Skip to content

Commit dbe08e1

Browse files
feckerfecker
authored
Merge pull request #2 from IntimateMerger/feature-1.27.1.2
Feature 1.27.1.2
2 parents 8dbc41d + d445dbc commit dbe08e1

4 files changed

Lines changed: 496 additions & 77 deletions

File tree

‎.github/workflows/build.yaml‎

Lines changed: 196 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,196 @@
1+
name: Build and Push Docker Image
2+
3+
on:
4+
push:
5+
branches:
6+
- master
7+
- main
8+
tags:
9+
- '*.*.*.*-*' # Format: 1.27.1.2-0
10+
pull_request:
11+
branches:
12+
- master
13+
- main
14+
workflow_dispatch:
15+
16+
env:
17+
DOCKER_IMAGE: intimatemerger/openresty
18+
19+
jobs:
20+
build:
21+
name: Build ${{ matrix.platform }}
22+
if: github.event_name != 'pull_request'
23+
runs-on: ${{ matrix.runner }}
24+
permissions:
25+
contents: read
26+
27+
strategy:
28+
fail-fast: true
29+
matrix:
30+
include:
31+
- platform: linux/amd64
32+
runner: ubuntu-latest
33+
arch: amd64
34+
- platform: linux/arm64
35+
runner: ubuntu-latest-arm
36+
arch: arm64
37+
38+
steps:
39+
- name: Checkout code
40+
uses: actions/checkout@v6
41+
42+
- name: Set up Docker Buildx
43+
uses: docker/setup-buildx-action@v3
44+
45+
- name: Log in to Docker Hub
46+
uses: docker/login-action@v3
47+
with:
48+
username: ${{ vars.DOCKERHUB_USERNAME }}
49+
password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN_READ_WRITE }}
50+
51+
- name: Build and push by digest
52+
id: build
53+
uses: docker/build-push-action@v6
54+
with:
55+
context: .
56+
platforms: ${{ matrix.platform }}
57+
outputs: type=image,name=${{ env.DOCKER_IMAGE }},push-by-digest=true,name-canonical=true,push=true
58+
sbom: true
59+
provenance: false
60+
cache-from: type=gha,scope=${{ matrix.arch }}
61+
cache-to: type=gha,mode=max,scope=${{ matrix.arch }}
62+
63+
- name: Export digest
64+
run: |
65+
mkdir -p /tmp/digests
66+
digest="${{ steps.build.outputs.digest }}"
67+
touch "/tmp/digests/${digest#sha256:}"
68+
69+
- name: Upload digest
70+
uses: actions/upload-artifact@v6
71+
with:
72+
name: digests-${{ matrix.arch }}
73+
path: /tmp/digests/*
74+
if-no-files-found: error
75+
retention-days: 1
76+
77+
merge:
78+
name: Create manifest list
79+
needs: build
80+
runs-on: ubuntu-latest
81+
permissions:
82+
contents: read
83+
84+
steps:
85+
- name: Download digests
86+
uses: actions/download-artifact@v7
87+
with:
88+
path: /tmp/digests
89+
pattern: digests-*
90+
merge-multiple: true
91+
92+
- name: Set up Docker Buildx
93+
uses: docker/setup-buildx-action@v3
94+
95+
- name: Log in to Docker Hub
96+
uses: docker/login-action@v3
97+
with:
98+
username: ${{ vars.DOCKERHUB_USERNAME }}
99+
password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN_READ_WRITE }}
100+
101+
- name: Extract version from tag
102+
id: version
103+
if: startsWith(github.ref, 'refs/tags/')
104+
run: |
105+
TAG=${GITHUB_REF#refs/tags/}
106+
echo "Original tag: $TAG"
107+
108+
# Extract version parts from tag format: 1.27.1.2-0
109+
if [[ $TAG =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)\.([0-9]+)-[0-9]+$ ]]; then
110+
MAJOR=${BASH_REMATCH[1]}
111+
MINOR=${BASH_REMATCH[2]}
112+
PATCH=${BASH_REMATCH[3]}
113+
114+
# Docker tags: MAJOR.MINOR.PATCH and MAJOR.MINOR
115+
PATCH_VERSION="${MAJOR}.${MINOR}.${PATCH}" # e.g., 1.27.1
116+
MINOR_VERSION="${MAJOR}.${MINOR}" # e.g., 1.27
117+
118+
echo "patch_version=$PATCH_VERSION" >> $GITHUB_OUTPUT
119+
echo "minor_version=$MINOR_VERSION" >> $GITHUB_OUTPUT
120+
121+
echo "Generated Docker tags: $PATCH_VERSION, $MINOR_VERSION"
122+
else
123+
echo "Tag format does not match expected pattern (X.X.X.X-X)"
124+
fi
125+
126+
- name: Docker meta
127+
id: meta
128+
uses: docker/metadata-action@v5
129+
with:
130+
images: ${{ env.DOCKER_IMAGE }}
131+
tags: |
132+
type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'master') || github.ref == format('refs/heads/{0}', 'main') }}
133+
type=raw,value=${{ steps.version.outputs.patch_version }},enable=${{ startsWith(github.ref, 'refs/tags/') && steps.version.outputs.patch_version != '' }}
134+
type=raw,value=${{ steps.version.outputs.minor_version }},enable=${{ startsWith(github.ref, 'refs/tags/') && steps.version.outputs.minor_version != '' }}
135+
136+
- name: Create manifest list and push
137+
working-directory: /tmp/digests
138+
run: |
139+
set -euo pipefail
140+
141+
# metadata-action からタグを取得
142+
TAGS=$(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON")
143+
144+
if [ -z "${TAGS}" ]; then
145+
echo "No tags to create"
146+
exit 1
147+
fi
148+
149+
echo "Creating manifest list with tags: ${TAGS}"
150+
echo "From digests:"
151+
ls -la
152+
153+
docker buildx imagetools create ${TAGS} \
154+
$(printf '${{ env.DOCKER_IMAGE }}@sha256:%s ' *)
155+
156+
echo "Successfully created and pushed manifest lists"
157+
158+
- name: Inspect manifest
159+
if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main'
160+
run: |
161+
docker buildx imagetools inspect ${{ env.DOCKER_IMAGE }}:${{ steps.meta.outputs.version }}
162+
163+
- name: Docker Scout CVE scan
164+
if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main'
165+
uses: docker/scout-action@v1
166+
continue-on-error: true
167+
with:
168+
command: cves
169+
image: ${{ env.DOCKER_IMAGE }}:${{ steps.meta.outputs.version }}
170+
only-severities: critical,high
171+
exit-code: false
172+
173+
security-scan:
174+
runs-on: ubuntu-latest
175+
if: github.event_name == 'pull_request'
176+
permissions:
177+
contents: read
178+
security-events: write
179+
180+
steps:
181+
- name: Checkout code
182+
uses: actions/checkout@v6
183+
184+
- name: Run Trivy vulnerability scanner
185+
uses: aquasecurity/trivy-action@master
186+
with:
187+
scan-type: 'config'
188+
scan-ref: '.'
189+
format: 'sarif'
190+
output: 'trivy-results.sarif'
191+
192+
- name: Upload Trivy results to GitHub Security
193+
uses: github/codeql-action/upload-sarif@v4
194+
if: always()
195+
with:
196+
sarif_file: 'trivy-results.sarif'

‎.trivyignore‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# non-root user
2+
AVD-DS-0002
3+
# no health check
4+
AVD-DS-0026

0 commit comments

Comments
 (0)