Build and Push to Docker Hub #517
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Push to Docker Hub | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: '0 0 * * *' # Every day at midnight | |
| push: | |
| branches: | |
| - main | |
| jobs: | |
| build_and_push_docker_images: | |
| strategy: | |
| matrix: | |
| versions: [ "1.0.10","1.1.9","3.1.0","3.1.1","3.1.1-SNAPSHOT","3.1.2-SNAPSHOT","latest" ] | |
| name: Push Docker image to Docker Hub | |
| permissions: | |
| packages: write | |
| contents: read | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out the repo | |
| uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 | |
| - name: Generate tags | |
| id: generate-tags | |
| run: | | |
| chmod +x get_versions.sh | |
| echo tags=$(./get_versions.sh ${{ matrix.versions }}) >> $GITHUB_OUTPUT | |
| - name: Build Production Images | |
| if: github.event_name != 'pull_request' | |
| id: build-image | |
| uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2 | |
| with: | |
| image: velocity | |
| tags: ${{ steps.generate-tags.outputs.tags }} | |
| containerfiles: | | |
| ./Dockerfile | |
| build-args: | | |
| VELOCITY_VERSION=${{ matrix.versions }} | |
| # PUSH | |
| - name: Push To GHCR | |
| id: push-to-ghcr | |
| uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2 | |
| with: | |
| username: ${{ github.actor }} | |
| password: ${{ github.token }} | |
| image: ${{ steps.build-image.outputs.image }} | |
| tags: ${{ steps.build-image.outputs.tags }} | |
| registry: ghcr.io/${{ github.repository_owner }} | |
| # SIGN | |
| - uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0 | |
| - name: Sign GHCR Image | |
| run: | | |
| cosign login ghcr.io -u ${{ github.actor }} -p ${{ github.token }} | |
| cosign sign -y --key env://COSIGN_PRIVATE_KEY ghcr.io/${{ github.repository_owner }}/${{ steps.build-image.outputs.image }}@${GHCR_TAGS} | |
| env: | |
| COSIGN_EXPERIMENTAL: false | |
| GHCR_TAGS: ${{ steps.push-to-ghcr.outputs.digest }} | |
| COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }} | |
| #SCAN | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: ghcr.io/${{ github.repository_owner }}/${{ steps.build-image.outputs.image }}@${GHCR_TAGS} | |
| format: 'sarif' | |
| output: 'trivy-results.sarif' | |
| continue-on-error: true | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@4355270be187e1b672a7a1c7c7bae5afdc1ab94a # v3 | |
| with: | |
| sarif_file: 'trivy-results.sarif' | |
| continue-on-error: true | |
| - name: Dive | |
| uses: yuichielectric/dive-action@c2bf577bd2ed379a30c45597cf304f9f269dbdfe # 0.0.4 | |
| with: | |
| image: ghcr.io/${{ github.repository_owner }}/${{ steps.build-image.outputs.image }}@${GHCR_TAGS} | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| continue-on-error: true | |
| # POST | |
| - name: Print image URLs | |
| run: | | |
| echo "Image pushed to ${{ steps.push-to-ghcr.outputs.registry-paths }}" |