Skip to content

Commit 6f62607

Browse files
vicenteherreravicenteherrera
committed
refactor: Separated build workflows for forwarder and installer
1 parent a1f65fa commit 6f62607

File tree

2 files changed

+185
-102
lines changed

2 files changed

+185
-102
lines changed

‎.github/workflows/build.yaml‎ renamed to ‎.github/workflows/build-forwarder.yaml‎

Lines changed: 20 additions & 102 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,23 @@
1-
name: Lint, test and security scan
1+
name: Build workflow - Forwarder
22
on:
33
push:
44
branches:
55
- master
6+
paths:
7+
- .github/workflows/build-forwarder.yml
8+
- AKSKubeAuditReceiverSolution/
69
pull_request:
710
branches:
811
- master
9-
page_build:
12+
paths:
13+
- .github/workflows/build-forwarder.yml
14+
- AKSKubeAuditReceiverSolution/
1015
workflow_dispatch:
1116
release:
1217
types:
1318
- published
1419

1520
jobs:
16-
check_bash_installer:
17-
name: Bash shell lint check
18-
if: github.event_name != 'release'
19-
# This action fails for release event because it can't find the commit SHA
20-
runs-on: ubuntu-16.04
21-
steps:
22-
- name: Checkout repo
23-
uses: actions/checkout@v2
24-
- name: Bash shell lint check with shellcheck
25-
uses: reviewdog/action-shellcheck@v1
26-
with:
27-
github_token: ${{ secrets.GITHUB_TOKEN }}
28-
reporter: github-check
29-
level: error
30-
pattern: '*.sh'
31-
path: '.'
32-
exclude: './test/*'
3321

3422
check_yaml:
3523
name: YAML lint check
@@ -76,8 +64,8 @@ jobs:
7664
- name: Dotnet test solution
7765
run: dotnet test AKSKubeAuditReceiverSolution/AKSKubeAuditReceiver.sln
7866

79-
sysdig_dockerfile_cis_benchmark_forwarder:
80-
name: Sysdig Dockerfile CIS benchmark - Forwarder
67+
sysdig_dockerfile_cis_benchmark:
68+
name: Sysdig Dockerfile CIS benchmark
8169
needs: [check_yaml, check_dotnet]
8270
runs-on: ubuntu-16.04
8371
steps:
@@ -108,87 +96,26 @@ jobs:
10896
curl -X POST -s https://app.sysdigcloud.com/api/events -H 'Content-Type: application/json; charset=UTF-8' -H 'Authorization: Bearer '"${SYSDIG_SECURE_TOKEN}"'' -d '{"event":{"name":"CIS Dockerfile Benchmark - PR: '"${PR_TITLE}"' ","description":"'"${reportString}"'","severity":"6"}}' --compressed
10997
echo "###"
11098
111-
sysdig_dockerfile_cis_benchmark_installer:
112-
name: Sysdig Dockerfile CIS benchmark - Installer
113-
needs: [check_bash_installer]
114-
runs-on: ubuntu-16.04
115-
steps:
116-
- name: Checkout repo
117-
uses: actions/checkout@v2
118-
- name: Sysdig CIS dockerfile benchmark
119-
uses: sysdiglabs/[email protected]
120-
id: cis_dockerfile_benchmark
121-
with:
122-
directory: './build'
123-
dockerfilePattern: 'Dockerfile'
124-
disallowedPackages: 'netcat'
125-
secretPatterns: 'aws_secret,pass'
126-
- name: Post run Sysdig CIS dockerfile benchmark
127-
env:
128-
SYSDIG_SECURE_TOKEN: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
129-
PR_TITLE: ${{ github.event.pull_request.title }}
130-
PR_SHA: ${{ github.event.pull_request.head.sha }}
131-
PR_OWNER: ${{ github.event.pull_request.head.user.login }}
132-
run: |
133-
echo "###"
134-
echo "{\"pr_name\": \"${PR_TITLE}\", \"pr_sha\": \"${PR_SHA}\", \"pr_owner\": \"${PR_OWNER}\"}" > /tmp/report.json
135-
echo ${{ toJSON(steps.cis_dockerfile_benchmark.outputs.violation_report) }} > /tmp/report
136-
reportString=$(sed 's/"/\\"/g' /tmp/report)
137-
echo $reportString
138-
# send result to Sysdig monitor
139-
curl -X POST -s https://app.sysdigcloud.com/api/events -H 'Content-Type: application/json; charset=UTF-8' -H 'Authorization: Bearer '"${SYSDIG_SECURE_TOKEN}"'' -d '{"event":{"name":"CIS Dockerfile Benchmark - PR: '"${PR_TITLE}"' ","description":"'"${reportString}"'","severity":"6"}}' --compressed
140-
echo "###"
141-
142-
143-
sysdig_image_scan_forwarder:
144-
name: Sysdig image scan - Forwarder
99+
sysdig_image_scan:
100+
name: Sysdig image scan
145101
needs: [check_yaml, check_dotnet]
146102
runs-on: ubuntu-16.04
147103
steps:
148104
- name: Checkout repo
149105
uses: actions/checkout@v2
150106
- name: Build the Docker image
151-
run: docker build -f ./AKSKubeAuditReceiverSolution/AKSKubeAuditReceiver/Dockerfile ./AKSKubeAuditReceiverSolution --tag sysdiglabs/aks-audit-log-forwarder
107+
run: |
108+
docker build -f ./AKSKubeAuditReceiverSolution/AKSKubeAuditReceiver/Dockerfile \
109+
./AKSKubeAuditReceiverSolution --tag sysdiglabs/aks-audit-log-forwarder
152110
- name: Sysdig Secure inline image scan
153111
uses: sysdiglabs/scan-action@v2
154112
with:
155113
image-tag: "sysdiglabs/aks-audit-log-forwarder"
156114
sysdig-secure-token: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
157115

158-
sysdig_image_scan_installer:
159-
name: Sysdig image scan - Installer
160-
needs: [check_bash_installer]
161-
runs-on: ubuntu-16.04
162-
steps:
163-
- name: Checkout repo
164-
uses: actions/checkout@v2
165-
- name: Build the Docker image
166-
run: docker build -f ./build/Dockerfile . --tag sysdiglabs/aks-audit-log-installer
167-
- name: Pull Sysdig inline scan
168-
run: docker pull sysdiglabs/secure-inline-scan:2
169-
- name: Run Sysdig inline image scan
170-
id: run_sysdig_inline_scan
171-
env:
172-
SYSDIG_SECURE_TOKEN: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
173-
run: |
174-
docker run sysdiglabs/secure-inline-scan:2 -s https://secure.sysdig.com -k $SYSDIG_SECURE_TOKEN sysdiglabs/aks-audit-log-installer \
175-
| tee sysdig_image_scan_installer_result.txt
176-
SCAN_RESULT=${PIPESTATUS[0]}
177-
echo "::set-output name=SCAN_RESULT::$SCAN_RESULT"
178-
echo "Scan finished with result: $SCAN_RESULT"
179-
- name: Scan result
180-
env:
181-
SCAN_RESULT: ${{ steps.run_sysdig_inline_scan.outputs.SCAN_RESULT }}
182-
run: |
183-
cat sysdig_image_scan_installer_result.txt
184-
echo "Scan result: $SCAN_RESULT"
185-
# exit $SCAN_RESULT
186-
187-
publish_images:
188-
name: Publish container images to registries
189-
needs: [sysdig_image_scan_forwarder]
190-
# We do not depend on scan of installer as check_shell can't run on release,
191-
# and scan for installer result is skipped
116+
publish_image:
117+
name: Publish container image to registries
118+
needs: [sysdig_image_scan]
192119
runs-on: ubuntu-16.04
193120
if: github.event_name == 'release'
194121
steps:
@@ -217,22 +144,13 @@ jobs:
217144
echo "Version tag: $VERSION_TAG"
218145
VERSION_MAJOR=$(echo $VERSION_TAG | sed 's/[^0-9]*\([0-9]\+\).*/\1/')
219146
VERSION_FULL=$(echo $VERSION_TAG | sed 's/[^0-9]*\([0-9]\+.*\)/\1/')
147+
[ -z $VERSION_FULL ] VERSION_FULL="master"
148+
[ -z $VERSION_MAJOR ] VERSION_FULL="master"
220149
echo "Version major: $VERSION_MAJOR"
221150
echo "Version full: $VERSION_FULL"
222151
echo "::set-output name=VERSION_MAJOR::$VERSION_MAJOR"
223152
echo "::set-output name=VERSION_FULL::$VERSION_FULL"
224-
- name: Build and push - Installer
225-
uses: docker/build-push-action@v2
226-
with:
227-
context: .
228-
file: ./build/Dockerfile
229-
platforms: linux/amd64
230-
push: true
231-
tags: |
232-
sysdiglabs/aks-audit-log-installer:latest
233-
sysdiglabs/aks-audit-log-installer:${{ steps.prepare_version_labels.outputs.VERSION_MAJOR }}
234-
sysdiglabs/aks-audit-log-installer:${{ steps.prepare_version_labels.outputs.VERSION_FULL }}
235-
- name: Build and push - Forwarder
153+
- name: Build and push
236154
uses: docker/build-push-action@v2
237155
with:
238156
context: AKSKubeAuditReceiverSolution/

‎.github/workflows/build-installer.yaml‎

Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
name: Build workflow - Installer
2+
on:
3+
push:
4+
branches:
5+
- master
6+
paths:
7+
- .github/workflows/build-installer.yml
8+
- build/Dockerfile
9+
- ./*.sh
10+
- ./*.in
11+
pull_request:
12+
branches:
13+
- master
14+
paths:
15+
- .github/workflows/build-installer.yml
16+
- build/Dockerfile
17+
- ./*.sh
18+
- ./*.in
19+
workflow_dispatch:
20+
release:
21+
types:
22+
- published
23+
24+
jobs:
25+
check_bash:
26+
name: Bash shell lint check
27+
if: github.event_name == 'push' || github.event_name == 'pull_request'
28+
# This action fails for events that are not 'push' or 'pull_request' because it can't find the commit SHA
29+
runs-on: ubuntu-16.04
30+
steps:
31+
- name: Checkout repo
32+
uses: actions/checkout@v2
33+
- name: Bash shell lint check with shellcheck
34+
uses: reviewdog/action-shellcheck@v1
35+
with:
36+
github_token: ${{ secrets.GITHUB_TOKEN }}
37+
reporter: github-check
38+
level: error
39+
pattern: '*.sh'
40+
path: '.'
41+
exclude: './test/*'
42+
43+
check_yaml:
44+
name: YAML lint check
45+
runs-on: ubuntu-16.04
46+
steps:
47+
- name: Checkout repo
48+
uses: actions/checkout@v2
49+
- name: 'Yaml lint'
50+
uses: karancode/yamllint-github-action@master
51+
with:
52+
yamllint_file_or_dir: './*.yaml*'
53+
yamllint_strict: false
54+
yamllint_comment: true
55+
env:
56+
GITHUB_ACCESS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
57+
58+
sysdig_dockerfile_cis_benchmark:
59+
name: Sysdig Dockerfile CIS benchmark
60+
needs: [check_yaml]
61+
runs-on: ubuntu-16.04
62+
steps:
63+
- name: Checkout repo
64+
uses: actions/checkout@v2
65+
- name: Sysdig CIS dockerfile benchmark
66+
uses: sysdiglabs/[email protected]
67+
id: cis_dockerfile_benchmark
68+
with:
69+
directory: './build'
70+
dockerfilePattern: 'Dockerfile'
71+
disallowedPackages: 'netcat'
72+
secretPatterns: 'aws_secret,pass'
73+
- name: Post run Sysdig CIS dockerfile benchmark
74+
env:
75+
SYSDIG_SECURE_TOKEN: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
76+
PR_TITLE: ${{ github.event.pull_request.title }}
77+
PR_SHA: ${{ github.event.pull_request.head.sha }}
78+
PR_OWNER: ${{ github.event.pull_request.head.user.login }}
79+
run: |
80+
echo "###"
81+
echo "{\"pr_name\": \"${PR_TITLE}\", \"pr_sha\": \"${PR_SHA}\", \"pr_owner\": \"${PR_OWNER}\"}" > /tmp/report.json
82+
echo ${{ toJSON(steps.cis_dockerfile_benchmark.outputs.violation_report) }} > /tmp/report
83+
reportString=$(sed 's/"/\\"/g' /tmp/report)
84+
echo $reportString
85+
# send result to Sysdig monitor
86+
curl -X POST -s https://app.sysdigcloud.com/api/events -H 'Content-Type: application/json; charset=UTF-8' -H 'Authorization: Bearer '"${SYSDIG_SECURE_TOKEN}"'' -d '{"event":{"name":"CIS Dockerfile Benchmark - PR: '"${PR_TITLE}"' ","description":"'"${reportString}"'","severity":"6"}}' --compressed
87+
echo "###"
88+
89+
sysdig_image_scan:
90+
name: Sysdig image scan
91+
needs: [check_yaml]
92+
runs-on: ubuntu-16.04
93+
steps:
94+
- name: Checkout repo
95+
uses: actions/checkout@v2
96+
- name: Build the Docker image
97+
run: docker build -f ./build/Dockerfile . --tag sysdiglabs/aks-audit-log-installer
98+
- name: Pull Sysdig inline scan
99+
run: docker pull sysdiglabs/secure-inline-scan:2
100+
- name: Run Sysdig inline image scan
101+
id: run_sysdig_inline_scan
102+
env:
103+
SYSDIG_SECURE_TOKEN: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
104+
run: |
105+
docker run sysdiglabs/secure-inline-scan:2 -s https://secure.sysdig.com -k $SYSDIG_SECURE_TOKEN sysdiglabs/aks-audit-log-installer \
106+
| tee sysdig_image_scan_result.txt
107+
SCAN_RESULT=${PIPESTATUS[0]}
108+
echo "::set-output name=SCAN_RESULT::$SCAN_RESULT"
109+
echo "Scan finished with result: $SCAN_RESULT"
110+
- name: Scan result
111+
env:
112+
SCAN_RESULT: ${{ steps.run_sysdig_inline_scan.outputs.SCAN_RESULT }}
113+
run: |
114+
cat sysdig_image_scan_result.txt
115+
echo "Scan result: $SCAN_RESULT"
116+
# exit $SCAN_RESULT
117+
118+
publish_images:
119+
name: Publish container images to registries
120+
needs: [sysdig_image_scan]
121+
runs-on: ubuntu-16.04
122+
if: github.event_name == 'release'
123+
steps:
124+
- name: Checkout
125+
uses: actions/checkout@v2
126+
- name: Set up QEMU
127+
uses: docker/setup-qemu-action@v1
128+
- name: Set up Docker Buildx
129+
uses: docker/setup-buildx-action@v1
130+
- name: Login to DockerHub
131+
uses: docker/login-action@v1
132+
with:
133+
username: ${{ secrets.DOCKERHUB_USERNAME }}
134+
password: ${{ secrets.DOCKERHUB_PASSWORD }}
135+
- name: Login to GitHub Container Registry
136+
uses: docker/login-action@v1
137+
with:
138+
registry: ghcr.io
139+
username: ${{ github.repository_owner }}
140+
password: ${{ secrets.CR_PAT_PKG }}
141+
- name: Prepare version labels
142+
id: prepare_version_labels
143+
env:
144+
VERSION_TAG: ${{ github.event.release.tag_name }}
145+
run: |
146+
echo "Version tag: $VERSION_TAG"
147+
VERSION_MAJOR=$(echo $VERSION_TAG | sed 's/[^0-9]*\([0-9]\+\).*/\1/')
148+
VERSION_FULL=$(echo $VERSION_TAG | sed 's/[^0-9]*\([0-9]\+.*\)/\1/')
149+
[ -z $VERSION_FULL ] VERSION_FULL="master"
150+
[ -z $VERSION_MAJOR ] VERSION_FULL="master"
151+
echo "Version major: $VERSION_MAJOR"
152+
echo "Version full: $VERSION_FULL"
153+
echo "::set-output name=VERSION_MAJOR::$VERSION_MAJOR"
154+
echo "::set-output name=VERSION_FULL::$VERSION_FULL"
155+
- name: Build and push
156+
uses: docker/build-push-action@v2
157+
with:
158+
context: .
159+
file: ./build/Dockerfile
160+
platforms: linux/amd64
161+
push: true
162+
tags: |
163+
sysdiglabs/aks-audit-log-installer:latest
164+
sysdiglabs/aks-audit-log-installer:${{ steps.prepare_version_labels.outputs.VERSION_MAJOR }}
165+
sysdiglabs/aks-audit-log-installer:${{ steps.prepare_version_labels.outputs.VERSION_FULL }}

0 commit comments

Comments
 (0)