Skip to content

Update modified

Update modified #9

Workflow file for this run

name: Build
on:
push:
branches:
- main
pull_request:
types: [ opened, synchronize, reopened ]
jobs:
build:
name: Build
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
with:
fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
env:
REPO: '${{ github.event.repository.name }}'
- name: Login to Public ECR
if: github.event_name != 'pull_request'
uses: docker/login-action@v1
with:
registry: public.ecr.aws
username: ${{ secrets.AWS_ACCESS_KEY_ID }}
password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
- name: Build image
run: |
docker build -t ${{ github.event.repository.name }} .
- name: Trivy - List all vulnerabilities
uses: aquasecurity/trivy-action@master
with:
image-ref: '${{ github.event.repository.name }}'
format: 'table'
ignore-unfixed: true
vuln-type: 'os,library'
- name: Trivy - Stop on Severe Vulnerabilities
uses: aquasecurity/trivy-action@master
if: github.event_name == 'pull_request'
with:
image-ref: '${{ github.event.repository.name }}'
format: 'table'
ignore-unfixed: true
trivyignores: .github/workflows/.trivyignore
exit-code: '1'
vuln-type: 'os,library'
severity: 'CRITICAL,HIGH'
- name: Docker meta
id: meta
uses: docker/metadata-action@v4
with:
images: public.ecr.aws/dissco/${{ github.event.repository.name }}
tags: |
type=sha
type=raw,value=latest
- name: Build and Push to ECR
uses: docker/build-push-action@v3
with:
context: .
push: ${{ github.event_name != 'pull_request' }}
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
- name: Set outputs
id: vars
run: echo "::set-output name=sha_short::$(git rev-parse --short HEAD)"
- name: Push tag
if: github.event_name != 'pull_request'
uses: anothrNick/[email protected]
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
CUSTOM_TAG: sha-${{ steps.vars.outputs.sha_short }}