-
-
Notifications
You must be signed in to change notification settings - Fork 0
214 lines (205 loc) · 8.04 KB
/
ci.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
---
name: ci
concurrency:
cancel-in-progress: ${{ ! startsWith(github.ref, 'refs/tags/v') }}
group: ci-${{ github.ref_name }}-${{ github.event_name }}
on:
push:
branches:
- main
tags:
- v*
pull_request:
branches:
- main
env:
ANSIBLE_FORCE_COLOR: "1"
PY_COLORS: "1"
jobs:
checkov:
if: |
contains(fromJson('["schedule", "pull_request", "push"]'), github.event_name)
permissions:
contents: read
security-events: write
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Checkov GitHub Action
uses: bridgecrewio/checkov-action@v12
with:
config_file: .checkov_config.yaml
output_format: cli,sarif
output_file_path: console,results.sarif
trivy:
if: github.event_name == 'push' || github.event_name == 'pull_request'
runs-on: ubuntu-latest
permissions:
contents: read
security-events: write
strategy:
fail-fast: false
matrix:
scan-type:
- fs
- config
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Cache trivy db
uses: actions/cache@v4
with:
path: |
~/.cache/trivy
~/work/temp
key: ${{ runner.os }}-trivy-db-${{ hashFiles('**/trivy.yaml') }}
- name: Run Trivy vulnerability scanner in fs mode
uses: aquasecurity/trivy-action@master
with:
format: sarif
ignore-unfixed: true
output: trivy-results.sarif
scan-ref: .
scan-type: ${{ matrix.scan-type }}
severity: CRITICAL,HIGH
trivy-config: trivy.yaml
token-setup-trivy: ${{ secrets.GH_PAT }}
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: trivy-results.sarif
ansible-lint:
if: github.event_name == 'push' || github.event_name == 'pull_request'
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Run ansible-lint
uses: ansible/ansible-lint@main
release-edge:
needs:
- checkov
- ansible-lint
- trivy
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
permissions:
packages: write
id-token: write
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Cosign CLI
uses: sigstore/cosign-installer@v3
- name: Setup Notation CLI
uses: notaryproject/notation-action/setup@v1
with:
version: "1.1.0"
- name: Setup Notation signing keys
run: |
mkdir -p ~/.config/notation/localkeys/
cp ./.notation/signingkeys.json ~/.config/notation/
cp ./.notation/notation.crt ~/.config/notation/localkeys/
echo "$NOTATION_KEY" > ~/.config/notation/localkeys/notation.key
env:
NOTATION_KEY: ${{ secrets.NOTATION_SIGNING_KEY }}
- name: Setup Flux CLI
uses: fluxcd/flux2/action@main
- name: Login to GitHub Container Registry
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ github.token }}
- name: Build source
run: tar cvzf kustomizations.tar.gz $(find . -maxdepth 1 -type d ! -name '.*' | grep -v -f .buildignore)
- id: push
name: Push to ghcr OCI registry
run: |
digest_url=$(flux push artifact oci://ghcr.io/${{ github.repository }}:${{ github.run_id }} \
--path=kustomizations.tar.gz \
--source=${{ github.server_url }}/${{ github.repository }} \
--revision="$(git tag --points-at HEAD)@sha1:$(git rev-parse HEAD)" \
--annotations="org.opencontainers.image.created=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" \
--annotations="org.opencontainers.image.description=OCI artifact containing Kustomizations" \
--annotations="org.opencontainers.image.documentation=${{ github.server_url }}/${{ github.repository }}" \
--annotations="org.opencontainers.image.licenses=Apache-2.0" \
--annotations="org.opencontainers.image.revision=$(git rev-parse HEAD)" \
--annotations="org.opencontainers.image.title=Kustomizations" \
--annotations="org.opencontainers.image.url=${{ github.server_url }}/${{ github.repository }}" \
--annotations="org.opencontainers.image.version=$(git tag --points-at HEAD)" \
--output json | jq -r '. | .repository + "@" + .digest')
flux tag artifact oci://ghcr.io/${{ github.repository }}:${{ github.run_id }} --tag latest
echo "digest-url=$digest_url" >> $GITHUB_OUTPUT
- name: Sign artifacts with cosign
run: |
cosign sign --yes ${{ steps.push.outputs.digest-url }}
- name: Sign artifacts with Notation
run: |
notation sign --signature-format cose ghcr.io/${{ github.repository }}:${{ github.run_id }}
notation sign --signature-format cose ghcr.io/${{ github.repository }}:latest
release-please:
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
runs-on: ubuntu-latest
permissions:
contents: write
pull-requests: write
outputs:
releases_created: ${{ steps.release-please.outputs.releases_created }}
tag_name: ${{ steps.release-please.outputs.tag_name }}
steps:
- id: release-please
name: Release please
uses: googleapis/release-please-action@v4
with:
release-type: simple
release-stable:
needs:
- release-please
if: needs.release-please.outputs.releases_created == 'true'
permissions:
contents: write
id-token: write
packages: write
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Cosign CLI
uses: sigstore/cosign-installer@v3
- name: Setup Notation CLI
uses: notaryproject/notation-action/setup@v1
with:
version: "1.1.0"
- name: Setup Flux CLI
uses: fluxcd/flux2/action@main
- name: Build source
run: tar cvzf kustomizations.tar.gz $(find . -maxdepth 1 -type d ! -name '.*' | grep -v -f .buildignore)
- name: Login to GitHub Container Registry
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ github.token }}
- name: Push to ghcr OCI registry
run: |
flux push artifact oci://ghcr.io/${{ github.repository }}:${{ needs.release-please.outputs.tag_name }} \
--path=kustomizations.tar.gz \
--source=${{ github.server_url }}/${{ github.repository }} \
--revision="$(git tag --points-at HEAD)@sha1:$(git rev-parse HEAD)" \
--annotations="org.opencontainers.image.created=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" \
--annotations="org.opencontainers.image.description=OCI artifact containing Kustomizations" \
--annotations="org.opencontainers.image.documentation=${{ github.server_url }}/${{ github.repository }}" \
--annotations="org.opencontainers.image.licenses=Apache-2.0" \
--annotations="org.opencontainers.image.revision=$(git rev-parse HEAD)" \
--annotations="org.opencontainers.image.title=Kustomizations" \
--annotations="org.opencontainers.image.url=${{ github.server_url }}/${{ github.repository }}" \
--annotations="org.opencontainers.image.version=$(git tag --points-at HEAD)"
flux tag artifact oci://ghcr.io/${{ github.repository }}:${{ needs.release-please.outputs.tag_name }} --tag latest
- name: Sign artifacts with cosign
env:
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
run: |
cosign sign --yes --key env://COSIGN_PRIVATE_KEY ghcr.io/${{ github.repository }}:${{ needs.release-please.outputs.tag_name }}