
| aws_pwsh: 0 | |
| kubectl: 1 | |
| kubelogin: 1 | |
| kustomize: 1 | |
| helm: 1 | |
| jq: 1 | |
| yq: 1 | |
| terraform: 0 | |
| opentofu: 0 | |
| terraspace: 0 | |
| sudo: 1 | |
| - name: iac | |
| docker: 1 | |
| azure_cli: 1 | |
| aws_cli: 1 | |
| powershell: 0 | |
| azure_pwsh: 0 | |
| aws_pwsh: 0 | |
| kubectl: 0 | |
| kubelogin: 0 | |
| kustomize: 0 | |
| helm: 0 | |
| jq: 1 | |
| yq: 1 | |
| terraform: 1 | |
| opentofu: 1 | |
| terraspace: 1 | |
| sudo: 1 | |
| - name: iac-pwsh | |
| docker: 1 | |
| azure_cli: 1 | |
| aws_cli: 1 | |
| powershell: 1 | |
| azure_pwsh: 1 | |
| aws_pwsh: 1 | |
| kubectl: 0 | |
| kubelogin: 0 | |
| kustomize: 0 | |
| helm: 0 | |
| jq: 1 | |
| yq: 1 | |
| terraform: 1 | |
| opentofu: 1 | |
| terraspace: 1 | |
| sudo: 1 | |
| steps: | |
| - name: Check out the repo | |
| uses: actions/checkout@v6 | |
| - name: Extract versions from Dockerfile | |
| id: versions | |
| run: | | |
| AGENT_VERSION=$(grep '^ARG AGENT_VERSION=' Dockerfile | cut -d'=' -f2) | |
| OS_VERSION=$(grep '^FROM ubuntu:' Dockerfile | cut -d':' -f2) | |
| echo "agent=${AGENT_VERSION}" >> $GITHUB_OUTPUT | |
| echo "os=${OS_VERSION}" >> $GITHUB_OUTPUT | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Extract metadata (tags, labels) for Docker | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: | | |
| ${{ env.REGISTRY_IMAGE }} | |
| ${{ env.GHCR_IMAGE }} | |
| tags: | | |
| type=raw,value=latest,enable={{is_default_branch}} | |
| type=ref,event=branch | |
| type=ref,event=pr | |
| type=sha,prefix={{branch}}- | |
| - name: Get the date | |
| id: date | |
| run: echo "date=$(date +'%Y%m%d')" >> $GITHUB_OUTPUT | |
| - name: Extract branch name | |
| id: extract_branch | |
| shell: bash | |
| run: | | |
| ref="${GITHUB_REF#refs/heads/}" | |
| ref="${ref#refs/pull/}" | |
| ref="${ref//\//-}" | |
| echo "branch=$ref" >> $GITHUB_OUTPUT | |
| - name: Build Docker image | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| push: false | |
| build-args: | | |
| ADD_DOCKER=${{ matrix.profile.docker }} | |
| ADD_AZURE_CLI=${{ matrix.profile.azure_cli }} | |
| ADD_AWS_CLI=${{ matrix.profile.aws_cli }} | |
| ADD_POWERSHELL=${{ matrix.profile.powershell }} | |
| ADD_AZURE_PWSH_CLI=${{ matrix.profile.azure_pwsh }} | |
| ADD_AWS_PWSH_CLI=${{ matrix.profile.aws_pwsh }} | |
| ADD_KUBECTL=${{ matrix.profile.kubectl }} | |
| ADD_KUBELOGIN=${{ matrix.profile.kubelogin }} | |
| ADD_KUSTOMIZE=${{ matrix.profile.kustomize }} | |
| ADD_HELM=${{ matrix.profile.helm }} | |
| ADD_YQ=${{ matrix.profile.yq }} | |
| ADD_JQ=${{ matrix.profile.jq }} | |
| ADD_TERRAFORM=${{ matrix.profile.terraform }} | |
| ADD_OPENTOFU=${{ matrix.profile.opentofu }} | |
| ADD_TERRASPACE=${{ matrix.profile.terraspace }} | |
| ADD_SUDO=${{ matrix.profile.sudo }} | |
| tags: ${{ env.REGISTRY_IMAGE }}:test-${{ matrix.profile.name }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha,scope=${{ matrix.profile.name }} | |
| cache-to: type=gha,mode=max,scope=${{ matrix.profile.name }} | |
| outputs: type=docker,dest=/tmp/image-${{ matrix.profile.name }}.tar | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: docker-image-${{ matrix.profile.name }} | |
| path: /tmp/image-${{ matrix.profile.name }}.tar | |
| retention-days: 1 | |
| - name: Clean up disk space | |
| if: always() | |
| run: | | |
| rm -f /tmp/image-${{ matrix.profile.name }}.tar | |
| docker system prune -af --volumes | |
| security-scan: | |
| name: Security Scan (${{ matrix.profile }}) | |
| runs-on: ubuntu-latest | |
| needs: build-and-test | |
| strategy: | |
| matrix: | |
| profile: [full, minimal, k8s, iac, iac-pwsh] | |
| steps: | |
| - name: Download artifact | |
| uses: actions/download-artifact@v7 | |
| with: | |
| name: docker-image-${{ matrix.profile }} | |
| path: /tmp | |
| - name: Load Docker image | |
| run: docker load --input /tmp/image-${{ matrix.profile }}.tar | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: ${{ env.REGISTRY_IMAGE }}:test-${{ matrix.profile }} | |
| format: 'sarif' | |
| output: 'trivy-results-${{ matrix.profile }}.sarif' | |
| severity: 'CRITICAL,HIGH' | |
| - name: Upload Trivy results to GitHub Security | |
| uses: github/codeql-action/upload-sarif@v4 | |
| if: always() | |
| with: | |
| sarif_file: 'trivy-results-${{ matrix.profile }}.sarif' | |
| - name: Run Trivy vulnerability scanner (table output) | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: ${{ env.REGISTRY_IMAGE }}:test-${{ matrix.profile }} | |
| format: 'table' | |
| exit-code: '0' | |
| severity: 'CRITICAL,HIGH' | |
| - name: Clean up disk space | |
| if: always() | |
| run: | | |
| rm -f /tmp/image-${{ matrix.profile }}.tar | |
| docker system prune -af --volumes | |
| test: | |
| name: Test Image (${{ matrix.profile }}) | |
| runs-on: ubuntu-latest | |
| needs: build-and-test | |
| strategy: | |
| matrix: | |
| profile: [full, minimal, k8s, iac, iac-pwsh] | |
| steps: | |
| - name: Check out the repo | |
| uses: actions/checkout@v6 | |
| - name: Download artifact | |
| uses: actions/download-artifact@v7 | |
| with: | |
| name: docker-image-${{ matrix.profile }} | |
| path: /tmp | |
| - name: Load Docker image | |
| run: docker load --input /tmp/image-${{ matrix.profile }}.tar | |
| - name: Test image runs | |
| run: | | |
| docker run --rm --entrypoint /bin/sh ${{ env.REGISTRY_IMAGE }}:test-${{ matrix.profile }} -c "echo 'Container starts successfully'" | |
| - name: Run test-tools.sh if exists | |
| run: | | |
| if [ -f ./test-tools.sh ]; then | |
| chmod +x ./test-tools.sh | |
| ./test-tools.sh | |
| else | |
| echo "No test-tools.sh found, skipping" | |
| fi | |
| - name: Clean up disk space | |
| if: always() | |
| run: | | |
| rm -f /tmp/image-${{ matrix.profile }}.tar | |
| docker system prune -af --volumes | |
| push: | |
| name: Push to Registries (${{ matrix.profile }}) | |
| runs-on: ubuntu-latest | |
| needs: [build-and-test, security-scan, test] | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| strategy: | |
| matrix: | |
| profile: | |
| - name: full | |
| docker: 1 | |
| azure_cli: 1 | |
| aws_cli: 1 | |
| powershell: 1 | |
| azure_pwsh: 1 | |
| aws_pwsh: 1 | |
| kubectl: 1 | |
| kubelogin: 1 | |
| kustomize: 1 | |
| helm: 1 | |
| jq: 1 | |
| yq: 1 | |
| terraform: 1 | |
| opentofu: 1 | |
| terraspace: 1 | |
| sudo: 1 | |
| - name: minimal | |
| docker: 0 | |
| azure_cli: 0 | |
| aws_cli: 0 | |
| powershell: 0 | |
| azure_pwsh: 0 | |
| aws_pwsh: 0 | |
| kubectl: 0 | |
| kubelogin: 0 | |
| kustomize: 0 | |
| helm: 0 | |
| jq: 0 | |
| yq: 0 | |
| terraform: 0 | |
| opentofu: 0 | |
| terraspace: 0 | |
| sudo: 1 | |
| - name: k8s | |
| docker: 1 | |
| azure_cli: 0 | |
| aws_cli: 0 | |
| powershell: 0 | |
| azure_pwsh: 0 | |
| aws_pwsh: 0 | |
| kubectl: 1 | |
| kubelogin: 1 | |
| kustomize: 1 | |
| helm: 1 | |
| jq: 1 | |
| yq: 1 | |
| terraform: 0 | |
| opentofu: 0 | |
| terraspace: 0 | |
| sudo: 1 | |
| - name: iac | |
| docker: 1 | |
| azure_cli: 1 | |
| aws_cli: 1 | |
| powershell: 0 | |
| azure_pwsh: 0 | |
| aws_pwsh: 0 | |
| kubectl: 0 | |
| kubelogin: 0 | |
| kustomize: 0 | |
| helm: 0 | |
| jq: 1 | |
| yq: 1 | |
| terraform: 1 | |
| opentofu: 1 | |
| terraspace: 1 | |
| sudo: 1 | |
| - name: iac-pwsh | |
| docker: 1 | |
| azure_cli: 1 | |
| aws_cli: 1 | |
| powershell: 1 | |
| azure_pwsh: 1 | |
| aws_pwsh: 1 | |
| kubectl: 0 | |
| kubelogin: 0 | |
| kustomize: 0 | |
| helm: 0 | |
| jq: 1 | |
| yq: 1 | |
| terraform: 1 | |
| opentofu: 1 | |
| terraspace: 1 | |
| sudo: 1 | |
| steps: | |
| - name: Check out the repo | |
| uses: actions/checkout@v6 | |
| - name: Extract versions from Dockerfile | |
| id: versions | |
| run: | | |
| AGENT_VERSION=$(grep '^ARG AGENT_VERSION=' Dockerfile | cut -d'=' -f2) | |
| OS_VERSION=$(grep '^FROM ubuntu:' Dockerfile | cut -d':' -f2) | |
| echo "agent=${AGENT_VERSION}" >> $GITHUB_OUTPUT | |
| echo "os=${OS_VERSION}" >> $GITHUB_OUTPUT | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Log in to Docker Hub | |
| uses: docker/login-action@v3 | |
| with: | |
| username: ${{ secrets.DOCKER_USERNAME }} | |
| password: ${{ secrets.DOCKER_PASSWORD }} | |
| - name: Log in to GitHub Container Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata (tags, labels) for Docker | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: | | |
| ${{ env.REGISTRY_IMAGE }} | |
| ${{ env.GHCR_IMAGE }} | |
| - name: Get the date | |
| id: date | |
| run: echo "date=$(date +'%Y%m%d')" >> $GITHUB_OUTPUT | |
| - name: Build and push Docker image | |
| id: build-push | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| build-args: | | |
| ADD_DOCKER=${{ matrix.profile.docker }} | |
| ADD_AZURE_CLI=${{ matrix.profile.azure_cli }} | |
| ADD_AWS_CLI=${{ matrix.profile.aws_cli }} | |
| ADD_POWERSHELL=${{ matrix.profile.powershell }} | |
| ADD_AZURE_PWSH_CLI=${{ matrix.profile.azure_pwsh }} | |
| ADD_AWS_PWSH_CLI=${{ matrix.profile.aws_pwsh }} | |
| ADD_KUBECTL=${{ matrix.profile.kubectl }} | |
| ADD_KUBELOGIN=${{ matrix.profile.kubelogin }} | |
| ADD_KUSTOMIZE=${{ matrix.profile.kustomize }} | |
| ADD_HELM=${{ matrix.profile.helm }} | |
| ADD_YQ=${{ matrix.profile.yq }} | |
| ADD_JQ=${{ matrix.profile.jq }} | |
| ADD_TERRAFORM=${{ matrix.profile.terraform }} | |
| ADD_OPENTOFU=${{ matrix.profile.opentofu }} | |
| ADD_TERRASPACE=${{ matrix.profile.terraspace }} | |
| ADD_SUDO=${{ matrix.profile.sudo }} | |
| tags: | | |
| ${{ env.REGISTRY_IMAGE }}:${{ steps.versions.outputs.agent }}-ubuntu${{ steps.versions.outputs.os }}-${{ matrix.profile.name }}-${{ steps.date.outputs.date }} | |
| ${{ env.REGISTRY_IMAGE }}:${{ steps.versions.outputs.agent }}-ubuntu${{ steps.versions.outputs.os }}-${{ matrix.profile.name }} | |
| ${{ env.REGISTRY_IMAGE }}:${{ steps.versions.outputs.agent }}-${{ matrix.profile.name }} | |
| ${{ env.REGISTRY_IMAGE }}:latest-${{ matrix.profile.name }} | |
| ${{ env.GHCR_IMAGE }}:${{ steps.versions.outputs.agent }}-ubuntu${{ steps.versions.outputs.os }}-${{ matrix.profile.name }}-${{ steps.date.outputs.date }} | |
| ${{ env.GHCR_IMAGE }}:${{ steps.versions.outputs.agent }}-ubuntu${{ steps.versions.outputs.os }}-${{ matrix.profile.name }} | |
| ${{ env.GHCR_IMAGE }}:${{ steps.versions.outputs.agent }}-${{ matrix.profile.name }} | |
| ${{ env.GHCR_IMAGE }}:latest-${{ matrix.profile.name }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha,scope=${{ matrix.profile.name }} | |
| cache-to: type=gha,mode=max,scope=${{ matrix.profile.name }} | |
| sbom: true | |
| provenance: true | |
| - name: Generate SBOM | |
| uses: anchore/sbom-action@v0 | |
| with: | |
| image: ${{ env.REGISTRY_IMAGE }}:${{ steps.versions.outputs.agent }}-${{ matrix.profile.name }} | |
| format: spdx-json | |
| output-file: sbom-spdx-${{ matrix.profile.name }}.json | |
| - name: Upload SBOM | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: sbom-${{ matrix.profile.name }} | |
| path: sbom-spdx-${{ matrix.profile.name }}.json | |
| retention-days: 30 | |
| - name: Add "latest" tag for full profile | |
| if: matrix.profile.name == 'full' | |
| run: | | |
| docker buildx imagetools create \ | |
| ${{ env.REGISTRY_IMAGE }}:${{ steps.versions.outputs.agent }}-${{ matrix.profile.name }} \ | |
| --tag ${{ env.REGISTRY_IMAGE }}:latest | |
| docker buildx imagetools create \ | |
| ${{ env.GHCR_IMAGE }}:${{ steps.versions.outputs.agent }}-${{ matrix.profile.name }} \ | |
| --tag ${{ env.GHCR_IMAGE }}:latest | |