Skip to content
Docker

chore #6

Sign in to view logs

chore

chore #6

Workflow file for this run

.github/workflows/ci_bake.yml at 7b7470f
name: Docker
# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.
on:
push:
branches: [ "main" ]
# Publish semver tags as releases.
tags: [ 'v*.*.*' ]
pull_request:
branches: [ "main" ]
env:
# Use docker.io for Docker Hub if empty
REGISTRY: docker.io
DOCKER_USERNAME: argentinaluiz
# github.repository as <account>/<repo>
IMAGE_NAME: argentinaluiz/docker-ci-test
SHA: ${{ github.event.pull_request.head.sha || github.event.after }}
COMPARE_TAG: latest
jobs:
ci:
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
# This is used to complete the identity challenge
# with sigstore/fulcio when running outside of PRs.
id-token: write
pull-requests: write
security-events: write
actions: read
steps:
- name: Checkout repository
uses: actions/checkout@v4
# Install the cosign tool except on PR
# https://github.com/sigstore/cosign-installer
- name: Install cosign
if: github.event_name != 'pull_request'
uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0
with:
cosign-release: 'v2.2.4'
# Set up BuildKit Docker container builder to be able to build
# multi-platform images and export cache
# https://github.com/docker/setup-buildx-action
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
# Login against a Docker registry except on PR
# https://github.com/docker/login-action
- name: Log into registry ${{ env.REGISTRY }}
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
with:
registry: ${{ env.REGISTRY }}
username: ${{ env.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_TOKEN }}
# Extract metadata (tags, labels) for Docker
# https://github.com/docker/metadata-action
- name: Extract Docker metadata
id: meta
uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
labels: |
org.opencontainers.image.revision=${{ env.SHA }}
tags: |
type=edge,branch=$repo.default_branch
type=semver,pattern=v{{version}}
type=sha,prefix=,suffix=,format=short
# Build and push Docker image with Buildx (don't push on PR)
# https://github.com/docker/build-push-action
- name: Build CI
id: build-ci
uses: docker/bake-action@v6
env:
github_token: ${{ secrets.GITHUB_TOKEN }}
with:
push: false
load: true
targets: ci
set: |
ci.cache-from=type=gha
ci.cache-to=type=gha,mode=max
ci.tags=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:ci
# tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:ci
# cache-from: type=gha
# cache-to: type=gha,mode=max
# # tem como usar secrets como valor, env e files
# #github_token=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
# secrets: |
# github_token=${{ secrets.MY_GITHUB_TOKEN }}
- name: Up containers
run: docker compose -f ./nestjs-project/compose.ci.yaml up -d --build
- name: Run tests
run: echo "Running tests..."
- name: Build for analysis
id: build-for-analysis
if: ${{ github.event_name == 'pull_request' }}
uses: docker/bake-action@v6
env:
github_token: ${{ secrets.GITHUB_TOKEN }}
with:
push: false
load: true
targets: prod
set: |
prod.cache-from=type=gha
prod.cache-to=type=gha,mode=max
prod.tags=${{ steps.meta.outputs.tags }}
# - name: Analyze for critical and high CVEs
# id: docker-scout-cves
# uses: docker/scout-action@v1
# with:
# command: cves
# image: ${{ steps.meta.outputs.tags }}
# only-severities: critical,high
# summary: true
# exit-code: true
# only-fixed: true
# - name: Analyze for all CVEs
# id: docker-scout-all-cves
# uses: docker/scout-action@v1
# with:
# command: cves
# image: ${{ steps.meta.outputs.tags }}
# summary: true
# sarif-file: sarif.output.json
# - name: Upload SARIF result
# id: upload-sarif
# if: ${{ github.event_name != 'pull_request' }}
# uses: github/codeql-action/upload-sarif@v3
# with:
# sarif_file: sarif.output.json
# # - name: Check if ":latest" tag exists
# # if: github.event_name == 'pull_request'
# # id: check-latest-exists
# # continue-on-error: true
# # run: |
# # docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
# # - name: Docker Scout
# # id: docker-scout
# # if: ${{ github.event_name == 'pull_request' }}
# # uses: docker/scout-action@v1
# # with:
# # command: compare
# # image: ${{ steps.meta.outputs.tags }}
# # to: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.COMPARE_TAG }}
# # write-comment: true
# # ignore-unchanged: true
# # only-severities: critical,high
# # github-token: ${{ secrets.GITHUB_TOKEN }}
# - name: Build final
# id: build-final
# uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
# with:
# context: ./nestjs-project
# file: ./nestjs-project/Dockerfile.prod
# push: ${{ github.event_name != 'pull_request' }}
# tags: ${{ steps.meta.outputs.tags }}
# labels: ${{ steps.meta.outputs.labels }}
# cache-from: type=gha
# cache-to: type=gha,mode=max
# provenance: mode=max
# sbom: true
# secrets: |
# github_token=${{ secrets.GITHUB_TOKEN }}
# # Sign the resulting Docker image digest except on PRs.
# # This will only write to the public Rekor transparency log when the Docker
# # repository is public to avoid leaking data. If you would like to publish
# # transparency data even for private images, pass --force to cosign below.
# # https://github.com/sigstore/cosign
# - name: Sign the published Docker image
# if: ${{ github.event_name != 'pull_request' }}
# env:
# # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
# TAGS: ${{ steps.meta.outputs.tags }}
# DIGEST: ${{ steps.build-final.outputs.digest }}
# # This step uses the identity token to provision an ephemeral certificate
# # against the sigstore community Fulcio instance.
# run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}