mirror of
https://github.com/aquasecurity/trivy.git
synced 2025-12-24 03:58:12 -08:00
109 lines
3.1 KiB
YAML
109 lines
3.1 KiB
YAML
name: Reusable release
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
goreleaser_config:
|
|
description: 'file path to GoReleaser config'
|
|
required: true
|
|
type: string
|
|
goreleaser_options:
|
|
description: 'GoReleaser options separated by spaces'
|
|
default: ''
|
|
required: false
|
|
type: string
|
|
|
|
env:
|
|
GH_USER: "aqua-bot"
|
|
|
|
jobs:
|
|
release:
|
|
name: Release
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
DOCKER_CLI_EXPERIMENTAL: "enabled"
|
|
permissions:
|
|
id-token: write # For cosign
|
|
packages: write # For GHCR
|
|
contents: read # Not required for public repositories, but for clarity
|
|
steps:
|
|
- name: Cosign install
|
|
uses: sigstore/cosign-installer@9becc617647dfa20ae7b1151972e9b3a2c338a2b
|
|
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@v2
|
|
|
|
- name: Set up Docker Buildx
|
|
id: buildx
|
|
uses: docker/setup-buildx-action@v2
|
|
|
|
- name: Show available Docker Buildx platforms
|
|
run: echo ${{ steps.buildx.outputs.platforms }}
|
|
|
|
- name: Login to docker.io registry
|
|
uses: docker/login-action@v2
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USER }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
|
|
- name: Login to ghcr.io registry
|
|
uses: docker/login-action@v2
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ env.GH_USER }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Login to ECR
|
|
uses: docker/login-action@v2
|
|
with:
|
|
registry: public.ecr.aws
|
|
username: ${{ secrets.ECR_ACCESS_KEY_ID }}
|
|
password: ${{ secrets.ECR_SECRET_ACCESS_KEY }}
|
|
|
|
- name: Checkout code
|
|
uses: actions/checkout@v3
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Setup Go
|
|
uses: actions/setup-go@v4
|
|
with:
|
|
go-version-file: go.mod
|
|
|
|
- name: Generate SBOM
|
|
uses: CycloneDX/gh-gomod-generate-sbom@v1
|
|
with:
|
|
args: mod -licenses -json -output bom.json
|
|
version: ^v1
|
|
|
|
- name: GoReleaser
|
|
uses: goreleaser/goreleaser-action@v4
|
|
with:
|
|
version: v1.16.2
|
|
args: release -f=${{ inputs.goreleaser_config}} ${{ inputs.goreleaser_options}}
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.ORG_REPO_TOKEN }}
|
|
|
|
## push images to registries
|
|
## only for canary build
|
|
- name: Build and push
|
|
if: ${{ inputs.goreleaser_config == 'goreleaser-canary.yml' }}
|
|
uses: docker/build-push-action@v4
|
|
with:
|
|
platforms: linux/amd64, linux/arm64
|
|
file: ./Dockerfile.canary # path to Dockerfile
|
|
context: .
|
|
push: true
|
|
tags: |
|
|
aquasec/trivy:canary
|
|
ghcr.io/aquasecurity/trivy:canary
|
|
public.ecr.aws/aquasecurity/trivy:canary
|
|
|
|
- name: Cache Trivy binaries
|
|
uses: actions/cache@v3.3.1
|
|
with:
|
|
path: dist/
|
|
# use 'github.sha' to create a unique cache folder for each run.
|
|
# use 'github.workflow' to create a unique cache folder if some runs have same commit sha.
|
|
# e.g. build and release runs
|
|
key: ${{ runner.os }}-bins-${{github.workflow}}-${{github.sha}}
|