Skip to content

chore(deps): update dependency idna to v3.7 [security] #272

chore(deps): update dependency idna to v3.7 [security]

chore(deps): update dependency idna to v3.7 [security] #272

Workflow file for this run

name: Plural AI
on:
push:
branches:
- master
- "renovate/frontend/*"
paths:
- ".github/workflows/ai.yaml"
- "ai/**"
pull_request:
branches:
- "**"
paths:
- ".github/workflows/ai.yaml"
- "ai/**"
jobs:
build:
name: Build image
runs-on: ubuntu-20.04
permissions:
contents: 'read'
id-token: 'write'
packages: 'write'
security-events: write
actions: read
steps:
- uses: actions/checkout@v3
- name: Docker meta
id: meta
uses: docker/metadata-action@v4
with:
# list of Docker images to use as base name for tags
images: |
ghcr.io/pluralsh/plural-ai
# generate Docker tags based on the following events/attributes
tags: |
type=sha
type=ref,event=pr
type=ref,event=branch
- name: Set up QEMU
uses: docker/setup-qemu-action@v2
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v2
- name: Login to GHCR
uses: docker/login-action@v2
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
password: ${{ secrets.GITHUB_TOKEN }}
- uses: docker/build-push-action@v3
with:
context: ./ai
file: ./ai/Dockerfile
push: true
load: false
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
platforms: linux/amd64
cache-from: type=gha
cache-to: type=gha,mode=max
- name: Run Trivy vulnerability scanner on frontend image
uses: aquasecurity/trivy-action@master
with:
scan-type: 'image'
image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
hide-progress: false
format: 'sarif'
output: 'trivy-results.sarif'
security-checks: 'vuln,secret'
ignore-unfixed: true
#severity: 'CRITICAL,HIGH'
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: 'trivy-results.sarif'