Skip to content

Commit f680ad9

Browse files
rwaffenrwaffen
authored
Merge pull request #6 from OpenVoxProject/update_ci
chore(ci): add GitHub Actions workflows for build, CI, and security scanning
2 parents e5dece0 + 9335bb9 commit f680ad9

File tree

3 files changed

+282
-0
lines changed

3 files changed

+282
-0
lines changed

‎.github/workflows/build_container.yml‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
---
2+
name: 📦 Build and Publish
3+
4+
on:
5+
push:
6+
branches:
7+
- 'main'
8+
tags:
9+
- '*'
10+
workflow_dispatch:
11+
12+
permissions:
13+
contents: read
14+
15+
jobs:
16+
setup-matrix:
17+
runs-on: ubuntu-latest
18+
outputs:
19+
build_matrix: ${{ steps.set-build-matrix.outputs.build_matrix }}
20+
tag_matrix: ${{ steps.set-tag-matrix.outputs.tag_matrix }}
21+
steps:
22+
- name: Source checkout
23+
uses: actions/checkout@v6
24+
25+
- name: 'Setup yq'
26+
uses: dcarbone/[email protected]
27+
28+
- id: set-build-matrix
29+
run: echo "build_matrix=$(bash matrix.sh build)" >> $GITHUB_OUTPUT
30+
31+
- id: set-tag-matrix
32+
run: echo "tag_matrix=$(bash matrix.sh tag)" >> $GITHUB_OUTPUT
33+
34+
build-and-push-container:
35+
runs-on: ${{ matrix.runner }}
36+
permissions:
37+
contents: read
38+
packages: write
39+
needs: setup-matrix
40+
strategy:
41+
matrix: ${{ fromJson(needs.setup-matrix.outputs.build_matrix) }}
42+
steps:
43+
- name: Build Vox Pupuli OpenBolt Container v${{ matrix.rubygem_openbolt }}-${{ matrix.platform }}
44+
uses: voxpupuli/gha-build-and-publish-a-container@v2
45+
with:
46+
registry_password: ${{ secrets.GITHUB_TOKEN }}
47+
build_args: |
48+
BASE_IMAGE=${{ matrix.base_image }}
49+
RUBYGEM_BUNDLER=${{ matrix.rubygem_bundler }}
50+
RUBYGEM_OPENBOLT=${{ matrix.rubygem_openbolt }}
51+
build_arch: linux/${{ matrix.platform }}
52+
buildfile: Containerfile
53+
docker_username: voxpupulibot
54+
docker_password: ${{ secrets.DOCKERHUB_BOT_ADMIN_TOKEN }}
55+
tags: |
56+
ghcr.io/${{ github.repository_owner }}/openbolt:${{ github.sha }}-v${{ matrix.rubygem_openbolt }}-${{ matrix.platform }}
57+
58+
create-multiarch-manifests:
59+
runs-on: ubuntu-latest
60+
permissions:
61+
contents: read
62+
packages: write
63+
needs:
64+
- setup-matrix
65+
- build-and-push-container
66+
strategy:
67+
matrix: ${{ fromJson(needs.setup-matrix.outputs.tag_matrix) }}
68+
steps:
69+
- name: Log in to the ghcr.io registry
70+
uses: docker/login-action@v3
71+
with:
72+
registry: ghcr.io
73+
username: ${{ github.repository_owner }}
74+
password: ${{ secrets.GITHUB_TOKEN }}
75+
76+
- name: Log in to the docker.io registry
77+
uses: docker/login-action@v3
78+
with:
79+
registry: docker.io
80+
username: voxpupulibot
81+
password: ${{ secrets.DOCKERHUB_BOT_ADMIN_TOKEN }}
82+
83+
- name: Create multiarch manifests
84+
run: |
85+
docker buildx imagetools create -t ghcr.io/${{ github.repository_owner }}/openbolt:${{ matrix.rubygem_openbolt }}-${{ github.ref_name }} \
86+
ghcr.io/${{ github.repository_owner }}/openbolt:${{ github.sha }}-v${{ matrix.rubygem_openbolt }}-arm64 \
87+
ghcr.io/${{ github.repository_owner }}/openbolt:${{ github.sha }}-v${{ matrix.rubygem_openbolt }}-amd64
88+
89+
docker buildx imagetools create -t ghcr.io/${{ github.repository_owner }}/openbolt:${{ matrix.rubygem_openbolt }}-latest \
90+
ghcr.io/${{ github.repository_owner }}/openbolt:${{ github.sha }}-v${{ matrix.rubygem_openbolt }}-arm64 \
91+
ghcr.io/${{ github.repository_owner }}/openbolt:${{ github.sha }}-v${{ matrix.rubygem_openbolt }}-amd64
92+
93+
docker buildx imagetools create -t ghcr.io/${{ github.repository_owner }}/openbolt:latest \
94+
ghcr.io/${{ github.repository_owner }}/openbolt:${{ github.sha }}-v${{ matrix.rubygem_openbolt }}-arm64 \
95+
ghcr.io/${{ github.repository_owner }}/openbolt:${{ github.sha }}-v${{ matrix.rubygem_openbolt }}-amd64
96+
97+
docker buildx imagetools create -t docker.io/${{ github.repository_owner }}/openbolt:${{ matrix.rubygem_openbolt }}-${{ github.ref_name }} \
98+
ghcr.io/${{ github.repository_owner }}/openbolt:${{ github.sha }}-v${{ matrix.rubygem_openbolt }}-arm64 \
99+
ghcr.io/${{ github.repository_owner }}/openbolt:${{ github.sha }}-v${{ matrix.rubygem_openbolt }}-amd64
100+
101+
docker buildx imagetools create -t docker.io/${{ github.repository_owner }}/openbolt:${{ matrix.rubygem_openbolt }}-latest \
102+
ghcr.io/${{ github.repository_owner }}/openbolt:${{ github.sha }}-v${{ matrix.rubygem_openbolt }}-arm64 \
103+
ghcr.io/${{ github.repository_owner }}/openbolt:${{ github.sha }}-v${{ matrix.rubygem_openbolt }}-amd64
104+
105+
docker buildx imagetools create -t docker.io/${{ github.repository_owner }}/openbolt:latest \
106+
ghcr.io/${{ github.repository_owner }}/openbolt:${{ github.sha }}-v${{ matrix.rubygem_openbolt }}-arm64 \
107+
ghcr.io/${{ github.repository_owner }}/openbolt:${{ github.sha }}-v${{ matrix.rubygem_openbolt }}-amd64
108+
109+
update-dockerhub-description:
110+
runs-on: ubuntu-latest
111+
needs:
112+
- create-multiarch-manifests
113+
steps:
114+
- name: Source checkout
115+
uses: actions/checkout@v6
116+
117+
- name: Update Docker Hub Description
118+
uses: peter-evans/dockerhub-description@v5
119+
with:
120+
username: voxpupulibot
121+
password: ${{ secrets.DOCKERHUB_BOT_ADMIN_TOKEN }}
122+
repository: voxpupuli/openbolt

‎.github/workflows/ci.yaml‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
---
2+
name: 🚦 CI
3+
4+
on:
5+
pull_request:
6+
branches:
7+
- main
8+
workflow_dispatch:
9+
10+
permissions:
11+
contents: read
12+
13+
jobs:
14+
setup-matrix:
15+
runs-on: ubuntu-latest
16+
outputs:
17+
build_matrix: ${{ steps.set-build-matrix.outputs.build_matrix }}
18+
steps:
19+
- name: Source checkout
20+
uses: actions/checkout@v5
21+
22+
- name: 'Setup yq'
23+
uses: dcarbone/[email protected]
24+
25+
- id: set-build-matrix
26+
run: echo "build_matrix=$(bash matrix.sh build)" >> $GITHUB_OUTPUT
27+
28+
build_ci_container:
29+
name: Build ${{ matrix.platform }} CI container
30+
runs-on: ${{ matrix.runner }}
31+
permissions:
32+
actions: read
33+
contents: read
34+
security-events: write
35+
pull-requests: write
36+
needs: setup-matrix
37+
strategy:
38+
matrix: ${{ fromJson(needs.setup-matrix.outputs.build_matrix) }}
39+
steps:
40+
- name: Checkout repository
41+
uses: actions/checkout@v5
42+
43+
- name: Build image
44+
uses: docker/build-push-action@v6
45+
with:
46+
file: Containerfile
47+
tags: 'ci/openbolt:${{ matrix.rubygem_openbolt }}'
48+
push: false
49+
platforms: linux/${{ matrix.platform }}
50+
build-args: |
51+
BASE_IMAGE=${{ matrix.base_image }}
52+
RUBYGEM_BUNDLER=${{ matrix.rubygem_bundler }}
53+
RUBYGEM_OPENBOLT=${{ matrix.rubygem_openbolt }}
54+
55+
- name: Clone voxpupuli/puppet-example repository
56+
uses: actions/checkout@v5
57+
with:
58+
repository: voxpupuli/puppet-example
59+
60+
- name: Test container
61+
run: |
62+
docker run --rm -v $PWD:/repo:Z ci/openbolt:${{ matrix.rubygem_openbolt }} -h
63+
64+
tests:
65+
needs:
66+
- build_ci_container
67+
runs-on: ubuntu-latest
68+
name: Test suite
69+
steps:
70+
- run: echo Test suite completed
71+
72+
dependabot:
73+
permissions:
74+
contents: write
75+
name: 'Dependabot auto-merge'
76+
needs:
77+
- tests
78+
runs-on: ubuntu-latest
79+
if: ${{ github.actor == 'dependabot[bot]' && github.event_name == 'pull_request'}}
80+
steps:
81+
- name: Dependabot metadata
82+
id: metadata
83+
uses: dependabot/[email protected]
84+
with:
85+
github-token: '${{ secrets.GITHUB_TOKEN }}'
86+
87+
- name: Enable auto-merge for Dependabot PRs
88+
run: gh pr merge --auto --merge "$PR_URL"
89+
env:
90+
PR_URL: ${{github.event.pull_request.html_url}}
91+
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

‎.github/workflows/security_scanning.yml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
---
2+
name: 🕵️ Security Scanning
3+
4+
on:
5+
push:
6+
branches:
7+
- main
8+
pull_request:
9+
branches:
10+
- main
11+
12+
permissions:
13+
contents: read
14+
15+
jobs:
16+
setup-matrix:
17+
runs-on: ubuntu-latest
18+
outputs:
19+
build_matrix: ${{ steps.set-build-matrix.outputs.build_matrix }}
20+
steps:
21+
- name: Source checkout
22+
uses: actions/checkout@v6
23+
24+
- name: 'Setup yq'
25+
uses: dcarbone/[email protected]
26+
27+
- id: set-build-matrix
28+
run: echo "build_matrix=$(bash matrix.sh build)" >> $GITHUB_OUTPUT
29+
30+
scan_ci_container:
31+
name: 'Scan CI container'
32+
runs-on: ${{ matrix.runner }}
33+
permissions:
34+
actions: read
35+
contents: read
36+
security-events: write
37+
needs: setup-matrix
38+
strategy:
39+
matrix: ${{ fromJson(needs.setup-matrix.outputs.build_matrix) }}
40+
steps:
41+
- name: Checkout repository
42+
uses: actions/checkout@v6
43+
44+
- name: Build CI container
45+
uses: docker/build-push-action@v6
46+
with:
47+
tags: 'ci/openbolt:${{ matrix.rubygem_openbolt }}'
48+
push: false
49+
file: Containerfile
50+
platforms: linux/${{ matrix.platform }}
51+
build-args: |
52+
BASE_IMAGE=${{ matrix.base_image }}
53+
RUBYGEM_BUNDLER=${{ matrix.rubygem_bundler }}
54+
RUBYGEM_OPENBOLT=${{ matrix.rubygem_openbolt }}
55+
56+
- name: Scan image with Anchore Grype
57+
uses: anchore/scan-action@v7
58+
id: scan
59+
with:
60+
image: 'ci/openbolt:${{ matrix.rubygem_openbolt }}'
61+
fail-build: false
62+
63+
- name: Inspect action SARIF report
64+
run: jq . ${{ steps.scan.outputs.sarif }}
65+
66+
- name: Upload Anchore scan SARIF report
67+
uses: github/codeql-action/upload-sarif@v4
68+
with:
69+
sarif_file: ${{ steps.scan.outputs.sarif }}

0 commit comments

Comments
 (0)