Skip to content

Bump docker/login-action from 2.2.0 to 3.0.0 #116

Bump docker/login-action from 2.2.0 to 3.0.0

Bump docker/login-action from 2.2.0 to 3.0.0 #116

# This workflow will build and push a signed Docker image
name: Build and sign image
on:
pull_request:
types:
- closed
branches:
- "main"
env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}
jobs:
build_and_sign_image:
if: ${{ github.event.pull_request.merged }}
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
id-token: write
security-events: write
steps:
- name: Checkout
uses: actions/checkout@v3
- name: Install cosign
uses: sigstore/cosign-installer@11086d25041f77fe8fe7b9ea4e48e3b9192b8f19 #v3.0.2
with:
cosign-release: 'v1.13.1'
- name: Log into registry ${{ env.REGISTRY }} for ${{ github.actor }}
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Extract metadata (tags, labels) for Docker
id: meta
uses: docker/metadata-action@818d4b7b91585d195f67373fd9cb0332e31a7175
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
- name: Build Docker Image
id: docker-build-and-push
uses: docker/build-push-action@2eb1c1961a95fc15694676618e422e8ba1d63825
with:
context: .
file: ./Dockerfile
push: true
tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest,${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{github.run_number}}
- name: Sign the published Docker images
env:
COSIGN_EXPERIMENTAL: "true"
# This step uses the identity token to provision an ephemeral certificate
# against the sigstore community Fulcio instance.
run: cosign sign "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.docker-build-and-push.outputs.digest }}"
# NOTE: This runs statically against the latest tag in Docker Hub which was not produced by this workflow
# This should be updated once this workflow is fully implemented
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@fbd16365eb88e12433951383f5e99bd901fc618f # 0.12.0
continue-on-error: true
with:
image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
format: 'sarif'
output: 'trivy-results-${{ inputs.image }}.sarif'
ignore-unfixed: 'true'
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@00e563ead9f72a8461b24876bee2d0c2e8bd2ee8 # v2.2.11
continue-on-error: true
with:
sarif_file: 'trivy-results-${{ inputs.image }}.sarif'
sha: ${{ github.sha }}
ref: ${{ github.ref }}