Skip to content

Commit 7e5136c

Browse files
moss2k13moss2k13
committed
initial commit
0 parents  commit 7e5136c

File tree

11 files changed

+754
-0
lines changed

11 files changed

+754
-0
lines changed

‎.github/workflows/pr_opened.yml‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
name: build test scan docker images
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- 'main'
7+
- 'master'
8+
paths:
9+
- app/**
10+
11+
env:
12+
DOCKERFILE_PATH: app
13+
DOCKERFILE_TAG: ${{ github.event.pull_request.head.sha }}
14+
REGISTRY_PATH: gcr.io/getindata-images-public/app
15+
REGISTRY_TYPE: "gcr.io" # If not set then will default to Docker Hub
16+
REGISTRY_USERNAME: _json_key
17+
18+
jobs:
19+
buildtestscan:
20+
runs-on: ubuntu-22.04
21+
steps:
22+
- uses: actions/checkout@v3
23+
with:
24+
fetch-depth: 100
25+
26+
- name: Set up Docker Buildx
27+
uses: docker/setup-buildx-action@v2.2.1
28+
29+
- name: Cache Docker layers
30+
uses: actions/cache@v3.2.0
31+
with:
32+
path: /tmp/.buildx-cache
33+
key: ${{ runner.os }}-buildx-${{ env.DOCKERFILE_TAG }}
34+
restore-keys: |
35+
${{ runner.os }}-buildx-
36+
37+
- name: Login to registry "${{ env.REGISTRY_TYPE }}"
38+
uses: docker/login-action@v2.1.0
39+
with:
40+
registry: ${{ env.REGISTRY_TYPE }}
41+
username: ${{ env.REGISTRY_USERNAME }}
42+
password: ${{ secrets.REGISTRY_PASSWORD }}
43+
44+
- name: Build and push Docker image
45+
uses: docker/build-push-action@v3.2.0
46+
with:
47+
context: "${{ env.DOCKERFILE_PATH }}"
48+
push: true
49+
tags: "${{ env.REGISTRY_PATH }}:${{ env.DOCKERFILE_TAG }}"
50+
cache-from: type=local,src=/tmp/.buildx-cache
51+
cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
52+
53+
- name: Run Checkov action
54+
id: checkov
55+
uses: bridgecrewio/checkov-action@v12.1347.0
56+
with:
57+
quiet: true # optional: display only failed checks
58+
soft_fail: true # optional: do not return an error code if there are failed checks
59+
framework: dockerfile
60+
output_format: github_failed_only
61+
log_level: WARNING # optional: set log level. Default WARNING
62+
dockerfile_path: "${{ env.DOCKERFILE_PATH }}/Dockerfile" # path to the Dockerfile
63+
64+
- name: Show Checkov results
65+
uses: actions-ecosystem/action-create-comment@v1
66+
with:
67+
github_token: ${{ secrets.GITHUB_TOKEN }}
68+
body: |
69+
## Checkov
70+
${{ env.CHECKOV_RESULTS }}
71+
72+
- name: Run Trivy vulnerability scanner
73+
uses: aquasecurity/trivy-action@0.8.0
74+
env:
75+
TRIVY_USERNAME: ${{ env.REGISTRY_USERNAME }}
76+
TRIVY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
77+
with:
78+
image-ref: "${{ env.REGISTRY_PATH }}:${{ env.DOCKERFILE_TAG }}"
79+
format: 'json'
80+
exit-code: '0'
81+
output: results_trivy.json
82+
ignore-unfixed: false
83+
vuln-type: 'os,library'
84+
severity: 'CRITICAL'
85+
86+
- name: Parse Trivy results
87+
run: |
88+
echo "| PkgName | InstalledVersion | Severity | Title | CVE URL |
89+
| ------ | ------ | ------ | ------ | ------ |" > results_trivy.md
90+
cat results_trivy.json | jq -r '.Results[].Vulnerabilities[] | [.PkgName, .InstalledVersion, .Severity, .Title, .PrimaryURL]| @tsv' |
91+
awk '
92+
BEGIN{ FS = "\t" } # Set field separator to tab
93+
{
94+
# Step 2: Replace all tab characters with pipe characters
95+
gsub("\t", " | ", $0)
96+
97+
# Step 3: Print fields with Markdown table formatting
98+
printf "| %s |\n", $0
99+
}' >> results_trivy.md
100+
101+
- name: Export Trivy results
102+
run: |
103+
echo 'TRIVY_RESULTS<<EOF' >> $GITHUB_ENV
104+
cat results_trivy.md >> $GITHUB_ENV
105+
echo 'EOF' >> $GITHUB_ENV
106+
107+
- name: Show Trivy results
108+
uses: actions-ecosystem/action-create-comment@v1
109+
with:
110+
github_token: ${{ secrets.GITHUB_TOKEN }}
111+
body: |
112+
## Trivy
113+
${{ env.TRIVY_RESULTS }}
114+
115+
- name: Move cache
116+
if: always() # always run even if the previous step fails
117+
run: |
118+
rm -rf /tmp/.buildx-cache
119+
mv /tmp/.buildx-cache-new /tmp/.buildx-cache

‎.github/workflows/pr_title.yml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
name: validate PR title
2+
3+
on:
4+
pull_request_target:
5+
types:
6+
- opened
7+
- edited
8+
- synchronize
9+
10+
jobs:
11+
lint_pr:
12+
name: Validate PR title
13+
runs-on: ubuntu-22.04
14+
steps:
15+
- uses: amannn/action-semantic-pull-request@v5
16+
id: lint_pr_title
17+
env:
18+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
19+
with:
20+
types: |
21+
feat
22+
fix
23+
perf
24+
docs
25+
style
26+
refactor
27+
test
28+
ci
29+
chore
30+
build
31+
requireScope: false
32+
subjectPattern: ^(?![A-Z]).+$
33+
subjectPatternError: |
34+
The description "{subject}" found in the pull request title "{title}"
35+
didn't match the configured pattern. Please ensure that the description
36+
doesn't start with an uppercase character.
37+
wip: true
38+
39+
- uses: marocchino/sticky-pull-request-comment@v2.3.1
40+
if: always() && (steps.lint_pr_title.outputs.error_message != null)
41+
with:
42+
header: pr-title-lint-error
43+
message: |
44+
Our pull requests titles follow the [Conventional Commits specification](https://www.conventionalcommits.org/en/v1.0.0/#summary)
45+
46+
Details:
47+
48+
```
49+
${{ steps.lint_pr_title.outputs.error_message }}
50+
```
51+
52+
- uses: marocchino/sticky-pull-request-comment@v2.3.1
53+
if: ${{ steps.lint_pr_title.outputs.error_message == null }}
54+
with:
55+
header: pr-title-lint-error
56+
delete: true

‎.github/workflows/release.yml‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
name: create new release with changelog
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- 'main'
7+
- 'master'
8+
types: [closed]
9+
paths:
10+
- app/**
11+
12+
env:
13+
DOCKERFILE_PATH: app
14+
DOCKERFILE_TAG: ${{ github.event.pull_request.head.sha }}
15+
REGISTRY_PATH: gcr.io/getindata-images-public/app
16+
REGISTRY_TYPE: "gcr.io" # If not set then will default to Docker Hub
17+
REGISTRY_USERNAME: _json_key
18+
19+
jobs:
20+
release:
21+
runs-on: ubuntu-22.04
22+
steps:
23+
- uses: actions/checkout@v3
24+
with:
25+
fetch-depth: 100
26+
27+
- name: Check release label
28+
id: release-label
29+
uses: actions-ecosystem/action-release-label@v1.2.0
30+
if: ${{ github.event.pull_request.merged == true }}
31+
32+
- name: Get latest tag
33+
id: get-latest-tag
34+
uses: actions-ecosystem/action-get-latest-tag@v1.6.0
35+
if: ${{ steps.release-label.outputs.level != null }}
36+
37+
- name: Bump semantic version
38+
id: bump-semver
39+
uses: actions-ecosystem/action-bump-semver@v1
40+
if: ${{ steps.release-label.outputs.level != null }}
41+
with:
42+
current_version: ${{ steps.get-latest-tag.outputs.tag }}
43+
level: ${{ steps.release-label.outputs.level }}
44+
45+
- name: Tag release
46+
id: tag-relese
47+
uses: actions-ecosystem/action-push-tag@v1
48+
if: ${{ steps.release-label.outputs.level != null }}
49+
with:
50+
tag: ${{ steps.bump-semver.outputs.new_version }}
51+
message: "${{ steps.bump-semver.outputs.new_version }}: PR #${{ github.event.pull_request.number }} ${{ github.event.pull_request.title }}"
52+
53+
- name: Login to registry ${{ env.REGISTRY_TYPE }}
54+
uses: docker/login-action@v2.1.0
55+
if: ${{ steps.release-label.outputs.level != null }}
56+
with:
57+
registry: ${{ env.REGISTRY_TYPE }}
58+
username: ${{ env.REGISTRY_USERNAME }}
59+
password: ${{ secrets.REGISTRY_PASSWORD }}
60+
61+
- name: Tag final docker image
62+
if: ${{ steps.release-label.outputs.level != null }}
63+
run: |
64+
docker pull ${{ env.REGISTRY_PATH }}:${{ github.event.pull_request.head.sha }}
65+
docker tag ${{ env.REGISTRY_PATH }}:${{ github.event.pull_request.head.sha }} ${{ env.REGISTRY_PATH }}:${{ steps.bump-semver.outputs.new_version }}
66+
docker push ${{ env.REGISTRY_PATH }}:${{ steps.bump-semver.outputs.new_version }}
67+
68+
- name: Generate new release with changelog
69+
id: release-with-changelog
70+
uses: fregante/release-with-changelog@v3.6.0
71+
if: ${{ steps.bump-semver.outputs.new_version != null }}
72+
with:
73+
token: "${{ secrets.GITHUB_TOKEN }}"
74+
exclude: '^chore|^docs|^ci|^build|^refactor|^style|^v?\d+\.\d+\.\d+'
75+
tag: "${{ steps.bump-semver.outputs.new_version }}"
76+
title: "Version ${{ steps.bump-semver.outputs.new_version }}"
77+
commit-template: "- {title} ← {hash}"
78+
skip-on-empty: true
79+
template: |
80+
### Changelog
81+
82+
{commits}
83+
84+
{range}
85+
86+
The new image is available at ${{ env.REGISTRY_PATH }}:${{ steps.bump-semver.outputs.new_version }} :tada:
87+
88+
- name: Comment PR
89+
id: add-comment
90+
uses: actions-ecosystem/action-create-comment@v1
91+
if: ${{ steps.bump-semver.outputs.new_version != null }}
92+
with:
93+
github_token: "${{ secrets.GITHUB_TOKEN }}"
94+
body: |
95+
The new version [${{ steps.bump-semver.outputs.new_version }}](https://github.com/${{ github.repository }}/releases/tag/${{ steps.bump-semver.outputs.new_version }}) has been released :tada:

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
### Examples: https://github.com/github/gitignore

0 commit comments

Comments
 (0)