Skip to content

Commit eb163e8

Browse files
manzil-infinity180manzil-infinity180
committed
wip: build, push
Signed-off-by: Rahul Vishwakarma <[email protected]>
1 parent 31479e4 commit eb163e8

File tree

4 files changed

+265
-0
lines changed

4 files changed

+265
-0
lines changed

‎.github/dependabot.yml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: gomod
4+
directories:
5+
- /
6+
schedule:
7+
interval: weekly
8+
rebase-strategy: disabled
9+
groups:
10+
kubernetes:
11+
patterns:
12+
- k8s.io/*
13+
# sigstore:
14+
# patterns:
15+
# - github.com/sigstore/sigstore/*
16+
- package-ecosystem: github-actions
17+
directories:
18+
- /
19+
- /.github/actions/*/
20+
schedule:
21+
interval: weekly
22+
rebase-strategy: disabled
23+
# - package-ecosystem: docker
24+
# directory: /.devcontainer
25+
# schedule:
26+
# interval: daily
27+
# rebase-strategy: disabled

‎.github/workflows/helm-release.yml

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
name: helm-release
2+
3+
on:
4+
pull_request:
5+
6+
#on:
7+
# push:
8+
# tags:
9+
# - 'defender-v*'
10+
11+
permissions:
12+
contents: write
13+
packages: write
14+
id-token: write
15+
pages: write
16+
17+
jobs:
18+
helm-release:
19+
runs-on: ubuntu-latest
20+
steps:
21+
- name: Checkout
22+
uses: actions/checkout@v4
23+
- name: Set Release Version
24+
run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
25+
26+
- name: Install Helm
27+
uses: azure/setup-helm@v4
28+
with:
29+
version: v3.14.0
30+
- name: Lint chart
31+
run: helm lint ./chart
32+
- name: Package chart
33+
run: |
34+
mkdir -p .dist
35+
helm package ./chart --destination .dist
36+
37+
- name: Login to GHCR (OCI)
38+
run: |
39+
helm registry login ghcr.io -u ${{ github.actor }} -p ${{ secrets.GITHUB_TOKEN }}
40+
- name: Push to GHCR (OCI)
41+
run: |
42+
helm push .dist/defender-*.tgz oci://ghcr.io/${{ github.repository_owner }}/charts
43+
44+
- name: Upload to GitHub Pages (static Helm repo)
45+
uses: stefanprodan/[email protected]
46+
with:
47+
token: "${{ secrets.GITHUB_TOKEN }}"
48+
linting: off
49+
charts_dir: helm
50+
51+
# - name: Publish to ArtifactHub
52+
# run: |
53+
# curl -sSfL https://github.com/artifacthub/hub/releases/download/v1.12.0/ah_Linux_x86_64.tar.gz | tar -xz -C /usr/local/bin ah
54+
# ah lint && ah publish

‎.github/workflows/release-security.yml

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
name: Secure Supply Chain Pipeline
2+
3+
on:
4+
pull_request:
5+
6+
#on:
7+
# push:
8+
# branches: [main]
9+
# tags: ['v*']
10+
11+
env:
12+
REGISTRY: ghcr.io
13+
IMAGE_NAME: ${{ github.repository }}
14+
15+
jobs:
16+
security-scan-and-build:
17+
runs-on: ubuntu-latest
18+
permissions:
19+
contents: read
20+
packages: write
21+
id-token: write # For cosign keyless signing
22+
23+
steps:
24+
- name: Checkout
25+
uses: actions/checkout@v4
26+
27+
- name: Setup Go
28+
uses: actions/setup-go@v4
29+
with:
30+
go-version: 1.21
31+
32+
# Static analysis and security scanning
33+
- name: Run Gosec Security Scanner
34+
uses: securecodewarrior/github-action-gosec@master
35+
with:
36+
args: './...'
37+
38+
- name: Run Nancy (dependency vulnerability scanner)
39+
run: |
40+
go list -json -deps ./... | nancy sleuth
41+
42+
# Ko setup for Go builds
43+
- name: Setup Ko
44+
uses: ko-build/[email protected]
45+
with:
46+
version: v0.15.1
47+
48+
# Cosign setup
49+
- name: Install Cosign
50+
uses: sigstore/[email protected]
51+
with:
52+
cosign-release: 'v2.2.0'
53+
54+
# Syft for SBOM generation
55+
- name: Install Syft
56+
uses: anchore/sbom-action/[email protected]
57+
58+
- name: Login to Container Registry
59+
uses: docker/login-action@v3
60+
with:
61+
registry: ${{ env.REGISTRY }}
62+
username: ${{ github.actor }}
63+
password: ${{ secrets.GITHUB_TOKEN }}
64+
65+
# Build with Ko
66+
- name: Build and Push with Ko
67+
run: |
68+
export KO_DOCKER_REPO=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
69+
IMAGE=$(ko build ./cmd/myapp --bare)
70+
echo "IMAGE=$IMAGE" >> $GITHUB_ENV
71+
72+
# Generate SBOM
73+
- name: Generate SBOM
74+
run: |
75+
syft ${{ env.IMAGE }} -o spdx-json > sbom.spdx.json
76+
77+
# Sign image and attach SBOM attestation
78+
- name: Sign Image and Create SBOM Attestation
79+
run: |
80+
# Keyless signing
81+
cosign sign --yes ${{ env.IMAGE }}
82+
83+
# Create SBOM attestation
84+
cosign attest --yes --predicate sbom.spdx.json --type spdx ${{ env.IMAGE }}
85+
86+
# Vulnerability scan of final image
87+
- name: Run Trivy vulnerability scanner
88+
uses: aquasecurity/trivy-action@master
89+
with:
90+
image-ref: ${{ env.IMAGE }}
91+
format: 'sarif'
92+
output: 'trivy-results.sarif'
93+
94+
- name: Upload Trivy scan results
95+
uses: github/codeql-action/upload-sarif@v2
96+
with:
97+
sarif_file: 'trivy-results.sarif'
98+
99+
# Deployment job with verification
100+
deploy:
101+
needs: security-scan-and-build
102+
runs-on: ubuntu-latest
103+
if: github.ref == 'refs/heads/main'
104+
105+
steps:
106+
- name: Checkout K8s manifests
107+
uses: actions/checkout@v4
108+
109+
- name: Setup kubectl
110+
uses: azure/setup-kubectl@v3
111+
112+
- name: Install Cosign
113+
uses: sigstore/[email protected]
114+
115+
# Verify signatures before deployment
116+
- name: Verify Image Signatures
117+
run: |
118+
cosign verify \
119+
--certificate-identity-regexp="${{ github.server_url }}/${{ github.repository }}" \
120+
--certificate-oidc-issuer=https://token.actions.githubusercontent.com \
121+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
122+
123+
# Verify SBOM attestation
124+
cosign verify-attestation \
125+
--certificate-identity-regexp="${{ github.server_url }}/${{ github.repository }}" \
126+
--certificate-oidc-issuer=https://token.actions.githubusercontent.com \
127+
--type=spdx \
128+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
129+
130+
- name: Deploy to Kubernetes
131+
run: |
132+
# Update image in manifests and deploy
133+
sed -i 's|IMAGE_PLACEHOLDER|${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest|g' k8s/*.yaml
134+
kubectl apply -f k8s/

‎.github/workflows/release.yml

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
name: DeployDefender
2+
3+
on:
4+
pull_request:
5+
6+
#on:
7+
# push:
8+
# tags:
9+
# - v*
10+
permissions:
11+
contents: read
12+
packages: write
13+
14+
env:
15+
REGISTRY: ghcr.io
16+
IMAGE_NAME: deployDefender
17+
18+
jobs:
19+
build-push:
20+
runs-on: ubuntu-latest
21+
22+
steps:
23+
- name: Checkout repo
24+
uses: actions/checkout@v4
25+
26+
- name: Login to GitHub Container Registry
27+
uses: docker/login-action@v3
28+
with:
29+
registry: ghcr.io
30+
username: ${{ github.repository_owner }}
31+
password: ${{ secrets.GITHUB_TOKEN }}
32+
33+
- name: Set up QEMU
34+
uses: docker/setup-qemu-action@v3
35+
36+
- name: Set up Docker Buildx
37+
uses: docker/setup-buildx-action@v3
38+
39+
- name: Build and Push image
40+
uses: docker/build-push-action@v6
41+
with:
42+
context: /
43+
file: Dockerfile
44+
push: true
45+
# ${{ github.event_name != 'pull_request' }}
46+
platforms: linux/amd64,linux/arm64
47+
tags: |
48+
ghcr.io/${{ env.IMAGE_NAME }}:${{ github.sha }}
49+
provenance: false
50+

0 commit comments

Comments
 (0)