ci: refactor build workflows #565
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
sjinks
force-pushed
the
refactor/build
branch
3 times, most recently
from
518be79 to
28884ac
Compare
Trivy Scan Reportghcr.io/automattic/vip-container-images/alpine:3.18.4 (alpine 3.18.4)Vulnerabilities
MisconfigurationsNo misconfigurations found. |
Trivy Scan Reportghcr.io/automattic/vip-container-images/dev-tools:0.9 (alpine 3.18.4)Vulnerabilities
MisconfigurationsNo misconfigurations found. |
Trivy Scan Reportghcr.io/automattic/vip-container-images/mu-plugins:0.1 (alpine 3.18.4)Vulnerabilities
MisconfigurationsNo misconfigurations found. |
Trivy Scan Reportghcr.io/automattic/vip-container-images/nginx:1.25.2 (alpine 3.18.4)Vulnerabilities
MisconfigurationsNo misconfigurations found. |
Trivy Scan Reportghcr.io/automattic/vip-container-images/skeleton:latest (alpine 3.18.4)Vulnerabilities
MisconfigurationsNo misconfigurations found. |
Trivy Scan Reportghcr.io/automattic/vip-container-images/photon:latest (alpine 3.18.4)Vulnerabilities
MisconfigurationsNo misconfigurations found. |
Trivy Scan Reportghcr.io/automattic/vip-container-images/php-fpm:7.4 (ubuntu 22.04)Vulnerabilities
MisconfigurationsNo misconfigurations found. |
Trivy Scan Reportghcr.io/automattic/vip-container-images/php-fpm:8.2 (ubuntu 22.04)Vulnerabilities
MisconfigurationsNo misconfigurations found. |
Trivy Scan Reportghcr.io/automattic/vip-container-images/php-fpm:8.1 (ubuntu 22.04)Vulnerabilities
MisconfigurationsNo misconfigurations found. |
Trivy Scan Reportghcr.io/automattic/vip-container-images/php-fpm:8.3 (ubuntu 22.04)Vulnerabilities
MisconfigurationsNo misconfigurations found. |
Trivy Scan Reportghcr.io/automattic/vip-container-images/traefik_openssl:2.10.5 (alpine 3.18.4)VulnerabilitiesNo vulnerabilities found. MisconfigurationsNo misconfigurations found. usr/local/bin/traefikVulnerabilities
MisconfigurationsNo misconfigurations found. |
Trivy Scan Reportghcr.io/automattic/vip-container-images/wordpress:5.8 (alpine 3.18.4)Vulnerabilities
MisconfigurationsNo misconfigurations found. |
Trivy Scan Reportghcr.io/automattic/vip-container-images/wordpress:6.1 (alpine 3.18.4)Vulnerabilities
MisconfigurationsNo misconfigurations found. |
Trivy Scan Reportghcr.io/automattic/vip-container-images/wordpress:5.9 (alpine 3.18.4)Vulnerabilities
MisconfigurationsNo misconfigurations found. |
Trivy Scan Reportghcr.io/automattic/vip-container-images/wordpress:6.2 (alpine 3.18.4)Vulnerabilities
MisconfigurationsNo misconfigurations found. |
Trivy Scan Reportghcr.io/automattic/vip-container-images/wordpress:6.0 (alpine 3.18.4)Vulnerabilities
MisconfigurationsNo misconfigurations found. |
Trivy Scan Reportghcr.io/automattic/vip-container-images/wordpress:6.3 (alpine 3.18.4)Vulnerabilities
MisconfigurationsNo misconfigurations found. |
Trivy Scan Reportghcr.io/automattic/vip-container-images/wordpress:trunk (alpine 3.18.4)Vulnerabilities
MisconfigurationsNo misconfigurations found. |
Trivy Scan Reportghcr.io/automattic/vip-container-images/wordpress:6.4 (alpine 3.18.4)Vulnerabilities
MisconfigurationsNo misconfigurations found. |
sjinks
commented
Oct 30, 2023
Comment on lines
+79
to
+90
| - name: Load image to local Docker | ||
| uses: docker/build-push-action@v5 | ||
| with: | ||
| load: true | ||
| push: false | ||
| context: ${{ inputs.context }} | ||
| file: ${{ inputs.file }} | ||
| tags: | | ||
| ${{ inputs.primaryTag }} | ||
| ${{ inputs.tags }} | ||
| build-args: ${{ inputs.args }} |
There was a problem hiding this comment.
This second scan will not rebuild the image(s); it will load them from the build cache.
We need this step to feed the built image to the local Docker daemon. The previous step pushes the built image(s) to the registry but does not load them into Docker.
It is impossible to feed a multi-platform image to Docker anyway, so we export only the native version (amd64).
sjinks
commented
Oct 30, 2023
Comment on lines
+91
to
+106
| - name: Security Scan | ||
| uses: aquasecurity/trivy-action@master | ||
| with: | ||
| image-ref: ${{ inputs.primaryTag }} | ||
| format: template | ||
| template: "@.github/actions/build-docker-image/markdown.tpl" | ||
| output: trivy.md | ||
| if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name && github.event.sender.login != 'dependabot[bot]' | ||
|
|
||
| - name: Security Scan | ||
| uses: aquasecurity/trivy-action@master | ||
| with: | ||
| image-ref: ${{ inputs.primaryTag }} | ||
| format: table | ||
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name || github.event.sender.login == 'dependabot[bot]' |
There was a problem hiding this comment.
We cannot post a comment from a PR coming from a "foreign" repo; Dependabot's pull requests also count as coming from a foreign repo.
So:
- If this is a PR that comes from our repo and not from Dependabot, we generate a markdown output, which we will post as a comment;
- Otherwise, if this is not a pull request, a PR from a foreign repo, or Dependabot authors this PR, we print scan results to the action log.
sjinks
force-pushed
the
refactor/build
branch
from
25531f8 to
e7f7291
Compare
Trivy Scan Reportghcr.io/automattic/vip-container-images/nginx:1.25.3 (alpine 3.18.4)VulnerabilitiesNo vulnerabilities found. MisconfigurationsNo misconfigurations found. |
rebeccahum
approved these changes
Oct 31, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Supersedes: #563
Supersedes: #239