diff --git a/.github/workflows/deploy-DEV-linters.yml b/.github/workflows/deploy-DEV-linters.yml index 0e1b7872dd0..284ebb16b4f 100644 --- a/.github/workflows/deploy-DEV-linters.yml +++ b/.github/workflows/deploy-DEV-linters.yml @@ -38,6 +38,14 @@ jobs: # Set the agent to run on runs-on: ubuntu-latest permissions: read-all + services: + registry: + image: registry:2 + ports: + - 5000:5000 + env: + # If using Docker Hub, trivy would need to have docker.io as prefix + REGISTRY_PREFIX: localhost:5000 strategy: fail-fast: false max-parallel: 14 @@ -194,15 +202,16 @@ jobs: id: meta with: images: | - ${{ github.repository }}-only-${{ matrix.linter }} + ${{ env.REGISTRY_PREFIX }}/${{ github.repository }}-only-${{ matrix.linter }} - name: Set up QEMU uses: docker/setup-qemu-action@v3 if: ${{ ( ( runner.arch != 'X64' || runner.os != 'Linux' ) && matrix.platform == 'linux/amd64' ) || matrix.platform != 'linux/amd64' }} - - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 + with: + driver-opts: network=host - name: Build Image uses: docker/build-push-action@v5 @@ -214,11 +223,14 @@ jobs: BUILD_DATE=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }} BUILD_VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }} BUILD_REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }} - load: true - push: false + push: true secrets: | GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }} tags: ${{ steps.meta.outputs.tags }} + annotations: ${{ steps.meta.outputs.annotations }} + provenance: true + sbom: true + outputs: type=registry,oci-mediatypes=true,compression=estargz,force-compression=true ##################################### # Run Linter test cases # @@ -241,7 +253,7 @@ jobs: - name: Run Trivy vulnerability scanner uses: aquasecurity/trivy-action@master with: - image-ref: 'docker.io/${{ fromJson(steps.meta.outputs.json).tags[0] }}' + image-ref: '${{ fromJson(steps.meta.outputs.json).tags[0] }}' format: 'table' exit-code: '1' ignore-unfixed: true diff --git a/.github/workflows/deploy-DEV.yml b/.github/workflows/deploy-DEV.yml index 93f9fb3e74e..4588bf597ee 100644 --- a/.github/workflows/deploy-DEV.yml +++ b/.github/workflows/deploy-DEV.yml @@ -57,47 +57,35 @@ jobs: if: (github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository) && !contains(github.event.head_commit.message, 'skip deploy') # Set max build time for the job timeout-minutes: 120 + services: + registry: + image: registry:2 + ports: + - 5000:5000 + env: + # If using Docker Hub, trivy would need to have docker.io as prefix + REGISTRY_PREFIX: localhost:5000 ################## # Load all steps # ################## steps: - ########################## - # Checkout the code base # - ########################## - name: Checkout Code uses: actions/checkout@v4 - ####################### - # Docker Buildx setup # - ####################### - - name: Set up QEMU - uses: docker/setup-qemu-action@v3 - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - ######################## - # Get the current date # - ######################## - - name: Get current date - run: echo "BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >>"$GITHUB_ENV" - - ######################## - # Build image tag name # - ######################## - - name: Build image tag name - id: image_tag - run: | - BRANCH_NAME="${GITHUB_REF##*/}" - TAG="test-${{ github.actor }}-${BRANCH_NAME}" - echo "Tag name: ${TAG}" - echo "tag=${TAG}" >>"$GITHUB_OUTPUT" + - name: Docker Metadata action + uses: docker/metadata-action@v5.3.0 + id: meta + with: + images: | + ${{ env.REGISTRY_PREFIX }}/${{ github.repository }} - name: Set up QEMU uses: docker/setup-qemu-action@v3 - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 + with: + driver-opts: network=host # Free disk space - name: Free Disk space @@ -118,16 +106,18 @@ jobs: file: Dockerfile-quick platforms: linux/amd64 build-args: | - BUILD_DATE=${{ env.BUILD_DATE }} - BUILD_REVISION=${{ github.sha }} - BUILD_VERSION=${{ steps.image_tag.outputs.tag }} + BUILD_DATE=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }} + BUILD_VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }} + BUILD_REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }} MEGA_LINTER_BASE_IMAGE="oxsecurity/megalinter:beta" - load: true - push: false + push: true secrets: | GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }} - tags: | - oxsecurity/megalinter:${{ steps.image_tag.outputs.tag }} + tags: ${{ steps.meta.outputs.tags }} + annotations: ${{ steps.meta.outputs.annotations }} + provenance: true + sbom: true + outputs: type=registry,oci-mediatypes=true,compression=estargz,force-compression=true timeout-minutes: 90 ####################################### @@ -148,15 +138,17 @@ jobs: file: Dockerfile platforms: linux/amd64 build-args: | - BUILD_DATE=${{ env.BUILD_DATE }} - BUILD_REVISION=${{ github.sha }} - BUILD_VERSION=${{ steps.image_tag.outputs.tag }} - load: true - push: false + BUILD_DATE=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }} + BUILD_VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }} + BUILD_REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }} + push: true secrets: | GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }} - tags: | - oxsecurity/megalinter:${{ steps.image_tag.outputs.tag }} + tags: ${{ steps.meta.outputs.tags }} + annotations: ${{ steps.meta.outputs.annotations }} + provenance: true + sbom: true + outputs: type=registry,oci-mediatypes=true,compression=estargz,force-compression=true timeout-minutes: 90 #################################### @@ -176,15 +168,17 @@ jobs: file: Dockerfile platforms: linux/amd64 build-args: | - BUILD_DATE=${{ env.BUILD_DATE }} - BUILD_REVISION=${{ github.sha }} - BUILD_VERSION=${{ steps.image_tag.outputs.tag }} - load: true - push: false + BUILD_DATE=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }} + BUILD_VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }} + BUILD_REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }} + push: true secrets: | GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }} - tags: | - oxsecurity/megalinter:${{ steps.image_tag.outputs.tag }} + tags: ${{ steps.meta.outputs.tags }} + annotations: ${{ steps.meta.outputs.annotations }} + provenance: true + sbom: true + outputs: type=registry,oci-mediatypes=true,compression=estargz,force-compression=true # Clean docker build cache - name: Clean docker buildx cache @@ -211,7 +205,7 @@ jobs: fi fi docker image ls - docker run $CI_ENV -e TEST_CASE_RUN=true -e OUTPUT_FORMAT=text -e OUTPUT_FOLDER=${{ github.sha }} -e OUTPUT_DETAIL=detailed -e GITHUB_SHA=${{ github.sha }} -e GITHUB_REPOSITORY=${GITHUB_REPOSITORY} -e GITHUB_BRANCH=${GITHUB_BRANCH} -e GITHUB_TOKEN="${{ secrets.GITHUB_TOKEN }}" -e TEST_KEYWORDS="${TEST_KEYWORDS_TO_USE}" -e MEGALINTER_VOLUME_ROOT="${GITHUB_WORKSPACE}" -v "/var/run/docker.sock:/var/run/docker.sock:rw" -v ${GITHUB_WORKSPACE}:/tmp/lint oxsecurity/megalinter:${{ steps.image_tag.outputs.tag }} + docker run $CI_ENV -e TEST_CASE_RUN=true -e OUTPUT_FORMAT=text -e OUTPUT_FOLDER=${{ github.sha }} -e OUTPUT_DETAIL=detailed -e GITHUB_SHA=${{ github.sha }} -e GITHUB_REPOSITORY=${GITHUB_REPOSITORY} -e GITHUB_BRANCH=${GITHUB_BRANCH} -e GITHUB_TOKEN="${{ secrets.GITHUB_TOKEN }}" -e TEST_KEYWORDS="${TEST_KEYWORDS_TO_USE}" -e MEGALINTER_VOLUME_ROOT="${GITHUB_WORKSPACE}" -v "/var/run/docker.sock:/var/run/docker.sock:rw" -v ${GITHUB_WORKSPACE}:/tmp/lint ${{ fromJson(steps.meta.outputs.json).tags[0]}} timeout-minutes: 90 ##################################### @@ -220,7 +214,7 @@ jobs: - name: Run against all code base if: "!contains(github.event.head_commit.message, 'quick build')" shell: bash - run: docker run -e GITHUB_REPOSITORY="${{ github.repository }}" -e GITHUB_SHA="${{ github.sha }}" -e GITHUB_TOKEN="${{ github.token }}" -e GITHUB_RUN_ID="${{ github.run_id }}" -e GITHUB_TOKEN="${{ secrets.GITHUB_TOKEN }}" -v "/var/run/docker.sock:/var/run/docker.sock:rw" -v ${GITHUB_WORKSPACE}:/tmp/lint oxsecurity/megalinter:${{ steps.image_tag.outputs.tag }} + run: docker run -e GITHUB_REPOSITORY="${{ github.repository }}" -e GITHUB_SHA="${{ github.sha }}" -e GITHUB_TOKEN="${{ github.token }}" -e GITHUB_RUN_ID="${{ github.run_id }}" -e GITHUB_TOKEN="${{ secrets.GITHUB_TOKEN }}" -v "/var/run/docker.sock:/var/run/docker.sock:rw" -v ${GITHUB_WORKSPACE}:/tmp/lint ${{ fromJson(steps.meta.outputs.json).tags[0]}} timeout-minutes: 15 # Upload MegaLinter artifacts @@ -259,7 +253,7 @@ jobs: run: cd mega-linter-runner && sudo yarn install --frozen-lockfile && sudo npm link - name: Run mega-linter-runner tests if: ${{ steps.docker_build.outcome }} == 'success' && !contains(github.event.head_commit.message, 'quick build') - run: cd mega-linter-runner && MEGALINTER_RELEASE=${{ steps.image_tag.outputs.tag }} MEGALINTER_NO_DOCKER_PULL=true npm run test + run: cd mega-linter-runner && MEGALINTER_RELEASE=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }} MEGALINTER_NO_DOCKER_PULL=true npm run test # - name: free disk space # run: | @@ -274,7 +268,7 @@ jobs: # - name: Run Trivy vulnerability scanner # uses: aquasecurity/trivy-action@master # with: - # image-ref: "docker.io/oxsecurity/megalinter:${{ steps.image_tag.outputs.tag }}" + # image-ref: "${{ fromJson(steps.meta.outputs.json).tags[0]}}" # format: 'table' # exit-code: '1' # ignore-unfixed: true