Skip to content

Merge pull request #247 from intelops/trivytime #390

Merge pull request #247 from intelops/trivytime

Merge pull request #247 from intelops/trivytime #390

Workflow file for this run

name: Client Docker Image CI
on:
push:
paths-ignore:
- '**.md'
- 'charts/**'
branches:
- 'main'
jobs:
build:
runs-on: ubuntu-latest
permissions:
packages: write
id-token: write
contents: read
actions: read
security-events: write
env:
REGISTRY: ghcr.io
GH_URL: https://github.com
steps:
- name: Checkout GitHub Action
uses: actions/checkout@v3
- name: Set up Docker Buildx
id: buildx
uses: docker/setup-buildx-action@v2
- name: Docker metadata
id: metadata
uses: docker/metadata-action@v4
with:
images: ${{ env.REGISTRY }}/${{ github.repository }}/client
tags: |
type=semver,pattern={{version}}
type=semver,pattern={{major}}.{{minor}}
type=raw,value={{sha}},enable=${{ github.ref_type != 'tag' }}
flavor: |
latest=true
- name: Login to GitHub Container Registry
uses: docker/login-action@v2
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Build image and push to GitHub Container Registry
uses: docker/build-push-action@v4
with:
context: .
file: ./dockerfiles/client/Dockerfile
tags: ${{ env.REGISTRY }}/${{ github.repository }}/client:${{ github.run_id }}
labels: ${{ steps.metadata.outputs.labels }}
push: true
- name: Install cosign
uses: sigstore/cosign-installer@main
- name: Sign the images
run: |
cosign sign -y ${{ env.REGISTRY }}/${{ github.repository }}/client:${{ github.run_id }}
env:
COSIGN_EXPERIMENTAL: 1
- name: Verify the pushed tags
run: cosign verify ${{ env.REGISTRY }}/${{ github.repository }}/client:${{ github.run_id }} --certificate-identity ${{ env.GH_URL }}/${{ github.repository }}/.github/workflows/client-image.yml@refs/heads/main --certificate-oidc-issuer https://token.actions.githubusercontent.com
env:
COSIGN_EXPERIMENTAL: 1
- name: Run Trivy in GitHub SBOM mode and submit results to Dependency Graph
uses: aquasecurity/trivy-action@master
with:
scan-type: 'fs'
format: 'github'
output: 'dependency-results.sbom.json'
image-ref: '.'
github-pat: ${{ secrets.GITHUB_TOKEN }}