Skip to content

Commit 66ea6a2

Browse files
devprodevpro
authored
Add content validate reusable workflow (#7)
* Add content validate reusable workflow * Initiate reusable dotnet validate workflow * Improve naming * Changed extension * Fix missing folder * Add reusable-container-scan.yml * Delete empty field * Fix ci * Add Cosign * Move to secrets * Fix secret for docker build * Update * Fix invalid ref * Update README
1 parent a14099f commit 66ea6a2

16 files changed

Lines changed: 680 additions & 343 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 5 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -2,34 +2,12 @@ name: CI
22

33
on:
44
push:
5-
branches:
6-
- main
5+
branches: [main]
76
pull_request:
8-
branches:
9-
- main
7+
branches: [main]
108
workflow_dispatch: {}
119

12-
env:
13-
python_version: "3.13"
14-
1510
jobs:
16-
build:
17-
runs-on: ubuntu-latest
18-
steps:
19-
- name: Checks-out the repository
20-
uses: actions/checkout@v4
21-
- name: Lints Markdown files
22-
uses: DavidAnson/markdownlint-cli2-action@v20
23-
with:
24-
globs: "**/*.md"
25-
- name: Set up Python ${{ env.python_version }}
26-
uses: actions/setup-python@v5
27-
with:
28-
python-version: ${{ env.python_version }}
29-
- name: Installs Python packages
30-
run: |
31-
python -m pip install --upgrade pip
32-
pip install yamllint
33-
- name: Lint YAML files
34-
run: |
35-
yamllint .
11+
markup-lint:
12+
name: Markup
13+
uses: ./.github/workflows/reusable-markup-lint.yml

‎.github/workflows/reusable-container-publication.yml‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
name: Reusable - Container publication
2+
# description: |
3+
# Builds a new container image with Docker and pushes it to a registry
4+
# Make sure to add (needed by cosign):
5+
# ```
6+
# permissions:
7+
# id-token: write
8+
# contents: read
9+
# ```
10+
11+
on:
12+
workflow_call:
13+
inputs:
14+
container-registry:
15+
description: Container registry
16+
type: string
17+
required: false
18+
default: "docker.io"
19+
create-latest:
20+
description: "Create latest tag?"
21+
type: boolean
22+
required: false
23+
default: false
24+
extra-build-arguments:
25+
description: Container build additional arguments
26+
type: string
27+
required: false
28+
default: ""
29+
image-definition:
30+
description: Path to the container definition file (Dockerfile, Containerfile)
31+
type: string
32+
required: true
33+
image-name:
34+
description: Image name
35+
type: string
36+
required: true
37+
image-path:
38+
description: Image path
39+
type: string
40+
required: true
41+
image-tag:
42+
description: Image tag
43+
type: string
44+
required: true
45+
job-name:
46+
description: Job name
47+
type: string
48+
required: false
49+
default: Publication
50+
operating-system:
51+
description: Operating system executing the runner
52+
type: string
53+
required: false
54+
default: ubuntu-latest
55+
workflow-parts-version:
56+
description: GitHub workflow parts version (branch/tag/SHA)
57+
type: string
58+
required: false
59+
default: main
60+
working-directory:
61+
description: Working directory
62+
type: string
63+
required: false
64+
default: "."
65+
secrets:
66+
container-registry-username:
67+
description: Container registry username
68+
required: true
69+
container-registry-password:
70+
description: Container registry password
71+
required: true
72+
extra-vars:
73+
description: "Additional environment variables"
74+
required: false
75+
76+
jobs:
77+
container-publication:
78+
name: ${{ inputs.job-name }}
79+
runs-on: ${{ inputs.operating-system }}
80+
defaults:
81+
run:
82+
working-directory: ${{ inputs.working-directory }}
83+
steps:
84+
- name: Set additional variables
85+
run: |
86+
if [[ -z "${{ secrets.extra-vars }}" ]]; then
87+
echo "No extra-vars bundle provided - skipping."
88+
else
89+
echo "${{ secrets.extra-vars }}" | while IFS='=' read -r key val; do
90+
if [[ -n "$val" ]]; then
91+
echo "::add-mask::$val"
92+
fi
93+
done
94+
echo "${{ secrets.extra-vars }}" >> "$GITHUB_ENV"
95+
fi
96+
- name: Clone repository
97+
uses: actions/checkout@v6
98+
- name: Checkout workflow parts
99+
uses: actions/checkout@v6
100+
with:
101+
repository: devpro/github-workflow-parts
102+
ref: ${{ inputs.workflow-parts-version }}
103+
path: workflow-parts
104+
- name: Login to container registry
105+
uses: docker/login-action@v3
106+
with:
107+
registry: ${{ inputs.container-registry }}
108+
username: ${{ secrets.container-registry-username }}
109+
password: ${{ secrets.container-registry-password }}
110+
- name: Build container image
111+
run: docker build . --file ${{ inputs.image-definition }} --tag ${{ env.IMAGE_REF }} ${{ secrets.extra-build-arguments }}
112+
shell: bash
113+
- name: Generate SBOM with Syft
114+
uses: anchore/sbom-action@v0
115+
continue-on-error: true
116+
with:
117+
image: ${{ env.IMAGE_REF }}
118+
# format: spdx-json # Or cyclonedx-json
119+
# output-file: sbom.json
120+
# upload-artifact: true # Auto-upload to workflow artifacts
121+
- name: Push image to container registry
122+
run: docker push ${{ env.IMAGE_REF }}
123+
shell: bash
124+
- name: Push latest tag to container registry
125+
if: ${{ inputs.create_latest }}
126+
run: |
127+
docker tag ${{ env.IMAGE_REF }} ${{ env.IMAGE_REF_LATEST }}
128+
docker push ${{ env.IMAGE_REF_LATEST }}
129+
shell: bash
130+
- name: Sign container image with Cosign
131+
uses: ./workflow-parts/actions/cosign/sign
132+
with:
133+
image-name: ${{ inputs.image-name }}
134+
image-path: ${{ inputs.image-path }}
135+
image-tag: ${{ inputs.image-tag }}
136+
env:
137+
IMAGE_REF: ${{ inputs.image-path }}/${{ inputs.image-name }}:${{ inputs.image-tag }}
138+
IMAGE_REF_LATEST: ${{ inputs.image-path }}/${{ inputs.image-name }}:latest

‎.github/workflows/reusable-container-scan.yml‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
name: Reusable - Container scan
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
image-definition:
7+
description: Path to the container definition file (Dockerfile, Containerfile)
8+
type: string
9+
required: true
10+
image-name:
11+
description: Image name
12+
type: string
13+
required: true
14+
image-path:
15+
description: Image path
16+
type: string
17+
required: true
18+
image-tag:
19+
description: Image tag
20+
type: string
21+
required: true
22+
job-name:
23+
description: Job name
24+
type: string
25+
required: false
26+
default: Scan
27+
max-high-cves:
28+
description: Maximum number of high CVEs authorized
29+
type: number
30+
required: false
31+
default: 0
32+
max-medium-cves:
33+
description: Maximum number of medium CVEs authorized
34+
type: number
35+
required: false
36+
default: 0
37+
neuvector-enabled:
38+
description: "Use NeuVector to scan the image?"
39+
type: string
40+
required: false
41+
default: false
42+
operating-system:
43+
description: Operating system executing the runner
44+
type: string
45+
required: false
46+
default: ubuntu-latest
47+
trivy-enabled:
48+
description: "Use Trivy to scan the image?"
49+
type: boolean
50+
required: false
51+
default: true
52+
working-directory:
53+
description: Working directory
54+
type: string
55+
required: false
56+
default: "."
57+
58+
jobs:
59+
container-scan:
60+
name: ${{ inputs.job-name }}
61+
runs-on: ${{ inputs.operating-system }}
62+
defaults:
63+
run:
64+
working-directory: ${{ inputs.working-directory }}
65+
steps:
66+
- name: Clone repository
67+
uses: actions/checkout@v6
68+
- name: Build container image
69+
run: docker build . --file ${{ inputs.image-definition }} --tag ${{ env.IMAGE_REF }}
70+
shell: bash
71+
- name: Scan container image with NeuVector
72+
if: ${{ inputs.neuvector-enabled }}
73+
uses: neuvector/scan-action@main
74+
with:
75+
image-repository: ${{ inputs.image-path }}/${{ inputs.image-name }}
76+
image-tag: ${{ inputs.image-tag }}
77+
min-high-cves-to-fail: '${{ inputs.max-high-cves }}'
78+
min-medium-cves-to-fail: '${{ inputs.max-medium-cves }}'
79+
- name: Scan container image with Trivy
80+
if: ${{ inputs.trivy-enabled }}
81+
uses: aquasecurity/trivy-action@master
82+
with:
83+
image-ref: ${{ env.IMAGE_REF }}
84+
format: 'table'
85+
exit-code: '1'
86+
ignore-unfixed: true
87+
vuln-type: 'os,library'
88+
severity: 'CRITICAL,HIGH'
89+
env:
90+
IMAGE_REF: ${{ inputs.image-path }}/${{ inputs.image-name }}:${{ inputs.image-tag }}
91+
GITHUB_TOKEN: ${{ github.token }}

0 commit comments

Comments
 (0)