Skip to content

Commit a08b5ea

Browse files
author
Gonzalo Diaz
committed
[CONFIG] [Gihub Actions] Docker running in splitted jobs.
1 parent 45180d8 commit a08b5ea

File tree

1 file changed

+121
-24
lines changed

1 file changed

+121
-24
lines changed

‎.github/workflows/docker-image.yml

Lines changed: 121 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -12,27 +12,11 @@ env:
1212
IMAGE_NAME: algorithm-exercises-js
1313

1414
jobs:
15-
16-
build:
17-
name: "Build & Test in Docker"
18-
15+
security:
16+
name: "Snyk Container"
1917
runs-on: ubuntu-latest
20-
2118
steps:
2219
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
23-
- name: Build the Docker image
24-
run: make compose/rebuild
25-
- name: Lint in Docker image
26-
run: make compose/lint
27-
- name: Test in Docker image
28-
run: make compose/test
29-
- name: Run in Docker image
30-
run: make compose/run
31-
- name: Tag Docker image
32-
run: >
33-
docker tag
34-
${{ env.IMAGE_NAME }}:latest
35-
${{ env.IMAGE_NAME }}:${{ github.sha }}
3620

3721
- name: Run Snyk to check Docker image for vulnerabilities
3822
# Snyk can be used to break the build when it detects vulnerabilities.
@@ -49,9 +33,122 @@ jobs:
4933
with:
5034
image: ${{ env.IMAGE_NAME }}:${{ github.sha }}
5135
args: --file=Dockerfile
52-
# yamllint disable rule:comments-indentation
53-
# - name: Upload result to GitHub Code Scanning
54-
# uses: github/codeql-action/upload-sarif@v2
55-
# with:
56-
# sarif_file: snyk.sarif
57-
# yamllint enable rule:comments-indentation
36+
37+
build:
38+
name: "Build & Test in Docker"
39+
runs-on: ubuntu-latest
40+
steps:
41+
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
42+
43+
# - name: Build the Docker image
44+
# run: make compose/rebuild
45+
# - name: Image List
46+
# run: docker image ls -a
47+
# - name: Lint in Docker image
48+
# run: make compose/lint
49+
# - name: Test in Docker image
50+
# run: make compose/test
51+
# - name: Run in Docker image
52+
# run: make compose/run
53+
54+
- name: Set up Docker Buildx
55+
uses: docker/setup-buildx-action@v3
56+
57+
- name: "LINT: Build and push"
58+
uses: docker/build-push-action@v6
59+
with:
60+
context: .
61+
target: lint
62+
outputs: |
63+
type=docker,dest=/tmp/${{ env.IMAGE_NAME }}_${{ github.sha }}_lint.tar
64+
tags: |
65+
${{ env.IMAGE_NAME }}:lint
66+
- name: "LINT: Upload artifact"
67+
uses: actions/upload-artifact@v4
68+
with:
69+
name: ${{ env.IMAGE_NAME }}_${{ github.sha }}_lint
70+
path: /tmp/${{ env.IMAGE_NAME }}_${{ github.sha }}_lint.tar
71+
72+
- name: "TEST: Build and push"
73+
uses: docker/build-push-action@v6
74+
with:
75+
context: .
76+
target: testing
77+
outputs: |
78+
type=docker,dest=/tmp/${{ env.IMAGE_NAME }}_${{ github.sha }}_test.tar
79+
tags: |
80+
${{ env.IMAGE_NAME }}:test
81+
- name: "TEST: Upload artifact"
82+
uses: actions/upload-artifact@v4
83+
with:
84+
name: ${{ env.IMAGE_NAME }}_${{ github.sha }}_test
85+
path: /tmp/${{ env.IMAGE_NAME }}_${{ github.sha }}_test.tar
86+
87+
- name: "PRODUCTION: Build and push"
88+
uses: docker/build-push-action@v6
89+
with:
90+
context: .
91+
target: production
92+
outputs: |
93+
type=docker,dest=/tmp/${{ env.IMAGE_NAME }}_${{ github.sha }}_prod.tar
94+
tags: |
95+
${{ env.IMAGE_NAME }}:latest
96+
${{ env.IMAGE_NAME }}:${{ github.sha }}
97+
- name: "PRODUCTION: Upload artifact"
98+
uses: actions/upload-artifact@v4
99+
with:
100+
name: ${{ env.IMAGE_NAME }}_${{ github.sha }}_prod
101+
path: /tmp/${{ env.IMAGE_NAME }}_${{ github.sha }}_prod.tar
102+
103+
lint:
104+
name: "Run in docker: LINT"
105+
runs-on: ubuntu-latest
106+
needs: build
107+
steps:
108+
- name: Download artifact
109+
uses: actions/download-artifact@v4
110+
with:
111+
name: ${{ env.IMAGE_NAME }}_${{ github.sha }}_prod
112+
path: /tmp/
113+
114+
- name: Load image
115+
run: |
116+
docker load --input /tmp/${{ env.IMAGE_NAME }}_${{ github.sha }}_prod.tar
117+
docker image ls -a
118+
119+
- name: Run lint
120+
run: |
121+
make compose/lint
122+
123+
scan:
124+
name: "Trivy"
125+
runs-on: ubuntu-latest
126+
needs: build
127+
steps:
128+
- name: Download artifact
129+
uses: actions/download-artifact@v4
130+
with:
131+
name: ${{ env.IMAGE_NAME }}_${{ github.sha }}_prod
132+
path: /tmp/
133+
134+
- name: Load image
135+
run: |
136+
docker load --input /tmp/${{ env.IMAGE_NAME }}_${{ github.sha }}_prod.tar
137+
docker image ls -a
138+
139+
- name: Run Trivy vulnerability scanner
140+
uses: aquasecurity/[email protected]
141+
with:
142+
image-ref: ${{ env.IMAGE_NAME }}:${{ github.sha }}
143+
format: 'table'
144+
exit-code: '1'
145+
ignore-unfixed: true
146+
vuln-type: 'os,library'
147+
severity: 'CRITICAL,HIGH'
148+
149+
# yamllint disable rule:comments-indentation
150+
# - name: Upload Trivy scan results to GitHub Security tab
151+
# uses: github/codeql-action/upload-sarif@v2
152+
# with:
153+
# sarif_file: 'trivy-results.sarif'
154+
# yamllint enable rule:comments-indentation

0 commit comments

Comments
 (0)