43 lines
1.7 KiB
YAML
43 lines
1.7 KiB
YAML
name: MobilityOps release evidence
|
|
|
|
on:
|
|
push:
|
|
tags: ["v*"]
|
|
|
|
jobs:
|
|
release-evidence:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
- name: Build commit-labelled release images
|
|
run: |
|
|
docker build --target runtime --build-arg VCS_REF="$GITHUB_SHA" --tag mobilityops-api-release --file backend/Dockerfile .
|
|
docker build --build-arg VCS_REF="$GITHUB_SHA" --tag mobilityops-web-release frontend
|
|
- name: Generate API CycloneDX SBOM
|
|
uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5 # v0.30.0
|
|
with:
|
|
scan-type: image
|
|
image-ref: mobilityops-api-release
|
|
format: cyclonedx
|
|
output: mobilityops-api-sbom.cdx.json
|
|
- name: Generate web CycloneDX SBOM
|
|
uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5 # v0.30.0
|
|
with:
|
|
scan-type: image
|
|
image-ref: mobilityops-web-release
|
|
format: cyclonedx
|
|
output: mobilityops-web-sbom.cdx.json
|
|
- name: Record immutable image metadata
|
|
run: |
|
|
docker image inspect mobilityops-api-release > mobilityops-api-image.json
|
|
docker image inspect mobilityops-web-release > mobilityops-web-image.json
|
|
sha256sum mobilityops-*-sbom.cdx.json mobilityops-*-image.json > SHA256SUMS
|
|
- name: Upload release evidence
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
|
|
with:
|
|
name: mobilityops-${{ github.ref_name }}-evidence
|
|
path: |
|
|
mobilityops-*-sbom.cdx.json
|
|
mobilityops-*-image.json
|
|
SHA256SUMS
|