ITWorx AppOps Automation
885dff413c
MobilityOps acceptance / acceptance (pull_request) Successful in 33s
51 lines
2.5 KiB
YAML
51 lines
2.5 KiB
YAML
name: MobilityOps release evidence
|
|
|
|
on:
|
|
push:
|
|
tags: ["v*"]
|
|
|
|
jobs:
|
|
release-evidence:
|
|
runs-on: linux-validation
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
- name: Build commit-labelled release images
|
|
run: |
|
|
docker build --target runtime --build-arg VCS_REF="$GITHUB_SHA" --tag mobilityops-api-release --file backend/Dockerfile .
|
|
docker build --build-arg VCS_REF="$GITHUB_SHA" --tag mobilityops-web-release frontend
|
|
docker build --build-arg VCS_REF="$GITHUB_SHA" --tag mobilityops-backup-tools-release --file deploy/unraid/Dockerfile.backup-tools .
|
|
- name: Scan all release images
|
|
run: |
|
|
for image in mobilityops-api-release mobilityops-web-release mobilityops-backup-tools-release; do
|
|
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
|
|
-v mobilityops-release-trivy:/root/.cache/ \
|
|
aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969 \
|
|
image --scanners vuln --severity HIGH,CRITICAL \
|
|
--ignore-unfixed --exit-code 1 "$image"
|
|
done
|
|
- name: Generate CycloneDX SBOMs with the pinned scanner image
|
|
run: |
|
|
for component in api web backup-tools; do
|
|
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
|
|
-v "$PWD:/work" -w /work \
|
|
aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969 \
|
|
image --format cyclonedx --output "mobilityops-${component}-sbom.cdx.json" \
|
|
"mobilityops-${component}-release"
|
|
done
|
|
- name: Record immutable image metadata
|
|
run: |
|
|
docker image inspect mobilityops-api-release > mobilityops-api-image.json
|
|
docker image inspect mobilityops-web-release > mobilityops-web-image.json
|
|
docker image inspect mobilityops-backup-tools-release > mobilityops-backup-tools-image.json
|
|
python scripts/generate-release-provenance.py
|
|
sha256sum mobilityops-*-sbom.cdx.json mobilityops-*-image.json release-provenance.json > SHA256SUMS
|
|
- name: Upload release evidence
|
|
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3; Gitea-compatible artifact protocol
|
|
with:
|
|
name: mobilityops-${{ github.ref_name }}-evidence
|
|
path: |
|
|
mobilityops-*-sbom.cdx.json
|
|
mobilityops-*-image.json
|
|
release-provenance.json
|
|
SHA256SUMS
|