Skip to content

Commit f0543e6

Browse files
dedenededene
committed
Initial commit
0 parents  commit f0543e6

File tree

11 files changed

+662
-0
lines changed

11 files changed

+662
-0
lines changed

‎.dockerignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# Ignore everything
2+
*

‎.github/auto-merge.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# Run on autopilot
2+
- match:
3+
dependency_type: all
4+
update_type: all

‎.github/dependabot.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
version: 2
2+
updates:
3+
# Maintain dependencies for GitHub Actions
4+
- package-ecosystem: 'github-actions'
5+
directory: '/'
6+
schedule:
7+
interval: 'daily'
8+
9+
# Maintain dependencies within Dockerfiles
10+
- package-ecosystem: 'docker'
11+
directory: '/'
12+
schedule:
13+
interval: 'daily'

‎.github/workflows/auto-merge.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
name: Auto-Merge Dependabot PRs
2+
3+
on:
4+
pull_request:
5+
6+
jobs:
7+
auto-merge:
8+
runs-on: ubuntu-latest
9+
steps:
10+
- uses: actions/checkout@v4
11+
- uses: ahmadnassri/action-dependabot-auto-merge@v2
12+
with:
13+
target: minor
14+
github-token: ${{ secrets.GH_TOKEN }}

‎.github/workflows/build.yml‎

Lines changed: 199 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,199 @@
1+
name: Build and push container images
2+
3+
on:
4+
workflow_dispatch:
5+
push:
6+
branches: [main]
7+
paths:
8+
- Dockerfile
9+
pull_request:
10+
branches: [main]
11+
paths:
12+
- Dockerfile
13+
14+
env:
15+
DOCKER_BUILDKIT: 1
16+
COSIGN_EXPERIMENTAL: 1
17+
18+
jobs:
19+
metadata:
20+
name: Get image and repo details
21+
runs-on: ubuntu-latest
22+
23+
outputs:
24+
name: ${{ steps.name.outputs.name }}
25+
title: ${{ steps.title.outputs.title }}
26+
version: ${{ steps.version.outputs.version }}
27+
branch: ${{ steps.branch.outputs.branch }}
28+
labels: ${{ steps.metadata.outputs.labels }}
29+
tags: ${{ steps.metadata.outputs.tags }}
30+
platforms: linux/amd64,linux/arm64,linux/arm/v7
31+
32+
steps:
33+
- name: Checkout repo
34+
uses: actions/checkout@v4
35+
36+
- name: Generate docker-compliant image name
37+
id: name
38+
run: echo "name=$(echo ${GITHUB_REPOSITORY,,} | sed 's/docker-//')" | tee -a $GITHUB_OUTPUT
39+
40+
- name: Generate OCI image title
41+
id: title
42+
run:
43+
echo "title=$(echo ${GITHUB_REPOSITORY#*/} | sed 's/docker-//')" | tee -a $GITHUB_OUTPUT
44+
45+
- name: Parse Caddy version
46+
id: version
47+
run:
48+
echo "version=$(grep -Eo 'caddy:[0-9]+\.[0-9]+\.[0-9]+$' Dockerfile | cut -d ':' -f2)" |
49+
tee -a $GITHUB_OUTPUT
50+
51+
- name: Generate build tag from head
52+
id: branch
53+
run: |
54+
export GIT_REF=${GITHUB_HEAD_REF:-$GITHUB_REF_NAME}
55+
echo "branch=$(echo ${GIT_REF,,} | sed 's/[^a-zA-Z0-9]/-/g')" | tee -a $GITHUB_OUTPUT
56+
57+
- name: Generate Docker metadata with Caddy version
58+
uses: docker/metadata-action@v4
59+
id: metadata
60+
with:
61+
images: |
62+
docker.io/${{ steps.name.outputs.name }}
63+
ghcr.io/${{ steps.name.outputs.name }}
64+
tags: |
65+
type=semver,pattern={{version}},value=v${{ steps.version.outputs.version }}
66+
type=semver,pattern={{major}}.{{minor}},value=v${{ steps.version.outputs.version }}
67+
type=semver,pattern={{major}},value=v${{ steps.version.outputs.version }}
68+
labels: |
69+
org.opencontainers.image.title=${{ steps.title.outputs.title }}
70+
71+
build:
72+
name: Build container image
73+
runs-on: ubuntu-latest
74+
needs: [metadata]
75+
76+
permissions:
77+
id-token: write # keyless Cosign signatures
78+
pull-requests: write # PR comments
79+
80+
outputs:
81+
digest: ${{ steps.build.outputs.digest }}
82+
image-ref: ttl.sh/${{ needs.metadata.outputs.name }}:${{ github.sha }}
83+
84+
steps:
85+
- name: Checkout repo
86+
uses: actions/checkout@v4
87+
88+
- name: Install Cosign
89+
uses: sigstore/[email protected]
90+
91+
- name: Set up QEMU
92+
uses: docker/setup-qemu-action@v3
93+
94+
- name: Set up Docker Buildx
95+
uses: docker/setup-buildx-action@v3
96+
97+
- name: Build Docker image
98+
uses: docker/build-push-action@v4
99+
id: build
100+
with:
101+
context: .
102+
push: true # to ttl.sh
103+
tags: ttl.sh/${{ needs.metadata.outputs.name }}:${{ github.sha }}
104+
labels: ${{ needs.metadata.outputs.labels }}
105+
platforms: ${{ needs.metadata.outputs.platforms }}
106+
cache-from: type=gha
107+
cache-to: type=gha,mode=max
108+
109+
- name: Sign container images
110+
run: |
111+
cosign sign --yes --recursive \
112+
"ttl.sh/$IMAGE_NAME@$IMAGE_DIGEST"
113+
env:
114+
IMAGE_NAME: ${{ needs.metadata.outputs.name }}
115+
IMAGE_DIGEST: ${{ steps.build.outputs.digest }}
116+
117+
trivy:
118+
name: Run Trivy scanner
119+
needs: [build]
120+
uses: ./.github/workflows/trivy.yml
121+
with:
122+
image-ref: ${{ needs.build.outputs.image-ref }}
123+
124+
publish:
125+
name: Publish container image
126+
needs: [metadata, build, trivy]
127+
runs-on: ubuntu-latest
128+
129+
permissions:
130+
id-token: write # keyless Cosign signatures
131+
packages: write # GHCR
132+
contents: write # git tags
133+
134+
if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
135+
steps:
136+
- name: Checkout repo
137+
uses: actions/checkout@v4
138+
139+
- name: Install Cosign
140+
uses: sigstore/[email protected]
141+
142+
- name: Set up QEMU
143+
uses: docker/setup-qemu-action@v3
144+
145+
- name: Set up Docker Buildx
146+
uses: docker/setup-buildx-action@v3
147+
148+
- name: Login to Docker Hub
149+
uses: docker/login-action@v3
150+
with:
151+
username: ${{ secrets.DOCKER_HUB_USER }}
152+
password: ${{ secrets.DOCKER_HUB_PASSWORD }}
153+
154+
- name: Login to GitHub Container Repository
155+
uses: docker/login-action@v3
156+
with:
157+
registry: ghcr.io
158+
username: ${{ github.actor }}
159+
password: ${{ github.token }}
160+
161+
- name: Verify container images
162+
run: |
163+
cosign verify \
164+
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
165+
--certificate-identity-regexp https://github.com/$GITHUB_REPOSITORY/.github/workflows/ \
166+
${{ needs.build.outputs.image-ref }}
167+
168+
- name: Publish container image
169+
uses: docker/build-push-action@v4
170+
id: publish
171+
with:
172+
context: .
173+
push: true
174+
tags: ${{ needs.metadata.outputs.tags }}
175+
labels: ${{ needs.metadata.outputs.labels }}
176+
platforms: ${{ needs.metadata.outputs.platforms }}
177+
cache-from: type=gha
178+
cache-to: type=gha,mode=max
179+
180+
- name: Sign container images
181+
run: |
182+
cosign sign --yes --recursive "docker.io/$IMAGE_NAME@$IMAGE_DIGEST"
183+
cosign sign --yes --recursive "ghcr.io/$IMAGE_NAME@$IMAGE_DIGEST"
184+
env:
185+
IMAGE_NAME: ${{ needs.metadata.outputs.name }}
186+
IMAGE_DIGEST: ${{ steps.publish.outputs.digest }}
187+
188+
- name: Push version tags
189+
run: |
190+
MAJOR=$(echo $CADDY_VERSION | cut -d . -f 1)
191+
MINOR=$(echo $CADDY_VERSION | cut -d . -f 2)
192+
git tag -f "v$MAJOR"
193+
git tag -f "v$MAJOR.$MINOR"
194+
git tag -f "v$CADDY_VERSION"
195+
git push -f -u origin "v$MAJOR"
196+
git push -f -u origin "v$MAJOR.$MINOR"
197+
git push -f -u origin "v$CADDY_VERSION"
198+
env:
199+
CADDY_VERSION: ${{ needs.metadata.outputs.version }}

‎.github/workflows/readme.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
name: Sync GitHub README with Docker Hub
2+
3+
on:
4+
workflow_dispatch:
5+
push:
6+
branches: [main]
7+
paths:
8+
- README.md
9+
10+
jobs:
11+
github-docker:
12+
name: Sync GitHub README with Docker Hub
13+
runs-on: ubuntu-latest
14+
15+
steps:
16+
- name: Checkout repo
17+
uses: actions/checkout@v4
18+
19+
- name: Generate docker-compliant image name
20+
run:
21+
echo "IMAGE_NAME=$(echo ${GITHUB_REPOSITORY,,} | sed 's/docker-//')" | tee -a $GITHUB_ENV
22+
23+
- name: Update Docker Hub description
24+
uses: peter-evans/dockerhub-description@v3
25+
with:
26+
username: ${{ secrets.DOCKER_HUB_USER }}
27+
password: ${{ secrets.DOCKER_HUB_PASSWORD }}
28+
repository: ${{ env.IMAGE_NAME }}
29+
short-description: ${{ github.event.repository.description }}

‎.github/workflows/trivy.yml‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
name: Trivy Security Scan
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
- cron: 0 0 * * * # daily at midnight
7+
workflow_call:
8+
inputs:
9+
image-ref:
10+
type: string
11+
required: false
12+
description: Container Ref to be scanned by Trivy
13+
14+
env:
15+
DOCKER_BUILDKIT: 1
16+
COSIGN_EXPERIMENTAL: 1
17+
18+
jobs:
19+
trivy-repo:
20+
name: Scan repository
21+
runs-on: ubuntu-latest
22+
23+
permissions:
24+
security-events: write # upload security results
25+
26+
steps:
27+
- name: Checkout repo
28+
uses: actions/checkout@v4
29+
with:
30+
fetch-depth: 0
31+
32+
- name: Get main branch SHA
33+
run: |
34+
git pull origin main:main
35+
echo "BASE_SHA=$(git merge-base --fork-point main)" | tee -a $GITHUB_ENV
36+
37+
- name: Scan repo filesystem
38+
uses: aquasecurity/[email protected]
39+
with:
40+
scan-type: fs
41+
format: sarif
42+
output: trivy-results.sarif
43+
44+
- name: Upload scan results to GitHub Security
45+
uses: github/codeql-action/upload-sarif@v2
46+
if: always()
47+
with:
48+
sarif_file: trivy-results.sarif
49+
ref: refs/heads/main
50+
sha: ${{ env.BASE_SHA }}
51+
52+
trivy-docker:
53+
name: Scan container image
54+
runs-on: ubuntu-latest
55+
56+
permissions:
57+
security-events: write # upload security results
58+
59+
steps:
60+
- name: Checkout repo
61+
uses: actions/checkout@v4
62+
with:
63+
fetch-depth: 0
64+
65+
- name: Get main branch SHA
66+
run: |
67+
git pull origin main:main
68+
echo "BASE_SHA=$(git merge-base --fork-point main)" | tee -a $GITHUB_ENV
69+
70+
- name: Install Cosign
71+
uses: sigstore/[email protected]
72+
73+
- name: Generate docker-compliant image name
74+
run: |
75+
if [[ -z "$IMAGE_REF" ]]; then
76+
echo "IMAGE_REF=$(echo ${GITHUB_REPOSITORY,,} | sed 's/docker-//'):latest" | tee -a $GITHUB_ENV
77+
else
78+
echo "IMAGE_REF=$IMAGE_REF" | tee -a $GITHUB_ENV
79+
fi
80+
env:
81+
IMAGE_REF: ${{ inputs.image-ref }}
82+
83+
- name: Verify container images
84+
run: |
85+
cosign verify \
86+
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
87+
--certificate-identity-regexp https://github.com/$GITHUB_REPOSITORY/.github/workflows/ \
88+
$IMAGE_REF
89+
90+
- name: Scan container image
91+
uses: aquasecurity/[email protected]
92+
with:
93+
image-ref: ${{ env.IMAGE_REF }}
94+
format: sarif
95+
output: trivy-results.sarif
96+
97+
- name: Upload scan results to GitHub Security
98+
uses: github/codeql-action/upload-sarif@v2
99+
if: always()
100+
with:
101+
sarif_file: trivy-results.sarif
102+
ref: refs/heads/main
103+
sha: ${{ env.BASE_SHA }}

0 commit comments

Comments
 (0)