63 lines
2.9 KiB
YAML
63 lines
2.9 KiB
YAML
name: MobilityOps release evidence
|
|
|
|
on:
|
|
push:
|
|
tags: ["v*"]
|
|
|
|
jobs:
|
|
release-evidence:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
- name: Build commit-labelled release images
|
|
run: |
|
|
docker build --target runtime --build-arg VCS_REF="$GITHUB_SHA" --tag mobilityops-api-release --file backend/Dockerfile .
|
|
docker build --build-arg VCS_REF="$GITHUB_SHA" --tag mobilityops-web-release frontend
|
|
docker build --build-arg VCS_REF="$GITHUB_SHA" --tag mobilityops-backup-tools-release --file deploy/unraid/Dockerfile.backup-tools .
|
|
- name: Scan all release images
|
|
run: |
|
|
for image in mobilityops-api-release mobilityops-web-release mobilityops-backup-tools-release; do
|
|
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
|
|
-v mobilityops-release-trivy:/root/.cache/ \
|
|
aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969 \
|
|
image --scanners vuln --severity HIGH,CRITICAL \
|
|
--ignore-unfixed --exit-code 1 "$image"
|
|
done
|
|
- name: Generate API CycloneDX SBOM
|
|
uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
|
|
with:
|
|
scan-type: image
|
|
image-ref: mobilityops-api-release
|
|
format: cyclonedx
|
|
output: mobilityops-api-sbom.cdx.json
|
|
- name: Generate web CycloneDX SBOM
|
|
uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
|
|
with:
|
|
scan-type: image
|
|
image-ref: mobilityops-web-release
|
|
format: cyclonedx
|
|
output: mobilityops-web-sbom.cdx.json
|
|
- name: Generate backup-tools CycloneDX SBOM
|
|
uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
|
|
with:
|
|
scan-type: image
|
|
image-ref: mobilityops-backup-tools-release
|
|
format: cyclonedx
|
|
output: mobilityops-backup-tools-sbom.cdx.json
|
|
- name: Record immutable image metadata
|
|
run: |
|
|
docker image inspect mobilityops-api-release > mobilityops-api-image.json
|
|
docker image inspect mobilityops-web-release > mobilityops-web-image.json
|
|
docker image inspect mobilityops-backup-tools-release > mobilityops-backup-tools-image.json
|
|
python scripts/generate-release-provenance.py
|
|
sha256sum mobilityops-*-sbom.cdx.json mobilityops-*-image.json release-provenance.json > SHA256SUMS
|
|
- name: Upload release evidence
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
|
|
with:
|
|
name: mobilityops-${{ github.ref_name }}-evidence
|
|
path: |
|
|
mobilityops-*-sbom.cdx.json
|
|
mobilityops-*-image.json
|
|
release-provenance.json
|
|
SHA256SUMS
|