From 1791bb2cd5d5ec66a330b1ed44f4a3283f40c95a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A9dric=20Lajus?= <74196307+Superfluxx@users.noreply.github.com> Date: Wed, 1 Apr 2026 11:39:56 +0200 Subject: [PATCH 01/20] Update pipeline (#22) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Added support fir build-args for container-ci workflow * Added default build-args logic, and renamed the build-args input parameter ti extra-build-args * Added custom user-defined tags support * Added support for ignoring hadolint rules * Added missing git metadata step * Modified author injection for commit vars * Added debug step for commit author * Added missing git fetch info * Updated git tech depth * Updated fetch depth * Fixed steps order in docker image build step * Fixed formatting issues with args * Refactored arg parse for docker build * Rationalized build args steps * Added missing checkout step * Trimmed arg-json command * Updated args json for build-args phase * Updated build-args logic * Updated build-args logic * Updated and refactored : - Added support for Dockles Ignore - Added support for Trivy Ignores - Optimized workflow by removing duplicated steps qs much as possible whilst keeping parallelization - Renamed a few steps for clarity * Updated defaults for a few params * Fixed weog version definition and updated parameters * Refactored an bu,ped hadolint action version * Added skip trivy init where it as needed * Fixed wrong dockle parameter for scan * Updated README * Made artifacts refere,ce unique * Updated docs * Cheese dockle by running it from binary * Clean dockle step and add argument handleling * Fix tentative when building chart depedencies -> ignoring oci repositories * Added fix at frst step too * Added back missing chart dir as param * Doc update : calling workflows * Change release suffix condition for dev branch * Change condition for running chart-releaser on branches * Add release steps for feature branch in CI workflow * add skip * Comment on repository OCI definition * fix CI * Clarify release types and update workflow references Updated README to clarify release management and workflow usage. * update rules * Fix config on CI Linter * fix Yaml Linter error * Fix Linter Errors * Fix : Error: ub/workflows/ci.yml:11:16: [error] too many spaces inside brackets (brackets) Error: ub/workflows/ci.yml:11:24: [error] too few spaces after comma (commas) Error: ub/workflows/ci.yml:11:29: [error] too many spaces inside brackets (brackets) * add exclusion OCI helm repository * refactoring + set path * rebuild DEV / SNAPSHOT every time called * fix chart release that not update index.yaml * fix yaml lint errors * refactor * update version of tools used by the workflow * add checkout * set the version of helm (same in all steps) * Log more info for the name of the version * Update config for chart-Releaser * skip upload if it is already made * remove download * try without upload / download at each job the chart * Need source for Polaris Scan * Delete release before create it again * skip if existe * from main * new line at end of file * test option with index * add feature branch in release process * Choose the right package-path * fix linter error : Error: ub/workflows/chart-ci.yml:361:1: [error] too many blank lines (1 > 0) (empty-lines) * remove CR releaser * downgrade chart-releaser plugin * remove download chart * [Temporary] Disable Helm, Checkout, Downloard pakaged Chart * Add Chechout step * Add Helm * All do in 1 job * Adjust task order in the job * Replace chart-releaser by specifics steps. * uncomment the right step for snapshot version name * remove tag creation * add login for fetch gh-pages * Clean before MR * add merge with helm before cr index * update url in index.yaml * update index with cr_releaser 1.7.0 * Fix for "chart-cr" action bug https://github.com/helm/chart-releaser-action/issues/171#issuecomment-2372464055 * same error * Put latest tag at the right step * again : latest_tag * Latest tag * Latest * Latest tag from $tag * Latest * export latest * CR and GH * Prepare git for chart-releaser * Latest * CR update * do it by cr * Fix version in chart. * Update CR rags + upload release * remove upload in case : immutable release * Cr args : owner and repo * Remove unused instructions * Add git login * remove OCI in dependancies list * Remove Hardcode * lower ? * name use for tag and for CR * Name * Name * Name * Name * Name * Name * looking for folder structure load for gh-pages branch * Name * Name . * Ref the commit that run the workflow * Add changelog.md as ref to release * Update trivy action to 0.35.0 (#15) * Update trivy (#19) * Fix release on Immutable TAG / RELEASE - Yaml Linter (#12) * Added support fir build-args for container-ci workflow * Added default build-args logic, and renamed the build-args input parameter ti extra-build-args * Added custom user-defined tags support * Added support for ignoring hadolint rules * Added missing git metadata step * Modified author injection for commit vars * Added debug step for commit author * Added missing git fetch info * Updated git tech depth * Updated fetch depth * Fixed steps order in docker image build step * Fixed formatting issues with args * Refactored arg parse for docker build * Rationalized build args steps * Added missing checkout step * Trimmed arg-json command * Updated args json for build-args phase * Updated build-args logic * Updated build-args logic * Updated and refactored : - Added support for Dockles Ignore - Added support for Trivy Ignores - Optimized workflow by removing duplicated steps qs much as possible whilst keeping parallelization - Renamed a few steps for clarity * Updated defaults for a few params * Fixed weog version definition and updated parameters * Refactored an bu,ped hadolint action version * Added skip trivy init where it as needed * Fixed wrong dockle parameter for scan * Updated README * Made artifacts refere,ce unique * Updated docs * Cheese dockle by running it from binary * Clean dockle step and add argument handleling * Fix tentative when building chart depedencies -> ignoring oci repositories * Added fix at frst step too * Added back missing chart dir as param * Doc update : calling workflows * Change release suffix condition for dev branch * Change condition for running chart-releaser on branches * Add release steps for feature branch in CI workflow * add skip * Comment on repository OCI definition * fix CI * Clarify release types and update workflow references Updated README to clarify release management and workflow usage. * update rules * Fix config on CI Linter * fix Yaml Linter error * Fix Linter Errors * Fix : Error: ub/workflows/ci.yml:11:16: [error] too many spaces inside brackets (brackets) Error: ub/workflows/ci.yml:11:24: [error] too few spaces after comma (commas) Error: ub/workflows/ci.yml:11:29: [error] too many spaces inside brackets (brackets) * add exclusion OCI helm repository * refactoring + set path * rebuild DEV / SNAPSHOT every time called * fix chart release that not update index.yaml * fix yaml lint errors * refactor * update version of tools used by the workflow * add checkout * set the version of helm (same in all steps) * Log more info for the name of the version * Update config for chart-Releaser * skip upload if it is already made * remove download * try without upload / download at each job the chart * Need source for Polaris Scan * Delete release before create it again * skip if existe * from main * new line at end of file * test option with index * add feature branch in release process * Choose the right package-path * fix linter error : Error: ub/workflows/chart-ci.yml:361:1: [error] too many blank lines (1 > 0) (empty-lines) * remove CR releaser * downgrade chart-releaser plugin * remove download chart * [Temporary] Disable Helm, Checkout, Downloard pakaged Chart * Add Chechout step * Add Helm * All do in 1 job * Adjust task order in the job * Replace chart-releaser by specifics steps. * uncomment the right step for snapshot version name * remove tag creation * add login for fetch gh-pages * Clean before MR * add merge with helm before cr index * update url in index.yaml * update index with cr_releaser 1.7.0 * Fix for "chart-cr" action bug https://github.com/helm/chart-releaser-action/issues/171#issuecomment-2372464055 * same error * Put latest tag at the right step * again : latest_tag * Latest tag * Latest * Latest tag from $tag * Latest * export latest * CR and GH * Prepare git for chart-releaser * Latest * CR update * do it by cr * Fix version in chart. * Update CR rags + upload release * remove upload in case : immutable release * Cr args : owner and repo * Remove unused instructions * Add git login * remove OCI in dependancies list * Remove Hardcode * lower ? * name use for tag and for CR * Name * Name * Name * Name * Name * Name * looking for folder structure load for gh-pages branch * Name * Name . * Ref the commit that run the workflow * Add changelog.md as ref to release --------- Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Lajus Co-authored-by: Cédric Lajus <74196307+Superfluxx@users.noreply.github.com> * trivy (#16) * Added support fir build-args for container-ci workflow * Added default build-args logic, and renamed the build-args input parameter ti extra-build-args * Added custom user-defined tags support * Added support for ignoring hadolint rules * Added missing git metadata step * Modified author injection for commit vars * Added debug step for commit author * Added missing git fetch info * Updated git tech depth * Updated fetch depth * Fixed steps order in docker image build step * Fixed formatting issues with args * Refactored arg parse for docker build * Rationalized build args steps * Added missing checkout step * Trimmed arg-json command * Updated args json for build-args phase * Updated build-args logic * Updated build-args logic * Updated and refactored : - Added support for Dockles Ignore - Added support for Trivy Ignores - Optimized workflow by removing duplicated steps qs much as possible whilst keeping parallelization - Renamed a few steps for clarity * Updated defaults for a few params * Fixed weog version definition and updated parameters * Refactored an bu,ped hadolint action version * Added skip trivy init where it as needed * Fixed wrong dockle parameter for scan * Updated README * Made artifacts refere,ce unique * Updated docs * Cheese dockle by running it from binary * Clean dockle step and add argument handleling * Fix tentative when building chart depedencies -> ignoring oci repositories * Added fix at frst step too * Added back missing chart dir as param * Doc update : calling workflows * Change release suffix condition for dev branch * Change condition for running chart-releaser on branches * Add release steps for feature branch in CI workflow * add skip * Comment on repository OCI definition * fix CI * Clarify release types and update workflow references Updated README to clarify release management and workflow usage. * update rules * Fix config on CI Linter * fix Yaml Linter error * Fix Linter Errors * Fix : Error: ub/workflows/ci.yml:11:16: [error] too many spaces inside brackets (brackets) Error: ub/workflows/ci.yml:11:24: [error] too few spaces after comma (commas) Error: ub/workflows/ci.yml:11:29: [error] too many spaces inside brackets (brackets) * add exclusion OCI helm repository * refactoring + set path * rebuild DEV / SNAPSHOT every time called * fix chart release that not update index.yaml * fix yaml lint errors * refactor * update version of tools used by the workflow * add checkout * set the version of helm (same in all steps) * Log more info for the name of the version * Update config for chart-Releaser * skip upload if it is already made * remove download * try without upload / download at each job the chart * Need source for Polaris Scan * Delete release before create it again * skip if existe * from main * new line at end of file * test option with index * add feature branch in release process * Choose the right package-path * fix linter error : Error: ub/workflows/chart-ci.yml:361:1: [error] too many blank lines (1 > 0) (empty-lines) * remove CR releaser * downgrade chart-releaser plugin * remove download chart * [Temporary] Disable Helm, Checkout, Downloard pakaged Chart * Add Chechout step * Add Helm * All do in 1 job * Adjust task order in the job * Replace chart-releaser by specifics steps. * uncomment the right step for snapshot version name * remove tag creation * add login for fetch gh-pages * Clean before MR * add merge with helm before cr index * update url in index.yaml * update index with cr_releaser 1.7.0 * Fix for "chart-cr" action bug https://github.com/helm/chart-releaser-action/issues/171#issuecomment-2372464055 * same error * Put latest tag at the right step * again : latest_tag * Latest tag * Latest * Latest tag from $tag * Latest * export latest * CR and GH * Prepare git for chart-releaser * Latest * CR update * do it by cr * Fix version in chart. * Update CR rags + upload release * remove upload in case : immutable release * Cr args : owner and repo * Remove unused instructions * Add git login * remove OCI in dependancies list * Remove Hardcode * lower ? * name use for tag and for CR * Name * Name * Name * Name * Name * Name * looking for folder structure load for gh-pages branch * Name * Name . * Ref the commit that run the workflow * Add changelog.md as ref to release * Update trivy action to 0.35.0 (#15) --------- Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Lajus Co-authored-by: Cédric Lajus <74196307+Superfluxx@users.noreply.github.com> * Update CI workflow with update (#17) * Added support fir build-args for container-ci workflow * Added default build-args logic, and renamed the build-args input parameter ti extra-build-args * Added custom user-defined tags support * Added support for ignoring hadolint rules * Added missing git metadata step * Modified author injection for commit vars * Added debug step for commit author * Added missing git fetch info * Updated git tech depth * Updated fetch depth * Fixed steps order in docker image build step * Fixed formatting issues with args * Refactored arg parse for docker build * Rationalized build args steps * Added missing checkout step * Trimmed arg-json command * Updated args json for build-args phase * Updated build-args logic * Updated build-args logic * Updated and refactored : - Added support for Dockles Ignore - Added support for Trivy Ignores - Optimized workflow by removing duplicated steps qs much as possible whilst keeping parallelization - Renamed a few steps for clarity * Updated defaults for a few params * Fixed weog version definition and updated parameters * Refactored an bu,ped hadolint action version * Added skip trivy init where it as needed * Fixed wrong dockle parameter for scan * Updated README * Made artifacts refere,ce unique * Updated docs * Cheese dockle by running it from binary * Clean dockle step and add argument handleling * Fix tentative when building chart depedencies -> ignoring oci repositories * Added fix at frst step too * Added back missing chart dir as param * Doc update : calling workflows * Change release suffix condition for dev branch * Change condition for running chart-releaser on branches * Add release steps for feature branch in CI workflow * add skip * Comment on repository OCI definition * fix CI * Clarify release types and update workflow references Updated README to clarify release management and workflow usage. * update rules * Fix config on CI Linter * fix Yaml Linter error * Fix Linter Errors * Fix : Error: ub/workflows/ci.yml:11:16: [error] too many spaces inside brackets (brackets) Error: ub/workflows/ci.yml:11:24: [error] too few spaces after comma (commas) Error: ub/workflows/ci.yml:11:29: [error] too many spaces inside brackets (brackets) * add exclusion OCI helm repository * refactoring + set path * rebuild DEV / SNAPSHOT every time called * fix chart release that not update index.yaml * fix yaml lint errors * refactor * update version of tools used by the workflow * add checkout * set the version of helm (same in all steps) * Log more info for the name of the version * Update config for chart-Releaser * skip upload if it is already made * remove download * try without upload / download at each job the chart * Need source for Polaris Scan * Delete release before create it again * skip if existe * from main * new line at end of file * test option with index * add feature branch in release process * Choose the right package-path * fix linter error : Error: ub/workflows/chart-ci.yml:361:1: [error] too many blank lines (1 > 0) (empty-lines) * remove CR releaser * downgrade chart-releaser plugin * remove download chart * [Temporary] Disable Helm, Checkout, Downloard pakaged Chart * Add Chechout step * Add Helm * All do in 1 job * Adjust task order in the job * Replace chart-releaser by specifics steps. * uncomment the right step for snapshot version name * remove tag creation * add login for fetch gh-pages * Clean before MR * add merge with helm before cr index * update url in index.yaml * update index with cr_releaser 1.7.0 * Fix for "chart-cr" action bug https://github.com/helm/chart-releaser-action/issues/171#issuecomment-2372464055 * same error * Put latest tag at the right step * again : latest_tag * Latest tag * Latest * Latest tag from $tag * Latest * export latest * CR and GH * Prepare git for chart-releaser * Latest * CR update * do it by cr * Fix version in chart. * Update CR rags + upload release * remove upload in case : immutable release * Cr args : owner and repo * Remove unused instructions * Add git login * remove OCI in dependancies list * Remove Hardcode * lower ? * name use for tag and for CR * Name * Name * Name * Name * Name * Name * looking for folder structure load for gh-pages branch * Name * Name . * Ref the commit that run the workflow * Add changelog.md as ref to release * Update trivy action to 0.35.0 (#15) --------- Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Lajus Co-authored-by: Cédric Lajus <74196307+Superfluxx@users.noreply.github.com> * Update container-ci.yml * Update chart-ci.yml * Update container-ci.yml * Update chart-ci.yml --------- Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Lajus Co-authored-by: Cédric Lajus <74196307+Superfluxx@users.noreply.github.com> * Update versions (#21) * Mise à jour des versions * fix --------- Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Nicolas-Delahaye --- .github/workflows/chart-ci.yml | 40 +++++++++++++++--------------- .github/workflows/container-ci.yml | 24 +++++++++--------- 2 files changed, 32 insertions(+), 32 deletions(-) diff --git a/.github/workflows/chart-ci.yml b/.github/workflows/chart-ci.yml index 7c86129..ac760b2 100644 --- a/.github/workflows/chart-ci.yml +++ b/.github/workflows/chart-ci.yml @@ -25,12 +25,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v6 with: fetch-depth: 0 - name: Install Helm - uses: azure/setup-helm@v4.3.1 + uses: azure/setup-helm@v5 with: version: v3.14.4 @@ -52,22 +52,22 @@ jobs: helm dependency build ${{ inputs.chart-dir }} - name: Generate values schema json - uses: losisin/helm-values-schema-json-action@v1.5.3 + uses: losisin/helm-values-schema-json-action@v2.5.0 with: - input: ${{ inputs.chart-dir }}/values.yaml + values: ${{ inputs.chart-values }} output: ${{ inputs.chart-dir }}/values.schema.json - name: Helm-docs - uses: losisin/helm-docs-github-action@v1.3.3 + uses: losisin/helm-docs-github-action@v1.8.0 with: chart-search-root: ${{ inputs.chart-dir }} - values-file: ${{ inputs.chart-dir }}/values.yaml + values-file: ${{ inputs.chart-values }} output-file: ${{ inputs.chart-dir }}/README.md template-files: ${{ inputs.chart-dir }}/README.md.gotpl sort-values-order: file - name: Upload packaged Chart - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: packaged-chart path: ${{ inputs.chart-dir }} @@ -81,21 +81,21 @@ jobs: needs: helm-build-chart steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v6 with: fetch-depth: 0 - name: Download packaged Chart - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: packaged-chart path: ${{ inputs.chart-dir }} - name: Set up Helm - uses: azure/setup-helm@v4.3.1 + uses: azure/setup-helm@v5 - name: Set up chart-testing - uses: helm/chart-testing-action@v2.6.1 + uses: helm/chart-testing-action@v2.8.0 - name: Run ct lint run: | @@ -110,13 +110,13 @@ jobs: runs-on: ubuntu-latest steps: - name: Download packaged Chart - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: packaged-chart path: ${{ inputs.chart-dir }} - name: Set up Helm - uses: azure/setup-helm@v4.3.1 + uses: azure/setup-helm@v5 with: version: v3.14.4 @@ -141,7 +141,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Download packaged Chart - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: packaged-chart path: ${{ inputs.chart-dir }} @@ -179,7 +179,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Download packaged Chart - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: packaged-chart path: ${{ inputs.chart-dir }} @@ -225,23 +225,23 @@ jobs: - trivy steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v6 with: fetch-depth: 0 - name: Download packaged Chart - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: packaged-chart path: ${{ inputs.chart-dir }} - name: Set up Helm - uses: azure/setup-helm@v4.3.1 + uses: azure/setup-helm@v5 with: version: v3.14.4 - name: Set up chart-testing - uses: helm/chart-testing-action@v2.6.1 + uses: helm/chart-testing-action@v2.8.0 - name: Run chart-testing (list-changed) id: list-changed @@ -272,7 +272,7 @@ jobs: contents: write steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v6 with: fetch-depth: 0 diff --git a/.github/workflows/container-ci.yml b/.github/workflows/container-ci.yml index 373ce83..b73172f 100644 --- a/.github/workflows/container-ci.yml +++ b/.github/workflows/container-ci.yml @@ -64,7 +64,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@v6 - name: Build Hadolint report uses: hadolint/hadolint-action@v3.3.0 @@ -97,7 +97,7 @@ jobs: needs: dockerfile-lint steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@v6 with: fetch-depth: 0 @@ -123,7 +123,7 @@ jobs: - name: Docker meta id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@v6 env: DOCKER_METADATA_SHORT_SHA_LENGTH: 7 with: @@ -159,7 +159,7 @@ jobs: outputs: type=docker,dest=/tmp/container.image.${{ hashFiles(inputs.dockerfile-path) }}.tar - name: Upload artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: container.image.${{ hashFiles(inputs.dockerfile-path) }} path: /tmp/container.image.${{ hashFiles(inputs.dockerfile-path) }}.tar @@ -171,10 +171,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@v6 - name: Download image tarball - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: container.image.${{ hashFiles(inputs.dockerfile-path) }} path: /tmp @@ -236,10 +236,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@v6 - name: Download image tarball - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: container.image.${{ hashFiles(inputs.dockerfile-path) }} path: /tmp @@ -292,7 +292,7 @@ jobs: exit-code: '0' - name: Submit SBOM to GitHub Dependency Graph - uses: advanced-security/spdx-dependency-submission-action@v0.1.1 + uses: advanced-security/spdx-dependency-submission-action@v0.2.0 with: filePath: 'image-sbom.spdx.json' @@ -378,10 +378,10 @@ jobs: runs-on: ubuntu-24.04 steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@v6 - name: Download image tarball - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: container.image.${{ hashFiles(inputs.dockerfile-path) }} path: /tmp @@ -396,7 +396,7 @@ jobs: docker image ls -a - name: Login to GitHub Container Registry - uses: docker/login-action@v3.3.0 + uses: docker/login-action@v4 with: registry: ghcr.io username: ${{github.actor}} From 338055671be160ef48b65a34fbe05badf18679ad Mon Sep 17 00:00:00 2001 From: Nicolas-Delahaye Date: Mon, 4 May 2026 16:38:28 +0200 Subject: [PATCH 02/20] Polaris and versions components (#24) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Added support fir build-args for container-ci workflow * Added default build-args logic, and renamed the build-args input parameter ti extra-build-args * Added custom user-defined tags support * Added support for ignoring hadolint rules * Added missing git metadata step * Modified author injection for commit vars * Added debug step for commit author * Added missing git fetch info * Updated git tech depth * Updated fetch depth * Fixed steps order in docker image build step * Fixed formatting issues with args * Refactored arg parse for docker build * Rationalized build args steps * Added missing checkout step * Trimmed arg-json command * Updated args json for build-args phase * Updated build-args logic * Updated build-args logic * Updated and refactored : - Added support for Dockles Ignore - Added support for Trivy Ignores - Optimized workflow by removing duplicated steps qs much as possible whilst keeping parallelization - Renamed a few steps for clarity * Updated defaults for a few params * Fixed weog version definition and updated parameters * Refactored an bu,ped hadolint action version * Added skip trivy init where it as needed * Fixed wrong dockle parameter for scan * Updated README * Made artifacts refere,ce unique * Updated docs * Cheese dockle by running it from binary * Clean dockle step and add argument handleling * Fix tentative when building chart depedencies -> ignoring oci repositories * Added fix at frst step too * Added back missing chart dir as param * Doc update : calling workflows * Change release suffix condition for dev branch * Change condition for running chart-releaser on branches * Add release steps for feature branch in CI workflow * add skip * Comment on repository OCI definition * fix CI * Clarify release types and update workflow references Updated README to clarify release management and workflow usage. * update rules * Fix config on CI Linter * fix Yaml Linter error * Fix Linter Errors * Fix : Error: ub/workflows/ci.yml:11:16: [error] too many spaces inside brackets (brackets) Error: ub/workflows/ci.yml:11:24: [error] too few spaces after comma (commas) Error: ub/workflows/ci.yml:11:29: [error] too many spaces inside brackets (brackets) * add exclusion OCI helm repository * refactoring + set path * rebuild DEV / SNAPSHOT every time called * fix chart release that not update index.yaml * fix yaml lint errors * refactor * update version of tools used by the workflow * add checkout * set the version of helm (same in all steps) * Log more info for the name of the version * Update config for chart-Releaser * skip upload if it is already made * remove download * try without upload / download at each job the chart * Need source for Polaris Scan * Delete release before create it again * skip if existe * from main * new line at end of file * test option with index * add feature branch in release process * Choose the right package-path * fix linter error : Error: ub/workflows/chart-ci.yml:361:1: [error] too many blank lines (1 > 0) (empty-lines) * remove CR releaser * downgrade chart-releaser plugin * remove download chart * [Temporary] Disable Helm, Checkout, Downloard pakaged Chart * Add Chechout step * Add Helm * All do in 1 job * Adjust task order in the job * Replace chart-releaser by specifics steps. * uncomment the right step for snapshot version name * remove tag creation * add login for fetch gh-pages * Clean before MR * add merge with helm before cr index * update url in index.yaml * update index with cr_releaser 1.7.0 * Fix for "chart-cr" action bug https://github.com/helm/chart-releaser-action/issues/171#issuecomment-2372464055 * same error * Put latest tag at the right step * again : latest_tag * Latest tag * Latest * Latest tag from $tag * Latest * export latest * CR and GH * Prepare git for chart-releaser * Latest * CR update * do it by cr * Fix version in chart. * Update CR rags + upload release * remove upload in case : immutable release * Cr args : owner and repo * Remove unused instructions * Add git login * remove OCI in dependancies list * Remove Hardcode * lower ? * name use for tag and for CR * Name * Name * Name * Name * Name * Name * looking for folder structure load for gh-pages branch * Name * Name . * Ref the commit that run the workflow * Add changelog.md as ref to release * Update trivy action to 0.35.0 (#15) * Update trivy (#19) * Fix release on Immutable TAG / RELEASE - Yaml Linter (#12) * Added support fir build-args for container-ci workflow * Added default build-args logic, and renamed the build-args input parameter ti extra-build-args * Added custom user-defined tags support * Added support for ignoring hadolint rules * Added missing git metadata step * Modified author injection for commit vars * Added debug step for commit author * Added missing git fetch info * Updated git tech depth * Updated fetch depth * Fixed steps order in docker image build step * Fixed formatting issues with args * Refactored arg parse for docker build * Rationalized build args steps * Added missing checkout step * Trimmed arg-json command * Updated args json for build-args phase * Updated build-args logic * Updated build-args logic * Updated and refactored : - Added support for Dockles Ignore - Added support for Trivy Ignores - Optimized workflow by removing duplicated steps qs much as possible whilst keeping parallelization - Renamed a few steps for clarity * Updated defaults for a few params * Fixed weog version definition and updated parameters * Refactored an bu,ped hadolint action version * Added skip trivy init where it as needed * Fixed wrong dockle parameter for scan * Updated README * Made artifacts refere,ce unique * Updated docs * Cheese dockle by running it from binary * Clean dockle step and add argument handleling * Fix tentative when building chart depedencies -> ignoring oci repositories * Added fix at frst step too * Added back missing chart dir as param * Doc update : calling workflows * Change release suffix condition for dev branch * Change condition for running chart-releaser on branches * Add release steps for feature branch in CI workflow * add skip * Comment on repository OCI definition * fix CI * Clarify release types and update workflow references Updated README to clarify release management and workflow usage. * update rules * Fix config on CI Linter * fix Yaml Linter error * Fix Linter Errors * Fix : Error: ub/workflows/ci.yml:11:16: [error] too many spaces inside brackets (brackets) Error: ub/workflows/ci.yml:11:24: [error] too few spaces after comma (commas) Error: ub/workflows/ci.yml:11:29: [error] too many spaces inside brackets (brackets) * add exclusion OCI helm repository * refactoring + set path * rebuild DEV / SNAPSHOT every time called * fix chart release that not update index.yaml * fix yaml lint errors * refactor * update version of tools used by the workflow * add checkout * set the version of helm (same in all steps) * Log more info for the name of the version * Update config for chart-Releaser * skip upload if it is already made * remove download * try without upload / download at each job the chart * Need source for Polaris Scan * Delete release before create it again * skip if existe * from main * new line at end of file * test option with index * add feature branch in release process * Choose the right package-path * fix linter error : Error: ub/workflows/chart-ci.yml:361:1: [error] too many blank lines (1 > 0) (empty-lines) * remove CR releaser * downgrade chart-releaser plugin * remove download chart * [Temporary] Disable Helm, Checkout, Downloard pakaged Chart * Add Chechout step * Add Helm * All do in 1 job * Adjust task order in the job * Replace chart-releaser by specifics steps. * uncomment the right step for snapshot version name * remove tag creation * add login for fetch gh-pages * Clean before MR * add merge with helm before cr index * update url in index.yaml * update index with cr_releaser 1.7.0 * Fix for "chart-cr" action bug https://github.com/helm/chart-releaser-action/issues/171#issuecomment-2372464055 * same error * Put latest tag at the right step * again : latest_tag * Latest tag * Latest * Latest tag from $tag * Latest * export latest * CR and GH * Prepare git for chart-releaser * Latest * CR update * do it by cr * Fix version in chart. * Update CR rags + upload release * remove upload in case : immutable release * Cr args : owner and repo * Remove unused instructions * Add git login * remove OCI in dependancies list * Remove Hardcode * lower ? * name use for tag and for CR * Name * Name * Name * Name * Name * Name * looking for folder structure load for gh-pages branch * Name * Name . * Ref the commit that run the workflow * Add changelog.md as ref to release --------- Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Lajus Co-authored-by: Cédric Lajus <74196307+Superfluxx@users.noreply.github.com> * trivy (#16) * Added support fir build-args for container-ci workflow * Added default build-args logic, and renamed the build-args input parameter ti extra-build-args * Added custom user-defined tags support * Added support for ignoring hadolint rules * Added missing git metadata step * Modified author injection for commit vars * Added debug step for commit author * Added missing git fetch info * Updated git tech depth * Updated fetch depth * Fixed steps order in docker image build step * Fixed formatting issues with args * Refactored arg parse for docker build * Rationalized build args steps * Added missing checkout step * Trimmed arg-json command * Updated args json for build-args phase * Updated build-args logic * Updated build-args logic * Updated and refactored : - Added support for Dockles Ignore - Added support for Trivy Ignores - Optimized workflow by removing duplicated steps qs much as possible whilst keeping parallelization - Renamed a few steps for clarity * Updated defaults for a few params * Fixed weog version definition and updated parameters * Refactored an bu,ped hadolint action version * Added skip trivy init where it as needed * Fixed wrong dockle parameter for scan * Updated README * Made artifacts refere,ce unique * Updated docs * Cheese dockle by running it from binary * Clean dockle step and add argument handleling * Fix tentative when building chart depedencies -> ignoring oci repositories * Added fix at frst step too * Added back missing chart dir as param * Doc update : calling workflows * Change release suffix condition for dev branch * Change condition for running chart-releaser on branches * Add release steps for feature branch in CI workflow * add skip * Comment on repository OCI definition * fix CI * Clarify release types and update workflow references Updated README to clarify release management and workflow usage. * update rules * Fix config on CI Linter * fix Yaml Linter error * Fix Linter Errors * Fix : Error: ub/workflows/ci.yml:11:16: [error] too many spaces inside brackets (brackets) Error: ub/workflows/ci.yml:11:24: [error] too few spaces after comma (commas) Error: ub/workflows/ci.yml:11:29: [error] too many spaces inside brackets (brackets) * add exclusion OCI helm repository * refactoring + set path * rebuild DEV / SNAPSHOT every time called * fix chart release that not update index.yaml * fix yaml lint errors * refactor * update version of tools used by the workflow * add checkout * set the version of helm (same in all steps) * Log more info for the name of the version * Update config for chart-Releaser * skip upload if it is already made * remove download * try without upload / download at each job the chart * Need source for Polaris Scan * Delete release before create it again * skip if existe * from main * new line at end of file * test option with index * add feature branch in release process * Choose the right package-path * fix linter error : Error: ub/workflows/chart-ci.yml:361:1: [error] too many blank lines (1 > 0) (empty-lines) * remove CR releaser * downgrade chart-releaser plugin * remove download chart * [Temporary] Disable Helm, Checkout, Downloard pakaged Chart * Add Chechout step * Add Helm * All do in 1 job * Adjust task order in the job * Replace chart-releaser by specifics steps. * uncomment the right step for snapshot version name * remove tag creation * add login for fetch gh-pages * Clean before MR * add merge with helm before cr index * update url in index.yaml * update index with cr_releaser 1.7.0 * Fix for "chart-cr" action bug https://github.com/helm/chart-releaser-action/issues/171#issuecomment-2372464055 * same error * Put latest tag at the right step * again : latest_tag * Latest tag * Latest * Latest tag from $tag * Latest * export latest * CR and GH * Prepare git for chart-releaser * Latest * CR update * do it by cr * Fix version in chart. * Update CR rags + upload release * remove upload in case : immutable release * Cr args : owner and repo * Remove unused instructions * Add git login * remove OCI in dependancies list * Remove Hardcode * lower ? * name use for tag and for CR * Name * Name * Name * Name * Name * Name * looking for folder structure load for gh-pages branch * Name * Name . * Ref the commit that run the workflow * Add changelog.md as ref to release * Update trivy action to 0.35.0 (#15) --------- Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Lajus Co-authored-by: Cédric Lajus <74196307+Superfluxx@users.noreply.github.com> * Update CI workflow with update (#17) * Added support fir build-args for container-ci workflow * Added default build-args logic, and renamed the build-args input parameter ti extra-build-args * Added custom user-defined tags support * Added support for ignoring hadolint rules * Added missing git metadata step * Modified author injection for commit vars * Added debug step for commit author * Added missing git fetch info * Updated git tech depth * Updated fetch depth * Fixed steps order in docker image build step * Fixed formatting issues with args * Refactored arg parse for docker build * Rationalized build args steps * Added missing checkout step * Trimmed arg-json command * Updated args json for build-args phase * Updated build-args logic * Updated build-args logic * Updated and refactored : - Added support for Dockles Ignore - Added support for Trivy Ignores - Optimized workflow by removing duplicated steps qs much as possible whilst keeping parallelization - Renamed a few steps for clarity * Updated defaults for a few params * Fixed weog version definition and updated parameters * Refactored an bu,ped hadolint action version * Added skip trivy init where it as needed * Fixed wrong dockle parameter for scan * Updated README * Made artifacts refere,ce unique * Updated docs * Cheese dockle by running it from binary * Clean dockle step and add argument handleling * Fix tentative when building chart depedencies -> ignoring oci repositories * Added fix at frst step too * Added back missing chart dir as param * Doc update : calling workflows * Change release suffix condition for dev branch * Change condition for running chart-releaser on branches * Add release steps for feature branch in CI workflow * add skip * Comment on repository OCI definition * fix CI * Clarify release types and update workflow references Updated README to clarify release management and workflow usage. * update rules * Fix config on CI Linter * fix Yaml Linter error * Fix Linter Errors * Fix : Error: ub/workflows/ci.yml:11:16: [error] too many spaces inside brackets (brackets) Error: ub/workflows/ci.yml:11:24: [error] too few spaces after comma (commas) Error: ub/workflows/ci.yml:11:29: [error] too many spaces inside brackets (brackets) * add exclusion OCI helm repository * refactoring + set path * rebuild DEV / SNAPSHOT every time called * fix chart release that not update index.yaml * fix yaml lint errors * refactor * update version of tools used by the workflow * add checkout * set the version of helm (same in all steps) * Log more info for the name of the version * Update config for chart-Releaser * skip upload if it is already made * remove download * try without upload / download at each job the chart * Need source for Polaris Scan * Delete release before create it again * skip if existe * from main * new line at end of file * test option with index * add feature branch in release process * Choose the right package-path * fix linter error : Error: ub/workflows/chart-ci.yml:361:1: [error] too many blank lines (1 > 0) (empty-lines) * remove CR releaser * downgrade chart-releaser plugin * remove download chart * [Temporary] Disable Helm, Checkout, Downloard pakaged Chart * Add Chechout step * Add Helm * All do in 1 job * Adjust task order in the job * Replace chart-releaser by specifics steps. * uncomment the right step for snapshot version name * remove tag creation * add login for fetch gh-pages * Clean before MR * add merge with helm before cr index * update url in index.yaml * update index with cr_releaser 1.7.0 * Fix for "chart-cr" action bug https://github.com/helm/chart-releaser-action/issues/171#issuecomment-2372464055 * same error * Put latest tag at the right step * again : latest_tag * Latest tag * Latest * Latest tag from $tag * Latest * export latest * CR and GH * Prepare git for chart-releaser * Latest * CR update * do it by cr * Fix version in chart. * Update CR rags + upload release * remove upload in case : immutable release * Cr args : owner and repo * Remove unused instructions * Add git login * remove OCI in dependancies list * Remove Hardcode * lower ? * name use for tag and for CR * Name * Name * Name * Name * Name * Name * looking for folder structure load for gh-pages branch * Name * Name . * Ref the commit that run the workflow * Add changelog.md as ref to release * Update trivy action to 0.35.0 (#15) --------- Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Lajus Co-authored-by: Cédric Lajus <74196307+Superfluxx@users.noreply.github.com> * Update container-ci.yml * Update chart-ci.yml * Update container-ci.yml * Update chart-ci.yml --------- Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Lajus Co-authored-by: Cédric Lajus <74196307+Superfluxx@users.noreply.github.com> * Update versions (#21) * Mise à jour des versions * fix * Polaris update (#23) * Update pipeline (#22) * Added support fir build-args for container-ci workflow * Added default build-args logic, and renamed the build-args input parameter ti extra-build-args * Added custom user-defined tags support * Added support for ignoring hadolint rules * Added missing git metadata step * Modified author injection for commit vars * Added debug step for commit author * Added missing git fetch info * Updated git tech depth * Updated fetch depth * Fixed steps order in docker image build step * Fixed formatting issues with args * Refactored arg parse for docker build * Rationalized build args steps * Added missing checkout step * Trimmed arg-json command * Updated args json for build-args phase * Updated build-args logic * Updated build-args logic * Updated and refactored : - Added support for Dockles Ignore - Added support for Trivy Ignores - Optimized workflow by removing duplicated steps qs much as possible whilst keeping parallelization - Renamed a few steps for clarity * Updated defaults for a few params * Fixed weog version definition and updated parameters * Refactored an bu,ped hadolint action version * Added skip trivy init where it as needed * Fixed wrong dockle parameter for scan * Updated README * Made artifacts refere,ce unique * Updated docs * Cheese dockle by running it from binary * Clean dockle step and add argument handleling * Fix tentative when building chart depedencies -> ignoring oci repositories * Added fix at frst step too * Added back missing chart dir as param * Doc update : calling workflows * Change release suffix condition for dev branch * Change condition for running chart-releaser on branches * Add release steps for feature branch in CI workflow * add skip * Comment on repository OCI definition * fix CI * Clarify release types and update workflow references Updated README to clarify release management and workflow usage. * update rules * Fix config on CI Linter * fix Yaml Linter error * Fix Linter Errors * Fix : Error: ub/workflows/ci.yml:11:16: [error] too many spaces inside brackets (brackets) Error: ub/workflows/ci.yml:11:24: [error] too few spaces after comma (commas) Error: ub/workflows/ci.yml:11:29: [error] too many spaces inside brackets (brackets) * add exclusion OCI helm repository * refactoring + set path * rebuild DEV / SNAPSHOT every time called * fix chart release that not update index.yaml * fix yaml lint errors * refactor * update version of tools used by the workflow * add checkout * set the version of helm (same in all steps) * Log more info for the name of the version * Update config for chart-Releaser * skip upload if it is already made * remove download * try without upload / download at each job the chart * Need source for Polaris Scan * Delete release before create it again * skip if existe * from main * new line at end of file * test option with index * add feature branch in release process * Choose the right package-path * fix linter error : Error: ub/workflows/chart-ci.yml:361:1: [error] too many blank lines (1 > 0) (empty-lines) * remove CR releaser * downgrade chart-releaser plugin * remove download chart * [Temporary] Disable Helm, Checkout, Downloard pakaged Chart * Add Chechout step * Add Helm * All do in 1 job * Adjust task order in the job * Replace chart-releaser by specifics steps. * uncomment the right step for snapshot version name * remove tag creation * add login for fetch gh-pages * Clean before MR * add merge with helm before cr index * update url in index.yaml * update index with cr_releaser 1.7.0 * Fix for "chart-cr" action bug https://github.com/helm/chart-releaser-action/issues/171#issuecomment-2372464055 * same error * Put latest tag at the right step * again : latest_tag * Latest tag * Latest * Latest tag from $tag * Latest * export latest * CR and GH * Prepare git for chart-releaser * Latest * CR update * do it by cr * Fix version in chart. * Update CR rags + upload release * remove upload in case : immutable release * Cr args : owner and repo * Remove unused instructions * Add git login * remove OCI in dependancies list * Remove Hardcode * lower ? * name use for tag and for CR * Name * Name * Name * Name * Name * Name * looking for folder structure load for gh-pages branch * Name * Name . * Ref the commit that run the workflow * Add changelog.md as ref to release * Update trivy action to 0.35.0 (#15) * Update trivy (#19) * Fix release on Immutable TAG / RELEASE - Yaml Linter (#12) * Added support fir build-args for container-ci workflow * Added default build-args logic, and renamed the build-args input parameter ti extra-build-args * Added custom user-defined tags support * Added support for ignoring hadolint rules * Added missing git metadata step * Modified author injection for commit vars * Added debug step for commit author * Added missing git fetch info * Updated git tech depth * Updated fetch depth * Fixed steps order in docker image build step * Fixed formatting issues with args * Refactored arg parse for docker build * Rationalized build args steps * Added missing checkout step * Trimmed arg-json command * Updated args json for build-args phase * Updated build-args logic * Updated build-args logic * Updated and refactored : - Added support for Dockles Ignore - Added support for Trivy Ignores - Optimized workflow by removing duplicated steps qs much as possible whilst keeping parallelization - Renamed a few steps for clarity * Updated defaults for a few params * Fixed weog version definition and updated parameters * Refactored an bu,ped hadolint action version * Added skip trivy init where it as needed * Fixed wrong dockle parameter for scan * Updated README * Made artifacts refere,ce unique * Updated docs * Cheese dockle by running it from binary * Clean dockle step and add argument handleling * Fix tentative when building chart depedencies -> ignoring oci repositories * Added fix at frst step too * Added back missing chart dir as param * Doc update : calling workflows * Change release suffix condition for dev branch * Change condition for running chart-releaser on branches * Add release steps for feature branch in CI workflow * add skip * Comment on repository OCI definition * fix CI * Clarify release types and update workflow references Updated README to clarify release management and workflow usage. * update rules * Fix config on CI Linter * fix Yaml Linter error * Fix Linter Errors * Fix : Error: ub/workflows/ci.yml:11:16: [error] too many spaces inside brackets (brackets) Error: ub/workflows/ci.yml:11:24: [error] too few spaces after comma (commas) Error: ub/workflows/ci.yml:11:29: [error] too many spaces inside brackets (brackets) * add exclusion OCI helm repository * refactoring + set path * rebuild DEV / SNAPSHOT every time called * fix chart release that not update index.yaml * fix yaml lint errors * refactor * update version of tools used by the workflow * add checkout * set the version of helm (same in all steps) * Log more info for the name of the version * Update config for chart-Releaser * skip upload if it is already made * remove download * try without upload / download at each job the chart * Need source for Polaris Scan * Delete release before create it again * skip if existe * from main * new line at end of file * test option with index * add feature branch in release process * Choose the right package-path * fix linter error : Error: ub/workflows/chart-ci.yml:361:1: [error] too many blank lines (1 > 0) (empty-lines) * remove CR releaser * downgrade chart-releaser plugin * remove download chart * [Temporary] Disable Helm, Checkout, Downloard pakaged Chart * Add Chechout step * Add Helm * All do in 1 job * Adjust task order in the job * Replace chart-releaser by specifics steps. * uncomment the right step for snapshot version name * remove tag creation * add login for fetch gh-pages * Clean before MR * add merge with helm before cr index * update url in index.yaml * update index with cr_releaser 1.7.0 * Fix for "chart-cr" action bug https://github.com/helm/chart-releaser-action/issues/171#issuecomment-2372464055 * same error * Put latest tag at the right step * again : latest_tag * Latest tag * Latest * Latest tag from $tag * Latest * export latest * CR and GH * Prepare git for chart-releaser * Latest * CR update * do it by cr * Fix version in chart. * Update CR rags + upload release * remove upload in case : immutable release * Cr args : owner and repo * Remove unused instructions * Add git login * remove OCI in dependancies list * Remove Hardcode * lower ? * name use for tag and for CR * Name * Name * Name * Name * Name * Name * looking for folder structure load for gh-pages branch * Name * Name . * Ref the commit that run the workflow * Add changelog.md as ref to release --------- Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Lajus Co-authored-by: Cédric Lajus <74196307+Superfluxx@users.noreply.github.com> * trivy (#16) * Added support fir build-args for container-ci workflow * Added default build-args logic, and renamed the build-args input parameter ti extra-build-args * Added custom user-defined tags support * Added support for ignoring hadolint rules * Added missing git metadata step * Modified author injection for commit vars * Added debug step for commit author * Added missing git fetch info * Updated git tech depth * Updated fetch depth * Fixed steps order in docker image build step * Fixed formatting issues with args * Refactored arg parse for docker build * Rationalized build args steps * Added missing checkout step * Trimmed arg-json command * Updated args json for build-args phase * Updated build-args logic * Updated build-args logic * Updated and refactored : - Added support for Dockles Ignore - Added support for Trivy Ignores - Optimized workflow by removing duplicated steps qs much as possible whilst keeping parallelization - Renamed a few steps for clarity * Updated defaults for a few params * Fixed weog version definition and updated parameters * Refactored an bu,ped hadolint action version * Added skip trivy init where it as needed * Fixed wrong dockle parameter for scan * Updated README * Made artifacts refere,ce unique * Updated docs * Cheese dockle by running it from binary * Clean dockle step and add argument handleling * Fix tentative when building chart depedencies -> ignoring oci repositories * Added fix at frst step too * Added back missing chart dir as param * Doc update : calling workflows * Change release suffix condition for dev branch * Change condition for running chart-releaser on branches * Add release steps for feature branch in CI workflow * add skip * Comment on repository OCI definition * fix CI * Clarify release types and update workflow references Updated README to clarify release management and workflow usage. * update rules * Fix config on CI Linter * fix Yaml Linter error * Fix Linter Errors * Fix : Error: ub/workflows/ci.yml:11:16: [error] too many spaces inside brackets (brackets) Error: ub/workflows/ci.yml:11:24: [error] too few spaces after comma (commas) Error: ub/workflows/ci.yml:11:29: [error] too many spaces inside brackets (brackets) * add exclusion OCI helm repository * refactoring + set path * rebuild DEV / SNAPSHOT every time called * fix chart release that not update index.yaml * fix yaml lint errors * refactor * update version of tools used by the workflow * add checkout * set the version of helm (same in all steps) * Log more info for the name of the version * Update config for chart-Releaser * skip upload if it is already made * remove download * try without upload / download at each job the chart * Need source for Polaris Scan * Delete release before create it again * skip if existe * from main * new line at end of file * test option with index * add feature branch in release process * Choose the right package-path * fix linter error : Error: ub/workflows/chart-ci.yml:361:1: [error] too many blank lines (1 > 0) (empty-lines) * remove CR releaser * downgrade chart-releaser plugin * remove download chart * [Temporary] Disable Helm, Checkout, Downloard pakaged Chart * Add Chechout step * Add Helm * All do in 1 job * Adjust task order in the job * Replace chart-releaser by specifics steps. * uncomment the right step for snapshot version name * remove tag creation * add login for fetch gh-pages * Clean before MR * add merge with helm before cr index * update url in index.yaml * update index with cr_releaser 1.7.0 * Fix for "chart-cr" action bug https://github.com/helm/chart-releaser-action/issues/171#issuecomment-2372464055 * same error * Put latest tag at the right step * again : latest_tag * Latest tag * Latest * Latest tag from $tag * Latest * export latest * CR and GH * Prepare git for chart-releaser * Latest * CR update * do it by cr * Fix version in chart. * Update CR rags + upload release * remove upload in case : immutable release * Cr args : owner and repo * Remove unused instructions * Add git login * remove OCI in dependancies list * Remove Hardcode * lower ? * name use for tag and for CR * Name * Name * Name * Name * Name * Name * looking for folder structure load for gh-pages branch * Name * Name . * Ref the commit that run the workflow * Add changelog.md as ref to release * Update trivy action to 0.35.0 (#15) --------- Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Lajus Co-authored-by: Cédric Lajus <74196307+Superfluxx@users.noreply.github.com> * Update CI workflow with update (#17) * Added support fir build-args for container-ci workflow * Added default build-args logic, and renamed the build-args input parameter ti extra-build-args * Added custom user-defined tags support * Added support for ignoring hadolint rules * Added missing git metadata step * Modified author injection for commit vars * Added debug step for commit author * Added missing git fetch info * Updated git tech depth * Updated fetch depth * Fixed steps order in docker image build step * Fixed formatting issues with args * Refactored arg parse for docker build * Rationalized build args steps * Added missing checkout step * Trimmed arg-json command * Updated args json for build-args phase * Updated build-args logic * Updated build-args logic * Updated and refactored : - Added support for Dockles Ignore - Added support for Trivy Ignores - Optimized workflow by removing duplicated steps qs much as possible whilst keeping parallelization - Renamed a few steps for clarity * Updated defaults for a few params * Fixed weog version definition and updated parameters * Refactored an bu,ped hadolint action version * Added skip trivy init where it as needed * Fixed wrong dockle parameter for scan * Updated README * Made artifacts refere,ce unique * Updated docs * Cheese dockle by running it from binary * Clean dockle step and add argument handleling * Fix tentative when building chart depedencies -> ignoring oci repositories * Added fix at frst step too * Added back missing chart dir as param * Doc update : calling workflows * Change release suffix condition for dev branch * Change condition for running chart-releaser on branches * Add release steps for feature branch in CI workflow * add skip * Comment on repository OCI definition * fix CI * Clarify release types and update workflow references Updated README to clarify release management and workflow usage. * update rules * Fix config on CI Linter * fix Yaml Linter error * Fix Linter Errors * Fix : Error: ub/workflows/ci.yml:11:16: [error] too many spaces inside brackets (brackets) Error: ub/workflows/ci.yml:11:24: [error] too few spaces after comma (commas) Error: ub/workflows/ci.yml:11:29: [error] too many spaces inside brackets (brackets) * add exclusion OCI helm repository * refactoring + set path * rebuild DEV / SNAPSHOT every time called * fix chart release that not update index.yaml * fix yaml lint errors * refactor * update version of tools used by the workflow * add checkout * set the version of helm (same in all steps) * Log more info for the name of the version * Update config for chart-Releaser * skip upload if it is already made * remove download * try without upload / download at each job the chart * Need source for Polaris Scan * Delete release before create it again * skip if existe * from main * new line at end of file * test option with index * add feature branch in release process * Choose the right package-path * fix linter error : Error: ub/workflows/chart-ci.yml:361:1: [error] too many blank lines (1 > 0) (empty-lines) * remove CR releaser * downgrade chart-releaser plugin * remove download chart * [Temporary] Disable Helm, Checkout, Downloard pakaged Chart * Add Chechout step * Add Helm * All do in 1 job * Adjust task order in the job * Replace chart-releaser by specifics steps. * uncomment the right step for snapshot version name * remove tag creation * add login for fetch gh-pages * Clean before MR * add merge with helm before cr index * update url in index.yaml * update index with cr_releaser 1.7.0 * Fix for "chart-cr" action bug https://github.com/helm/chart-releaser-action/issues/171#issuecomment-2372464055 * same error * Put latest tag at the right step * again : latest_tag * Latest tag * Latest * Latest tag from $tag * Latest * export latest * CR and GH * Prepare git for chart-releaser * Latest * CR update * do it by cr * Fix version in chart. * Update CR rags + upload release * remove upload in case : immutable release * Cr args : owner and repo * Remove unused instructions * Add git login * remove OCI in dependancies list * Remove Hardcode * lower ? * name use for tag and for CR * Name * Name * Name * Name * Name * Name * looking for folder structure load for gh-pages branch * Name * Name . * Ref the commit that run the workflow * Add changelog.md as ref to release * Update trivy action to 0.35.0 (#15) --------- Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Lajus Co-authored-by: Cédric Lajus <74196307+Superfluxx@users.noreply.github.com> * Update container-ci.yml * Update chart-ci.yml * Update container-ci.yml * Update chart-ci.yml --------- Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Lajus Co-authored-by: Cédric Lajus <74196307+Superfluxx@users.noreply.github.com> * Update versions (#21) * Mise à jour des versions * fix --------- Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Nicolas-Delahaye * Update how to get polaris from github --------- Co-authored-by: Cédric Lajus <74196307+Superfluxx@users.noreply.github.com> Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Kévin ZGRZENDEK --------- Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Lajus Co-authored-by: Cédric Lajus <74196307+Superfluxx@users.noreply.github.com> --- .github/workflows/chart-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/chart-ci.yml b/.github/workflows/chart-ci.yml index ac760b2..9492d45 100644 --- a/.github/workflows/chart-ci.yml +++ b/.github/workflows/chart-ci.yml @@ -150,7 +150,7 @@ jobs: run: | mkdir -p .local/bin curl -s https://api.github.com/repos/FairwindsOps/polaris/releases/latest | \ - jq '.assets[] | select(.name=="polaris_linux_amd64.tar.gz")'.browser_download_url | \ + jq '.assets[] | select(.name | endswith("linux_amd64.tar.gz"))'.browser_download_url | \ xargs curl -s -L | \ tar xvz -C .local/bin polaris echo "$PWD/.local/bin" >> $GITHUB_PATH From 66785783755845321f4842334a806f8ce89e6ffd Mon Sep 17 00:00:00 2001 From: Nicolas-Delahaye Date: Fri, 5 Jun 2026 09:23:55 +0200 Subject: [PATCH 03/20] Fix Sarif bug MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Added support fir build-args for container-ci workflow * Added default build-args logic, and renamed the build-args input parameter ti extra-build-args * Added custom user-defined tags support * Added support for ignoring hadolint rules * Added missing git metadata step * Modified author injection for commit vars * Added debug step for commit author * Added missing git fetch info * Updated git tech depth * Updated fetch depth * Fixed steps order in docker image build step * Fixed formatting issues with args * Refactored arg parse for docker build * Rationalized build args steps * Added missing checkout step * Trimmed arg-json command * Updated args json for build-args phase * Updated build-args logic * Updated build-args logic * Updated and refactored : - Added support for Dockles Ignore - Added support for Trivy Ignores - Optimized workflow by removing duplicated steps qs much as possible whilst keeping parallelization - Renamed a few steps for clarity * Updated defaults for a few params * Fixed weog version definition and updated parameters * Refactored an bu,ped hadolint action version * Added skip trivy init where it as needed * Fixed wrong dockle parameter for scan * Updated README * Made artifacts refere,ce unique * Updated docs * Cheese dockle by running it from binary * Clean dockle step and add argument handleling * Fix tentative when building chart depedencies -> ignoring oci repositories * Added fix at frst step too * Added back missing chart dir as param * Doc update : calling workflows * Change release suffix condition for dev branch * Change condition for running chart-releaser on branches * Add release steps for feature branch in CI workflow * add skip * Comment on repository OCI definition * fix CI * Clarify release types and update workflow references Updated README to clarify release management and workflow usage. * update rules * Fix config on CI Linter * fix Yaml Linter error * Fix Linter Errors * Fix : Error: ub/workflows/ci.yml:11:16: [error] too many spaces inside brackets (brackets) Error: ub/workflows/ci.yml:11:24: [error] too few spaces after comma (commas) Error: ub/workflows/ci.yml:11:29: [error] too many spaces inside brackets (brackets) * add exclusion OCI helm repository * refactoring + set path * rebuild DEV / SNAPSHOT every time called * fix chart release that not update index.yaml * fix yaml lint errors * refactor * update version of tools used by the workflow * add checkout * set the version of helm (same in all steps) * Log more info for the name of the version * Update config for chart-Releaser * skip upload if it is already made * remove download * try without upload / download at each job the chart * Need source for Polaris Scan * Delete release before create it again * skip if existe * from main * new line at end of file * test option with index * add feature branch in release process * Choose the right package-path * fix linter error : Error: ub/workflows/chart-ci.yml:361:1: [error] too many blank lines (1 > 0) (empty-lines) * remove CR releaser * downgrade chart-releaser plugin * remove download chart * [Temporary] Disable Helm, Checkout, Downloard pakaged Chart * Add Chechout step * Add Helm * All do in 1 job * Adjust task order in the job * Replace chart-releaser by specifics steps. * uncomment the right step for snapshot version name * remove tag creation * add login for fetch gh-pages * Clean before MR * add merge with helm before cr index * update url in index.yaml * update index with cr_releaser 1.7.0 * Fix for "chart-cr" action bug https://github.com/helm/chart-releaser-action/issues/171#issuecomment-2372464055 * same error * Put latest tag at the right step * again : latest_tag * Latest tag * Latest * Latest tag from $tag * Latest * export latest * CR and GH * Prepare git for chart-releaser * Latest * CR update * do it by cr * Fix version in chart. * Update CR rags + upload release * remove upload in case : immutable release * Cr args : owner and repo * Remove unused instructions * Add git login * remove OCI in dependancies list * Remove Hardcode * lower ? * name use for tag and for CR * Name * Name * Name * Name * Name * Name * looking for folder structure load for gh-pages branch * Name * Name . * Ref the commit that run the workflow * Add changelog.md as ref to release * Update trivy action to 0.35.0 (#15) * Update trivy (#19) * Fix release on Immutable TAG / RELEASE - Yaml Linter (#12) * Added support fir build-args for container-ci workflow * Added default build-args logic, and renamed the build-args input parameter ti extra-build-args * Added custom user-defined tags support * Added support for ignoring hadolint rules * Added missing git metadata step * Modified author injection for commit vars * Added debug step for commit author * Added missing git fetch info * Updated git tech depth * Updated fetch depth * Fixed steps order in docker image build step * Fixed formatting issues with args * Refactored arg parse for docker build * Rationalized build args steps * Added missing checkout step * Trimmed arg-json command * Updated args json for build-args phase * Updated build-args logic * Updated build-args logic * Updated and refactored : - Added support for Dockles Ignore - Added support for Trivy Ignores - Optimized workflow by removing duplicated steps qs much as possible whilst keeping parallelization - Renamed a few steps for clarity * Updated defaults for a few params * Fixed weog version definition and updated parameters * Refactored an bu,ped hadolint action version * Added skip trivy init where it as needed * Fixed wrong dockle parameter for scan * Updated README * Made artifacts refere,ce unique * Updated docs * Cheese dockle by running it from binary * Clean dockle step and add argument handleling * Fix tentative when building chart depedencies -> ignoring oci repositories * Added fix at frst step too * Added back missing chart dir as param * Doc update : calling workflows * Change release suffix condition for dev branch * Change condition for running chart-releaser on branches * Add release steps for feature branch in CI workflow * add skip * Comment on repository OCI definition * fix CI * Clarify release types and update workflow references Updated README to clarify release management and workflow usage. * update rules * Fix config on CI Linter * fix Yaml Linter error * Fix Linter Errors * Fix : Error: ub/workflows/ci.yml:11:16: [error] too many spaces inside brackets (brackets) Error: ub/workflows/ci.yml:11:24: [error] too few spaces after comma (commas) Error: ub/workflows/ci.yml:11:29: [error] too many spaces inside brackets (brackets) * add exclusion OCI helm repository * refactoring + set path * rebuild DEV / SNAPSHOT every time called * fix chart release that not update index.yaml * fix yaml lint errors * refactor * update version of tools used by the workflow * add checkout * set the version of helm (same in all steps) * Log more info for the name of the version * Update config for chart-Releaser * skip upload if it is already made * remove download * try without upload / download at each job the chart * Need source for Polaris Scan * Delete release before create it again * skip if existe * from main * new line at end of file * test option with index * add feature branch in release process * Choose the right package-path * fix linter error : Error: ub/workflows/chart-ci.yml:361:1: [error] too many blank lines (1 > 0) (empty-lines) * remove CR releaser * downgrade chart-releaser plugin * remove download chart * [Temporary] Disable Helm, Checkout, Downloard pakaged Chart * Add Chechout step * Add Helm * All do in 1 job * Adjust task order in the job * Replace chart-releaser by specifics steps. * uncomment the right step for snapshot version name * remove tag creation * add login for fetch gh-pages * Clean before MR * add merge with helm before cr index * update url in index.yaml * update index with cr_releaser 1.7.0 * Fix for "chart-cr" action bug https://github.com/helm/chart-releaser-action/issues/171#issuecomment-2372464055 * same error * Put latest tag at the right step * again : latest_tag * Latest tag * Latest * Latest tag from $tag * Latest * export latest * CR and GH * Prepare git for chart-releaser * Latest * CR update * do it by cr * Fix version in chart. * Update CR rags + upload release * remove upload in case : immutable release * Cr args : owner and repo * Remove unused instructions * Add git login * remove OCI in dependancies list * Remove Hardcode * lower ? * name use for tag and for CR * Name * Name * Name * Name * Name * Name * looking for folder structure load for gh-pages branch * Name * Name . * Ref the commit that run the workflow * Add changelog.md as ref to release --------- Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Lajus Co-authored-by: Cédric Lajus <74196307+Superfluxx@users.noreply.github.com> * trivy (#16) * Added support fir build-args for container-ci workflow * Added default build-args logic, and renamed the build-args input parameter ti extra-build-args * Added custom user-defined tags support * Added support for ignoring hadolint rules * Added missing git metadata step * Modified author injection for commit vars * Added debug step for commit author * Added missing git fetch info * Updated git tech depth * Updated fetch depth * Fixed steps order in docker image build step * Fixed formatting issues with args * Refactored arg parse for docker build * Rationalized build args steps * Added missing checkout step * Trimmed arg-json command * Updated args json for build-args phase * Updated build-args logic * Updated build-args logic * Updated and refactored : - Added support for Dockles Ignore - Added support for Trivy Ignores - Optimized workflow by removing duplicated steps qs much as possible whilst keeping parallelization - Renamed a few steps for clarity * Updated defaults for a few params * Fixed weog version definition and updated parameters * Refactored an bu,ped hadolint action version * Added skip trivy init where it as needed * Fixed wrong dockle parameter for scan * Updated README * Made artifacts refere,ce unique * Updated docs * Cheese dockle by running it from binary * Clean dockle step and add argument handleling * Fix tentative when building chart depedencies -> ignoring oci repositories * Added fix at frst step too * Added back missing chart dir as param * Doc update : calling workflows * Change release suffix condition for dev branch * Change condition for running chart-releaser on branches * Add release steps for feature branch in CI workflow * add skip * Comment on repository OCI definition * fix CI * Clarify release types and update workflow references Updated README to clarify release management and workflow usage. * update rules * Fix config on CI Linter * fix Yaml Linter error * Fix Linter Errors * Fix : Error: ub/workflows/ci.yml:11:16: [error] too many spaces inside brackets (brackets) Error: ub/workflows/ci.yml:11:24: [error] too few spaces after comma (commas) Error: ub/workflows/ci.yml:11:29: [error] too many spaces inside brackets (brackets) * add exclusion OCI helm repository * refactoring + set path * rebuild DEV / SNAPSHOT every time called * fix chart release that not update index.yaml * fix yaml lint errors * refactor * update version of tools used by the workflow * add checkout * set the version of helm (same in all steps) * Log more info for the name of the version * Update config for chart-Releaser * skip upload if it is already made * remove download * try without upload / download at each job the chart * Need source for Polaris Scan * Delete release before create it again * skip if existe * from main * new line at end of file * test option with index * add feature branch in release process * Choose the right package-path * fix linter error : Error: ub/workflows/chart-ci.yml:361:1: [error] too many blank lines (1 > 0) (empty-lines) * remove CR releaser * downgrade chart-releaser plugin * remove download chart * [Temporary] Disable Helm, Checkout, Downloard pakaged Chart * Add Chechout step * Add Helm * All do in 1 job * Adjust task order in the job * Replace chart-releaser by specifics steps. * uncomment the right step for snapshot version name * remove tag creation * add login for fetch gh-pages * Clean before MR * add merge with helm before cr index * update url in index.yaml * update index with cr_releaser 1.7.0 * Fix for "chart-cr" action bug https://github.com/helm/chart-releaser-action/issues/171#issuecomment-2372464055 * same error * Put latest tag at the right step * again : latest_tag * Latest tag * Latest * Latest tag from $tag * Latest * export latest * CR and GH * Prepare git for chart-releaser * Latest * CR update * do it by cr * Fix version in chart. * Update CR rags + upload release * remove upload in case : immutable release * Cr args : owner and repo * Remove unused instructions * Add git login * remove OCI in dependancies list * Remove Hardcode * lower ? * name use for tag and for CR * Name * Name * Name * Name * Name * Name * looking for folder structure load for gh-pages branch * Name * Name . * Ref the commit that run the workflow * Add changelog.md as ref to release * Update trivy action to 0.35.0 (#15) --------- Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Lajus Co-authored-by: Cédric Lajus <74196307+Superfluxx@users.noreply.github.com> * Update CI workflow with update (#17) * Added support fir build-args for container-ci workflow * Added default build-args logic, and renamed the build-args input parameter ti extra-build-args * Added custom user-defined tags support * Added support for ignoring hadolint rules * Added missing git metadata step * Modified author injection for commit vars * Added debug step for commit author * Added missing git fetch info * Updated git tech depth * Updated fetch depth * Fixed steps order in docker image build step * Fixed formatting issues with args * Refactored arg parse for docker build * Rationalized build args steps * Added missing checkout step * Trimmed arg-json command * Updated args json for build-args phase * Updated build-args logic * Updated build-args logic * Updated and refactored : - Added support for Dockles Ignore - Added support for Trivy Ignores - Optimized workflow by removing duplicated steps qs much as possible whilst keeping parallelization - Renamed a few steps for clarity * Updated defaults for a few params * Fixed weog version definition and updated parameters * Refactored an bu,ped hadolint action version * Added skip trivy init where it as needed * Fixed wrong dockle parameter for scan * Updated README * Made artifacts refere,ce unique * Updated docs * Cheese dockle by running it from binary * Clean dockle step and add argument handleling * Fix tentative when building chart depedencies -> ignoring oci repositories * Added fix at frst step too * Added back missing chart dir as param * Doc update : calling workflows * Change release suffix condition for dev branch * Change condition for running chart-releaser on branches * Add release steps for feature branch in CI workflow * add skip * Comment on repository OCI definition * fix CI * Clarify release types and update workflow references Updated README to clarify release management and workflow usage. * update rules * Fix config on CI Linter * fix Yaml Linter error * Fix Linter Errors * Fix : Error: ub/workflows/ci.yml:11:16: [error] too many spaces inside brackets (brackets) Error: ub/workflows/ci.yml:11:24: [error] too few spaces after comma (commas) Error: ub/workflows/ci.yml:11:29: [error] too many spaces inside brackets (brackets) * add exclusion OCI helm repository * refactoring + set path * rebuild DEV / SNAPSHOT every time called * fix chart release that not update index.yaml * fix yaml lint errors * refactor * update version of tools used by the workflow * add checkout * set the version of helm (same in all steps) * Log more info for the name of the version * Update config for chart-Releaser * skip upload if it is already made * remove download * try without upload / download at each job the chart * Need source for Polaris Scan * Delete release before create it again * skip if existe * from main * new line at end of file * test option with index * add feature branch in release process * Choose the right package-path * fix linter error : Error: ub/workflows/chart-ci.yml:361:1: [error] too many blank lines (1 > 0) (empty-lines) * remove CR releaser * downgrade chart-releaser plugin * remove download chart * [Temporary] Disable Helm, Checkout, Downloard pakaged Chart * Add Chechout step * Add Helm * All do in 1 job * Adjust task order in the job * Replace chart-releaser by specifics steps. * uncomment the right step for snapshot version name * remove tag creation * add login for fetch gh-pages * Clean before MR * add merge with helm before cr index * update url in index.yaml * update index with cr_releaser 1.7.0 * Fix for "chart-cr" action bug https://github.com/helm/chart-releaser-action/issues/171#issuecomment-2372464055 * same error * Put latest tag at the right step * again : latest_tag * Latest tag * Latest * Latest tag from $tag * Latest * export latest * CR and GH * Prepare git for chart-releaser * Latest * CR update * do it by cr * Fix version in chart. * Update CR rags + upload release * remove upload in case : immutable release * Cr args : owner and repo * Remove unused instructions * Add git login * remove OCI in dependancies list * Remove Hardcode * lower ? * name use for tag and for CR * Name * Name * Name * Name * Name * Name * looking for folder structure load for gh-pages branch * Name * Name . * Ref the commit that run the workflow * Add changelog.md as ref to release * Update trivy action to 0.35.0 (#15) --------- Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Lajus Co-authored-by: Cédric Lajus <74196307+Superfluxx@users.noreply.github.com> * Update container-ci.yml * Update chart-ci.yml * Update container-ci.yml * Update chart-ci.yml --------- Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Lajus Co-authored-by: Cédric Lajus <74196307+Superfluxx@users.noreply.github.com> * Update versions (#21) * Mise à jour des versions * fix * Polaris update (#23) * Update pipeline (#22) * Added support fir build-args for container-ci workflow * Added default build-args logic, and renamed the build-args input parameter ti extra-build-args * Added custom user-defined tags support * Added support for ignoring hadolint rules * Added missing git metadata step * Modified author injection for commit vars * Added debug step for commit author * Added missing git fetch info * Updated git tech depth * Updated fetch depth * Fixed steps order in docker image build step * Fixed formatting issues with args * Refactored arg parse for docker build * Rationalized build args steps * Added missing checkout step * Trimmed arg-json command * Updated args json for build-args phase * Updated build-args logic * Updated build-args logic * Updated and refactored : - Added support for Dockles Ignore - Added support for Trivy Ignores - Optimized workflow by removing duplicated steps qs much as possible whilst keeping parallelization - Renamed a few steps for clarity * Updated defaults for a few params * Fixed weog version definition and updated parameters * Refactored an bu,ped hadolint action version * Added skip trivy init where it as needed * Fixed wrong dockle parameter for scan * Updated README * Made artifacts refere,ce unique * Updated docs * Cheese dockle by running it from binary * Clean dockle step and add argument handleling * Fix tentative when building chart depedencies -> ignoring oci repositories * Added fix at frst step too * Added back missing chart dir as param * Doc update : calling workflows * Change release suffix condition for dev branch * Change condition for running chart-releaser on branches * Add release steps for feature branch in CI workflow * add skip * Comment on repository OCI definition * fix CI * Clarify release types and update workflow references Updated README to clarify release management and workflow usage. * update rules * Fix config on CI Linter * fix Yaml Linter error * Fix Linter Errors * Fix : Error: ub/workflows/ci.yml:11:16: [error] too many spaces inside brackets (brackets) Error: ub/workflows/ci.yml:11:24: [error] too few spaces after comma (commas) Error: ub/workflows/ci.yml:11:29: [error] too many spaces inside brackets (brackets) * add exclusion OCI helm repository * refactoring + set path * rebuild DEV / SNAPSHOT every time called * fix chart release that not update index.yaml * fix yaml lint errors * refactor * update version of tools used by the workflow * add checkout * set the version of helm (same in all steps) * Log more info for the name of the version * Update config for chart-Releaser * skip upload if it is already made * remove download * try without upload / download at each job the chart * Need source for Polaris Scan * Delete release before create it again * skip if existe * from main * new line at end of file * test option with index * add feature branch in release process * Choose the right package-path * fix linter error : Error: ub/workflows/chart-ci.yml:361:1: [error] too many blank lines (1 > 0) (empty-lines) * remove CR releaser * downgrade chart-releaser plugin * remove download chart * [Temporary] Disable Helm, Checkout, Downloard pakaged Chart * Add Chechout step * Add Helm * All do in 1 job * Adjust task order in the job * Replace chart-releaser by specifics steps. * uncomment the right step for snapshot version name * remove tag creation * add login for fetch gh-pages * Clean before MR * add merge with helm before cr index * update url in index.yaml * update index with cr_releaser 1.7.0 * Fix for "chart-cr" action bug https://github.com/helm/chart-releaser-action/issues/171#issuecomment-2372464055 * same error * Put latest tag at the right step * again : latest_tag * Latest tag * Latest * Latest tag from $tag * Latest * export latest * CR and GH * Prepare git for chart-releaser * Latest * CR update * do it by cr * Fix version in chart. * Update CR rags + upload release * remove upload in case : immutable release * Cr args : owner and repo * Remove unused instructions * Add git login * remove OCI in dependancies list * Remove Hardcode * lower ? * name use for tag and for CR * Name * Name * Name * Name * Name * Name * looking for folder structure load for gh-pages branch * Name * Name . * Ref the commit that run the workflow * Add changelog.md as ref to release * Update trivy action to 0.35.0 (#15) * Update trivy (#19) * Fix release on Immutable TAG / RELEASE - Yaml Linter (#12) * Added support fir build-args for container-ci workflow * Added default build-args logic, and renamed the build-args input parameter ti extra-build-args * Added custom user-defined tags support * Added support for ignoring hadolint rules * Added missing git metadata step * Modified author injection for commit vars * Added debug step for commit author * Added missing git fetch info * Updated git tech depth * Updated fetch depth * Fixed steps order in docker image build step * Fixed formatting issues with args * Refactored arg parse for docker build * Rationalized build args steps * Added missing checkout step * Trimmed arg-json command * Updated args json for build-args phase * Updated build-args logic * Updated build-args logic * Updated and refactored : - Added support for Dockles Ignore - Added support for Trivy Ignores - Optimized workflow by removing duplicated steps qs much as possible whilst keeping parallelization - Renamed a few steps for clarity * Updated defaults for a few params * Fixed weog version definition and updated parameters * Refactored an bu,ped hadolint action version * Added skip trivy init where it as needed * Fixed wrong dockle parameter for scan * Updated README * Made artifacts refere,ce unique * Updated docs * Cheese dockle by running it from binary * Clean dockle step and add argument handleling * Fix tentative when building chart depedencies -> ignoring oci repositories * Added fix at frst step too * Added back missing chart dir as param * Doc update : calling workflows * Change release suffix condition for dev branch * Change condition for running chart-releaser on branches * Add release steps for feature branch in CI workflow * add skip * Comment on repository OCI definition * fix CI * Clarify release types and update workflow references Updated README to clarify release management and workflow usage. * update rules * Fix config on CI Linter * fix Yaml Linter error * Fix Linter Errors * Fix : Error: ub/workflows/ci.yml:11:16: [error] too many spaces inside brackets (brackets) Error: ub/workflows/ci.yml:11:24: [error] too few spaces after comma (commas) Error: ub/workflows/ci.yml:11:29: [error] too many spaces inside brackets (brackets) * add exclusion OCI helm repository * refactoring + set path * rebuild DEV / SNAPSHOT every time called * fix chart release that not update index.yaml * fix yaml lint errors * refactor * update version of tools used by the workflow * add checkout * set the version of helm (same in all steps) * Log more info for the name of the version * Update config for chart-Releaser * skip upload if it is already made * remove download * try without upload / download at each job the chart * Need source for Polaris Scan * Delete release before create it again * skip if existe * from main * new line at end of file * test option with index * add feature branch in release process * Choose the right package-path * fix linter error : Error: ub/workflows/chart-ci.yml:361:1: [error] too many blank lines (1 > 0) (empty-lines) * remove CR releaser * downgrade chart-releaser plugin * remove download chart * [Temporary] Disable Helm, Checkout, Downloard pakaged Chart * Add Chechout step * Add Helm * All do in 1 job * Adjust task order in the job * Replace chart-releaser by specifics steps. * uncomment the right step for snapshot version name * remove tag creation * add login for fetch gh-pages * Clean before MR * add merge with helm before cr index * update url in index.yaml * update index with cr_releaser 1.7.0 * Fix for "chart-cr" action bug https://github.com/helm/chart-releaser-action/issues/171#issuecomment-2372464055 * same error * Put latest tag at the right step * again : latest_tag * Latest tag * Latest * Latest tag from $tag * Latest * export latest * CR and GH * Prepare git for chart-releaser * Latest * CR update * do it by cr * Fix version in chart. * Update CR rags + upload release * remove upload in case : immutable release * Cr args : owner and repo * Remove unused instructions * Add git login * remove OCI in dependancies list * Remove Hardcode * lower ? * name use for tag and for CR * Name * Name * Name * Name * Name * Name * looking for folder structure load for gh-pages branch * Name * Name . * Ref the commit that run the workflow * Add changelog.md as ref to release --------- Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Lajus Co-authored-by: Cédric Lajus <74196307+Superfluxx@users.noreply.github.com> * trivy (#16) * Added support fir build-args for container-ci workflow * Added default build-args logic, and renamed the build-args input parameter ti extra-build-args * Added custom user-defined tags support * Added support for ignoring hadolint rules * Added missing git metadata step * Modified author injection for commit vars * Added debug step for commit author * Added missing git fetch info * Updated git tech depth * Updated fetch depth * Fixed steps order in docker image build step * Fixed formatting issues with args * Refactored arg parse for docker build * Rationalized build args steps * Added missing checkout step * Trimmed arg-json command * Updated args json for build-args phase * Updated build-args logic * Updated build-args logic * Updated and refactored : - Added support for Dockles Ignore - Added support for Trivy Ignores - Optimized workflow by removing duplicated steps qs much as possible whilst keeping parallelization - Renamed a few steps for clarity * Updated defaults for a few params * Fixed weog version definition and updated parameters * Refactored an bu,ped hadolint action version * Added skip trivy init where it as needed * Fixed wrong dockle parameter for scan * Updated README * Made artifacts refere,ce unique * Updated docs * Cheese dockle by running it from binary * Clean dockle step and add argument handleling * Fix tentative when building chart depedencies -> ignoring oci repositories * Added fix at frst step too * Added back missing chart dir as param * Doc update : calling workflows * Change release suffix condition for dev branch * Change condition for running chart-releaser on branches * Add release steps for feature branch in CI workflow * add skip * Comment on repository OCI definition * fix CI * Clarify release types and update workflow references Updated README to clarify release management and workflow usage. * update rules * Fix config on CI Linter * fix Yaml Linter error * Fix Linter Errors * Fix : Error: ub/workflows/ci.yml:11:16: [error] too many spaces inside brackets (brackets) Error: ub/workflows/ci.yml:11:24: [error] too few spaces after comma (commas) Error: ub/workflows/ci.yml:11:29: [error] too many spaces inside brackets (brackets) * add exclusion OCI helm repository * refactoring + set path * rebuild DEV / SNAPSHOT every time called * fix chart release that not update index.yaml * fix yaml lint errors * refactor * update version of tools used by the workflow * add checkout * set the version of helm (same in all steps) * Log more info for the name of the version * Update config for chart-Releaser * skip upload if it is already made * remove download * try without upload / download at each job the chart * Need source for Polaris Scan * Delete release before create it again * skip if existe * from main * new line at end of file * test option with index * add feature branch in release process * Choose the right package-path * fix linter error : Error: ub/workflows/chart-ci.yml:361:1: [error] too many blank lines (1 > 0) (empty-lines) * remove CR releaser * downgrade chart-releaser plugin * remove download chart * [Temporary] Disable Helm, Checkout, Downloard pakaged Chart * Add Chechout step * Add Helm * All do in 1 job * Adjust task order in the job * Replace chart-releaser by specifics steps. * uncomment the right step for snapshot version name * remove tag creation * add login for fetch gh-pages * Clean before MR * add merge with helm before cr index * update url in index.yaml * update index with cr_releaser 1.7.0 * Fix for "chart-cr" action bug https://github.com/helm/chart-releaser-action/issues/171#issuecomment-2372464055 * same error * Put latest tag at the right step * again : latest_tag * Latest tag * Latest * Latest tag from $tag * Latest * export latest * CR and GH * Prepare git for chart-releaser * Latest * CR update * do it by cr * Fix version in chart. * Update CR rags + upload release * remove upload in case : immutable release * Cr args : owner and repo * Remove unused instructions * Add git login * remove OCI in dependancies list * Remove Hardcode * lower ? * name use for tag and for CR * Name * Name * Name * Name * Name * Name * looking for folder structure load for gh-pages branch * Name * Name . * Ref the commit that run the workflow * Add changelog.md as ref to release * Update trivy action to 0.35.0 (#15) --------- Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Lajus Co-authored-by: Cédric Lajus <74196307+Superfluxx@users.noreply.github.com> * Update CI workflow with update (#17) * Added support fir build-args for container-ci workflow * Added default build-args logic, and renamed the build-args input parameter ti extra-build-args * Added custom user-defined tags support * Added support for ignoring hadolint rules * Added missing git metadata step * Modified author injection for commit vars * Added debug step for commit author * Added missing git fetch info * Updated git tech depth * Updated fetch depth * Fixed steps order in docker image build step * Fixed formatting issues with args * Refactored arg parse for docker build * Rationalized build args steps * Added missing checkout step * Trimmed arg-json command * Updated args json for build-args phase * Updated build-args logic * Updated build-args logic * Updated and refactored : - Added support for Dockles Ignore - Added support for Trivy Ignores - Optimized workflow by removing duplicated steps qs much as possible whilst keeping parallelization - Renamed a few steps for clarity * Updated defaults for a few params * Fixed weog version definition and updated parameters * Refactored an bu,ped hadolint action version * Added skip trivy init where it as needed * Fixed wrong dockle parameter for scan * Updated README * Made artifacts refere,ce unique * Updated docs * Cheese dockle by running it from binary * Clean dockle step and add argument handleling * Fix tentative when building chart depedencies -> ignoring oci repositories * Added fix at frst step too * Added back missing chart dir as param * Doc update : calling workflows * Change release suffix condition for dev branch * Change condition for running chart-releaser on branches * Add release steps for feature branch in CI workflow * add skip * Comment on repository OCI definition * fix CI * Clarify release types and update workflow references Updated README to clarify release management and workflow usage. * update rules * Fix config on CI Linter * fix Yaml Linter error * Fix Linter Errors * Fix : Error: ub/workflows/ci.yml:11:16: [error] too many spaces inside brackets (brackets) Error: ub/workflows/ci.yml:11:24: [error] too few spaces after comma (commas) Error: ub/workflows/ci.yml:11:29: [error] too many spaces inside brackets (brackets) * add exclusion OCI helm repository * refactoring + set path * rebuild DEV / SNAPSHOT every time called * fix chart release that not update index.yaml * fix yaml lint errors * refactor * update version of tools used by the workflow * add checkout * set the version of helm (same in all steps) * Log more info for the name of the version * Update config for chart-Releaser * skip upload if it is already made * remove download * try without upload / download at each job the chart * Need source for Polaris Scan * Delete release before create it again * skip if existe * from main * new line at end of file * test option with index * add feature branch in release process * Choose the right package-path * fix linter error : Error: ub/workflows/chart-ci.yml:361:1: [error] too many blank lines (1 > 0) (empty-lines) * remove CR releaser * downgrade chart-releaser plugin * remove download chart * [Temporary] Disable Helm, Checkout, Downloard pakaged Chart * Add Chechout step * Add Helm * All do in 1 job * Adjust task order in the job * Replace chart-releaser by specifics steps. * uncomment the right step for snapshot version name * remove tag creation * add login for fetch gh-pages * Clean before MR * add merge with helm before cr index * update url in index.yaml * update index with cr_releaser 1.7.0 * Fix for "chart-cr" action bug https://github.com/helm/chart-releaser-action/issues/171#issuecomment-2372464055 * same error * Put latest tag at the right step * again : latest_tag * Latest tag * Latest * Latest tag from $tag * Latest * export latest * CR and GH * Prepare git for chart-releaser * Latest * CR update * do it by cr * Fix version in chart. * Update CR rags + upload release * remove upload in case : immutable release * Cr args : owner and repo * Remove unused instructions * Add git login * remove OCI in dependancies list * Remove Hardcode * lower ? * name use for tag and for CR * Name * Name * Name * Name * Name * Name * looking for folder structure load for gh-pages branch * Name * Name . * Ref the commit that run the workflow * Add changelog.md as ref to release * Update trivy action to 0.35.0 (#15) --------- Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Lajus Co-authored-by: Cédric Lajus <74196307+Superfluxx@users.noreply.github.com> * Update container-ci.yml * Update chart-ci.yml * Update container-ci.yml * Update chart-ci.yml --------- Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Lajus Co-authored-by: Cédric Lajus <74196307+Superfluxx@users.noreply.github.com> * Update versions (#21) * Mise à jour des versions * fix --------- Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Nicolas-Delahaye * Update how to get polaris from github --------- Co-authored-by: Cédric Lajus <74196307+Superfluxx@users.noreply.github.com> Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Kévin ZGRZENDEK * Bugfix/fix sarif file bug (#25) * Update Trivy action to v0.36.0 * Add a SARIF script that fix too long id and rule Id * Fix typo * Add debug * Make inline script * Fix path * Check all sarif scripts --------- Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Kévin ZGRZENDEK Co-authored-by: Lajus Co-authored-by: Cédric Lajus <74196307+Superfluxx@users.noreply.github.com> --- .github/workflows/chart-ci.yml | 4 +-- .github/workflows/container-ci.yml | 53 +++++++++++++++++++++++++++--- 2 files changed, 50 insertions(+), 7 deletions(-) diff --git a/.github/workflows/chart-ci.yml b/.github/workflows/chart-ci.yml index 9492d45..dfe081d 100644 --- a/.github/workflows/chart-ci.yml +++ b/.github/workflows/chart-ci.yml @@ -185,7 +185,7 @@ jobs: path: ${{ inputs.chart-dir }} - name: Build Trivy Vulnerability report - uses: aquasecurity/trivy-action@v0.35.0 + uses: aquasecurity/trivy-action@v0.36.0 env: TRIVY_HELM_KUBE_VERSION: ${{ inputs.kubernetes-version }} TRIVY_HELM_SET_FILE: ${{ inputs.chart-values }} @@ -203,7 +203,7 @@ jobs: sarif_file: 'trivy-vuln-results.sarif' - name: Run Trivy Vulnerability scan - uses: aquasecurity/trivy-action@v0.35.0 + uses: aquasecurity/trivy-action@v0.36.0 env: TRIVY_HELM_KUBE_VERSION: ${{ inputs.kubernetes-version }} TRIVY_HELM_SET_FILE: ${{ inputs.chart-values }} diff --git a/.github/workflows/container-ci.yml b/.github/workflows/container-ci.yml index b73172f..ccc1662 100644 --- a/.github/workflows/container-ci.yml +++ b/.github/workflows/container-ci.yml @@ -283,7 +283,7 @@ jobs: cat "$IGNORE_FILE" - name: Generate SBOM (SPDX JSON) - uses: aquasecurity/trivy-action@v0.35.0 + uses: aquasecurity/trivy-action@v0.36.0 with: scan-type: 'image' image-ref: "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" @@ -297,7 +297,7 @@ jobs: filePath: 'image-sbom.spdx.json' - name: Build Trivy Vulnerability report - uses: aquasecurity/trivy-action@v0.35.0 + uses: aquasecurity/trivy-action@v0.36.0 with: image-ref: "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" skip-setup-trivy: true @@ -317,7 +317,7 @@ jobs: category: vulnerability - name: Build Trivy License report - uses: aquasecurity/trivy-action@v0.35.0 + uses: aquasecurity/trivy-action@v0.36.0 with: image-ref: "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" skip-setup-trivy: true @@ -330,6 +330,49 @@ jobs: limit-severities-for-sarif: 'false' output: 'trivy-license-results.sarif' + - name: Patch Trivy Vulnerability SARIF rule IDs for GitHub + run: | + python3 <<'PY' + import json + import sys + from pathlib import Path + + max_len = 200 + paths = [Path("trivy-vuln-results.sarif"), Path("trivy-license-results.sarif")] + + for path in paths : + try: + with path.open("r", encoding="utf-8") as f: + sarif = json.load(f) + except FileNotFoundError: + print(f"ERROR: SARIF file not found: {path}") + sys.exit(1) + + total_id_fixed = 0 + total_ruleId_fixed = 0 + + for run in sarif.get("runs", []): + for rule in run.get("tool", {}).get("driver", {}).get("rules", []): + if isinstance(rule.get("id"), str) and len(rule["id"]) > max_len: + rule.setdefault("properties", {})["originalTrivyRuleId"] = rule["id"] + rule["id"] = rule["id"][:max_len] + total_id_fixed += 1 + + for result in run.get("results", []): + if isinstance(result.get("ruleId"), str) and len(result["ruleId"]) > max_len: + result.setdefault("properties", {})["originalTrivyRuleId"] = result["ruleId"] + result["ruleId"] = result["ruleId"][:max_len] + total_ruleId_fixed += 1 + + with path.open("w", encoding="utf-8") as f: + json.dump(sarif, f, ensure_ascii=False, indent=2) + + print("SARIF patched") + print(f"File: {path}") + print(f"id fixed: {total_id_fixed}") + print(f"ruleId fixed: {total_ruleId_fixed}") + PY + - name: Upload Trivy License report to GitHub Security tab uses: github/codeql-action/upload-sarif@v4 with: @@ -337,7 +380,7 @@ jobs: category: license - name: Run Trivy Vulnerability scan - uses: aquasecurity/trivy-action@v0.35.0 + uses: aquasecurity/trivy-action@v0.36.0 # Overriding env vars from previous steps for them not to interfere with the scan env: TRIVY_FORMAT: 'table' @@ -354,7 +397,7 @@ jobs: trivyignores: 'ci-trivy-ignore.txt' - name: Run Trivy License scan - uses: aquasecurity/trivy-action@v0.35.0 + uses: aquasecurity/trivy-action@v0.36.0 # Overriding env vars from previous steps for them not to interfere with the scan env: TRIVY_FORMAT: 'table' From e3858ab6cd1a594d093e39bdbace13fc82602f45 Mon Sep 17 00:00:00 2001 From: 7066189 Date: Mon, 27 Jul 2026 13:56:55 +0200 Subject: [PATCH 04/20] Add Unit Test on CI Workflow --- .github/workflows/chart-ci.yml | 726 +++++++++++------------ .github/workflows/ci.yml | 106 ++-- .github/workflows/container-ci.yml | 901 +++++++++++++++-------------- CONTRIBUTING.md | 42 +- LICENSE | 404 ++++++------- README.md | 682 +++++++++++----------- test/container/Dockerfile | 5 + 7 files changed, 1453 insertions(+), 1413 deletions(-) create mode 100644 test/container/Dockerfile diff --git a/.github/workflows/chart-ci.yml b/.github/workflows/chart-ci.yml index dfe081d..e7306ac 100644 --- a/.github/workflows/chart-ci.yml +++ b/.github/workflows/chart-ci.yml @@ -1,363 +1,363 @@ -name: Chart CI - -on: - workflow_call: - inputs: - chart-dir: - description: "Directory holding your Chart" - required: true - type: string - default: "chart" - chart-values: - description: "Chart values file that will be used for the testing and scanning steps" - required: false - type: string - default: "chart/values.yaml" - kubernetes-version: - description: "Version of the target Kubernetes cluster the Chart will run on" - required: false - type: string - default: "1.24.2" - - -jobs: - helm-build-chart: - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - - - name: Install Helm - uses: azure/setup-helm@v5 - with: - version: v3.14.4 - - - name: Extract and add Helm repositories - run: | - yq eval -r ' - .dependencies[] - | select(.repository != "oci://*") - | "\(.name) \(.repository)" - ' "${{ inputs.chart-dir }}/Chart.yaml" \ - | while read -r name repo; do - helm repo add "$name" "$repo" - done - - helm repo update - - - name: Install chart dependencies - run: | - helm dependency build ${{ inputs.chart-dir }} - - - name: Generate values schema json - uses: losisin/helm-values-schema-json-action@v2.5.0 - with: - values: ${{ inputs.chart-values }} - output: ${{ inputs.chart-dir }}/values.schema.json - - - name: Helm-docs - uses: losisin/helm-docs-github-action@v1.8.0 - with: - chart-search-root: ${{ inputs.chart-dir }} - values-file: ${{ inputs.chart-values }} - output-file: ${{ inputs.chart-dir }}/README.md - template-files: ${{ inputs.chart-dir }}/README.md.gotpl - sort-values-order: file - - - name: Upload packaged Chart - uses: actions/upload-artifact@v7 - with: - name: packaged-chart - path: ${{ inputs.chart-dir }} - if-no-files-found: error - retention-days: 1 - - - helm-ct-lint: - name: Helm CT - Chart Linting - runs-on: ubuntu-latest - needs: helm-build-chart - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - - - name: Download packaged Chart - uses: actions/download-artifact@v8 - with: - name: packaged-chart - path: ${{ inputs.chart-dir }} - - - name: Set up Helm - uses: azure/setup-helm@v5 - - - name: Set up chart-testing - uses: helm/chart-testing-action@v2.8.0 - - - name: Run ct lint - run: | - ct lint \ - --target-branch ${{ github.event.repository.default_branch }} \ - --chart-dirs ${{ inputs.chart-dir }} - - - kubeconform: - name: Kubeconform - Chart Validation - needs: helm-ct-lint - runs-on: ubuntu-latest - steps: - - name: Download packaged Chart - uses: actions/download-artifact@v8 - with: - name: packaged-chart - path: ${{ inputs.chart-dir }} - - - name: Set up Helm - uses: azure/setup-helm@v5 - with: - version: v3.14.4 - - - name: Setup Helm plugins - run: | - helm plugin install https://github.com/jtyr/kubeconform-helm - - - name: Run Kubeconform check - run: | - helm kubeconform ${{ inputs.chart-dir }} \ - --values ${{ inputs.chart-values }} \ - --schema-location ${{ inputs.chart-dir }}/values.schema.json \ - --output json \ - --kubernetes-version ${{ inputs.kubernetes-version }} \ - --strict \ - --summary - - - polaris: - name: Polaris - Chart Scan - needs: helm-ct-lint - runs-on: ubuntu-latest - steps: - - name: Download packaged Chart - uses: actions/download-artifact@v8 - with: - name: packaged-chart - path: ${{ inputs.chart-dir }} - - - name: Setup Polaris - run: | - mkdir -p .local/bin - curl -s https://api.github.com/repos/FairwindsOps/polaris/releases/latest | \ - jq '.assets[] | select(.name | endswith("linux_amd64.tar.gz"))'.browser_download_url | \ - xargs curl -s -L | \ - tar xvz -C .local/bin polaris - echo "$PWD/.local/bin" >> $GITHUB_PATH - - - name: Configure Polaris - run: | - echo "checks:" > $PWD/polaris_config.yaml - echo " sensitiveContainerEnvVar: warning" >> $PWD/polaris_config.yaml - - - name: Run chart-testing (polaris) - run: | - polaris audit \ - --config=$PWD/polaris_config.yaml \ - --only-show-failed-tests \ - --set-exit-code-below-score=80 \ - --set-exit-code-on-danger=true \ - --helm-chart ${{ inputs.chart-dir }} \ - --helm-values ${{ inputs.chart-values }} \ - --format=pretty \ - --color=true - - - trivy: - name: Trivy - Chart Vulnerability Scan - needs: helm-ct-lint - runs-on: ubuntu-latest - steps: - - name: Download packaged Chart - uses: actions/download-artifact@v8 - with: - name: packaged-chart - path: ${{ inputs.chart-dir }} - - - name: Build Trivy Vulnerability report - uses: aquasecurity/trivy-action@v0.36.0 - env: - TRIVY_HELM_KUBE_VERSION: ${{ inputs.kubernetes-version }} - TRIVY_HELM_SET_FILE: ${{ inputs.chart-values }} - with: - scan-type: 'config' - exit-code: '0' - ignore-unfixed: false - severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL' - format: 'sarif' - output: 'trivy-vuln-results.sarif' - - - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v4 - with: - sarif_file: 'trivy-vuln-results.sarif' - - - name: Run Trivy Vulnerability scan - uses: aquasecurity/trivy-action@v0.36.0 - env: - TRIVY_HELM_KUBE_VERSION: ${{ inputs.kubernetes-version }} - TRIVY_HELM_SET_FILE: ${{ inputs.chart-values }} - TRIVY_FORMAT: 'table' - TRIVY_OUTPUT: '' - with: - scan-type: 'config' - exit-code: '1' - ignore-unfixed: true - severity: 'CRITICAL' - - - helm-ct-test: - name: Helm CT - Chart Testing - runs-on: ubuntu-latest - needs: - - kubeconform - - polaris - - trivy - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - - - name: Download packaged Chart - uses: actions/download-artifact@v8 - with: - name: packaged-chart - path: ${{ inputs.chart-dir }} - - - name: Set up Helm - uses: azure/setup-helm@v5 - with: - version: v3.14.4 - - - name: Set up chart-testing - uses: helm/chart-testing-action@v2.8.0 - - - name: Run chart-testing (list-changed) - id: list-changed - run: | - changed=$(ct list-changed --target-branch ${{ github.event.repository.default_branch }}) - if [[ -n "$changed" ]]; then - echo "changed=true" >> "$GITHUB_OUTPUT" - fi - - - name: Create kind cluster - if: steps.list-changed.outputs.changed == 'true' - uses: helm/kind-action@v1.10.0 - - - name: Run chart-testing (install) - if: steps.list-changed.outputs.changed == 'true' - run: | - ct install \ - --target-branch ${{ github.event.repository.default_branch }} \ - --chart-dirs ${{ inputs.chart-dir }} \ - --helm-extra-args "-f ${{ inputs.chart-values }}" - - - helm-chart-releaser: - needs: helm-ct-test - name: Helm CR - Chart Release - runs-on: ubuntu-latest - permissions: - contents: write - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - - # ### Release steps specific to `feature` branch ### - - name: Add release suffix - SNAPSHOT - if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' - run: | - VERSION_SUFFIX="-snapshot-$(git rev-parse --short ${{ github.sha }})" \ - yq -i '.version |= . + env(VERSION_SUFFIX)' ${{ inputs.chart-dir }}/Chart.yaml - - ### Release steps specific to `dev` branch ### - - name: Add release suffix - DEV - if: github.ref == 'refs/heads/dev' - run: | - VERSION_SUFFIX="-dev-$(git rev-parse --short ${{ github.sha }})" \ - yq -i '.version |= . + env(VERSION_SUFFIX)' ${{ inputs.chart-dir }}/Chart.yaml - - - name: Package chart - run: | - helm package ${{ inputs.chart-dir }} -d .cr-release-packages/ - - # ### Prepare release variables ### - - name: Prepare release variables - id: prepare-release - run: | - git fetch origin gh-pages - name=$(git show origin/gh-pages:index.yaml | yq e '.entries | keys | .[0]' 2>/dev/null || echo " ??? ") - - VERSION=$(yq '.version' ${{ inputs.chart-dir }}/Chart.yaml) - - TAG_NAME="${name}-${VERSION}" - - echo "TAG_NAME=$TAG_NAME" >> $GITHUB_OUTPUT - echo "VERSION=$VERSION" >> $GITHUB_OUTPUT - - # ### Release steps specific to `feature` or `dev` branch ### - - name: Create GitHub pre-release + tag - if: github.ref != 'refs/heads/main' - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: | - gh release create "${{ steps.prepare-release.outputs.TAG_NAME }}" \ - .cr-release-packages/*.tgz \ - --prerelease \ - --title "${{ steps.prepare-release.outputs.TAG_NAME }}" \ - --target ${{ github.sha}} \ - --notes "Version from ${{ github.ref_name }}" \ - -F CHANGELOG.md - - # ### Release steps specific to `main` branch ### - - name: Create GitHub release + tag - if: github.ref == 'refs/heads/main' - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: | - gh release create "${{ steps.prepare-release.outputs.TAG_NAME }}" \ - .cr-release-packages/*.tgz \ - --latest \ - --target ${{ github.sha}} \ - --title "${{ steps.prepare-release.outputs.TAG_NAME }}" \ - --notes "Version from ${{ github.ref_name }}" \ - -F CHANGELOG.md - - - name: Update index.yaml on gh-pages - env: - CR_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: | - git config user.name "$GITHUB_ACTOR" - git config user.email "$GITHUB_ACTOR@users.noreply.github.com" - - # Get gh-pages - git fetch origin gh-pages - mkdir -p .cr-index - git show origin/gh-pages:index.yaml > .cr-index/index.yaml 2>/dev/null || echo "apiVersion: v1\nentries: {}" > .cr-index/index.yaml - - echo "Merge index.yaml with new chart version..." - helm repo index .cr-index \ - --url https://${{ github.repository_owner }}.github.io/${{ github.event.repository.name }} \ - --merge .cr-index/index.yaml - - args=(-o "${{ github.repository_owner }}" -r "${{ github.event.repository.name }}" --push) - - echo "Installing chart-releaser on $install_dir..." - curl -sSLo cr.tar.gz "https://github.com/helm/chart-releaser/releases/download/v1.8.1/chart-releaser_1.8.1_linux_amd64.tar.gz" - tar -xzf cr.tar.gz -C "/usr/local/bin/" - rm -f cr.tar.gz - - cr index "${args[@]}" +name: Chart CI + +on: + workflow_call: + inputs: + chart-dir: + description: "Directory holding your Chart" + required: true + type: string + default: "chart" + chart-values: + description: "Chart values file that will be used for the testing and scanning steps" + required: false + type: string + default: "chart/values.yaml" + kubernetes-version: + description: "Version of the target Kubernetes cluster the Chart will run on" + required: false + type: string + default: "1.24.2" + + +jobs: + helm-build-chart: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v6 + with: + fetch-depth: 0 + + - name: Install Helm + uses: azure/setup-helm@v5 + with: + version: v3.14.4 + + - name: Extract and add Helm repositories + run: | + yq eval -r ' + .dependencies[] + | select(.repository != "oci://*") + | "\(.name) \(.repository)" + ' "${{ inputs.chart-dir }}/Chart.yaml" \ + | while read -r name repo; do + helm repo add "$name" "$repo" + done + + helm repo update + + - name: Install chart dependencies + run: | + helm dependency build ${{ inputs.chart-dir }} + + - name: Generate values schema json + uses: losisin/helm-values-schema-json-action@v2.5.0 + with: + values: ${{ inputs.chart-values }} + output: ${{ inputs.chart-dir }}/values.schema.json + + - name: Helm-docs + uses: losisin/helm-docs-github-action@v1.8.0 + with: + chart-search-root: ${{ inputs.chart-dir }} + values-file: ${{ inputs.chart-values }} + output-file: ${{ inputs.chart-dir }}/README.md + template-files: ${{ inputs.chart-dir }}/README.md.gotpl + sort-values-order: file + + - name: Upload packaged Chart + uses: actions/upload-artifact@v7 + with: + name: packaged-chart + path: ${{ inputs.chart-dir }} + if-no-files-found: error + retention-days: 1 + + + helm-ct-lint: + name: Helm CT - Chart Linting + runs-on: ubuntu-latest + needs: helm-build-chart + steps: + - name: Checkout + uses: actions/checkout@v6 + with: + fetch-depth: 0 + + - name: Download packaged Chart + uses: actions/download-artifact@v8 + with: + name: packaged-chart + path: ${{ inputs.chart-dir }} + + - name: Set up Helm + uses: azure/setup-helm@v5 + + - name: Set up chart-testing + uses: helm/chart-testing-action@v2.8.0 + + - name: Run ct lint + run: | + ct lint \ + --target-branch ${{ github.event.repository.default_branch }} \ + --chart-dirs ${{ inputs.chart-dir }} + + + kubeconform: + name: Kubeconform - Chart Validation + needs: helm-ct-lint + runs-on: ubuntu-latest + steps: + - name: Download packaged Chart + uses: actions/download-artifact@v8 + with: + name: packaged-chart + path: ${{ inputs.chart-dir }} + + - name: Set up Helm + uses: azure/setup-helm@v5 + with: + version: v3.14.4 + + - name: Setup Helm plugins + run: | + helm plugin install https://github.com/jtyr/kubeconform-helm + + - name: Run Kubeconform check + run: | + helm kubeconform ${{ inputs.chart-dir }} \ + --values ${{ inputs.chart-values }} \ + --schema-location ${{ inputs.chart-dir }}/values.schema.json \ + --output json \ + --kubernetes-version ${{ inputs.kubernetes-version }} \ + --strict \ + --summary + + + polaris: + name: Polaris - Chart Scan + needs: helm-ct-lint + runs-on: ubuntu-latest + steps: + - name: Download packaged Chart + uses: actions/download-artifact@v8 + with: + name: packaged-chart + path: ${{ inputs.chart-dir }} + + - name: Setup Polaris + run: | + mkdir -p .local/bin + curl -s https://api.github.com/repos/FairwindsOps/polaris/releases/latest | \ + jq '.assets[] | select(.name | endswith("linux_amd64.tar.gz"))'.browser_download_url | \ + xargs curl -s -L | \ + tar xvz -C .local/bin polaris + echo "$PWD/.local/bin" >> $GITHUB_PATH + + - name: Configure Polaris + run: | + echo "checks:" > $PWD/polaris_config.yaml + echo " sensitiveContainerEnvVar: warning" >> $PWD/polaris_config.yaml + + - name: Run chart-testing (polaris) + run: | + polaris audit \ + --config=$PWD/polaris_config.yaml \ + --only-show-failed-tests \ + --set-exit-code-below-score=80 \ + --set-exit-code-on-danger=true \ + --helm-chart ${{ inputs.chart-dir }} \ + --helm-values ${{ inputs.chart-values }} \ + --format=pretty \ + --color=true + + + trivy: + name: Trivy - Chart Vulnerability Scan + needs: helm-ct-lint + runs-on: ubuntu-latest + steps: + - name: Download packaged Chart + uses: actions/download-artifact@v8 + with: + name: packaged-chart + path: ${{ inputs.chart-dir }} + + - name: Build Trivy Vulnerability report + uses: aquasecurity/trivy-action@v0.36.0 + env: + TRIVY_HELM_KUBE_VERSION: ${{ inputs.kubernetes-version }} + TRIVY_HELM_SET_FILE: ${{ inputs.chart-values }} + with: + scan-type: 'config' + exit-code: '0' + ignore-unfixed: false + severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL' + format: 'sarif' + output: 'trivy-vuln-results.sarif' + + - name: Upload Trivy scan results to GitHub Security tab + uses: github/codeql-action/upload-sarif@v4 + with: + sarif_file: 'trivy-vuln-results.sarif' + + - name: Run Trivy Vulnerability scan + uses: aquasecurity/trivy-action@v0.36.0 + env: + TRIVY_HELM_KUBE_VERSION: ${{ inputs.kubernetes-version }} + TRIVY_HELM_SET_FILE: ${{ inputs.chart-values }} + TRIVY_FORMAT: 'table' + TRIVY_OUTPUT: '' + with: + scan-type: 'config' + exit-code: '1' + ignore-unfixed: true + severity: 'CRITICAL' + + + helm-ct-test: + name: Helm CT - Chart Testing + runs-on: ubuntu-latest + needs: + - kubeconform + - polaris + - trivy + steps: + - name: Checkout + uses: actions/checkout@v6 + with: + fetch-depth: 0 + + - name: Download packaged Chart + uses: actions/download-artifact@v8 + with: + name: packaged-chart + path: ${{ inputs.chart-dir }} + + - name: Set up Helm + uses: azure/setup-helm@v5 + with: + version: v3.14.4 + + - name: Set up chart-testing + uses: helm/chart-testing-action@v2.8.0 + + - name: Run chart-testing (list-changed) + id: list-changed + run: | + changed=$(ct list-changed --target-branch ${{ github.event.repository.default_branch }}) + if [[ -n "$changed" ]]; then + echo "changed=true" >> "$GITHUB_OUTPUT" + fi + + - name: Create kind cluster + if: steps.list-changed.outputs.changed == 'true' + uses: helm/kind-action@v1.10.0 + + - name: Run chart-testing (install) + if: steps.list-changed.outputs.changed == 'true' + run: | + ct install \ + --target-branch ${{ github.event.repository.default_branch }} \ + --chart-dirs ${{ inputs.chart-dir }} \ + --helm-extra-args "-f ${{ inputs.chart-values }}" + + + helm-chart-releaser: + needs: helm-ct-test + name: Helm CR - Chart Release + runs-on: ubuntu-latest + permissions: + contents: write + steps: + - name: Checkout + uses: actions/checkout@v6 + with: + fetch-depth: 0 + + # ### Release steps specific to `feature` branch ### + - name: Add release suffix - SNAPSHOT + if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' + run: | + VERSION_SUFFIX="-snapshot-$(git rev-parse --short ${{ github.sha }})" \ + yq -i '.version |= . + env(VERSION_SUFFIX)' ${{ inputs.chart-dir }}/Chart.yaml + + ### Release steps specific to `dev` branch ### + - name: Add release suffix - DEV + if: github.ref == 'refs/heads/dev' + run: | + VERSION_SUFFIX="-dev-$(git rev-parse --short ${{ github.sha }})" \ + yq -i '.version |= . + env(VERSION_SUFFIX)' ${{ inputs.chart-dir }}/Chart.yaml + + - name: Package chart + run: | + helm package ${{ inputs.chart-dir }} -d .cr-release-packages/ + + # ### Prepare release variables ### + - name: Prepare release variables + id: prepare-release + run: | + git fetch origin gh-pages + name=$(git show origin/gh-pages:index.yaml | yq e '.entries | keys | .[0]' 2>/dev/null || echo " ??? ") + + VERSION=$(yq '.version' ${{ inputs.chart-dir }}/Chart.yaml) + + TAG_NAME="${name}-${VERSION}" + + echo "TAG_NAME=$TAG_NAME" >> $GITHUB_OUTPUT + echo "VERSION=$VERSION" >> $GITHUB_OUTPUT + + # ### Release steps specific to `feature` or `dev` branch ### + - name: Create GitHub pre-release + tag + if: github.ref != 'refs/heads/main' + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + gh release create "${{ steps.prepare-release.outputs.TAG_NAME }}" \ + .cr-release-packages/*.tgz \ + --prerelease \ + --title "${{ steps.prepare-release.outputs.TAG_NAME }}" \ + --target ${{ github.sha}} \ + --notes "Version from ${{ github.ref_name }}" \ + -F CHANGELOG.md + + # ### Release steps specific to `main` branch ### + - name: Create GitHub release + tag + if: github.ref == 'refs/heads/main' + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + gh release create "${{ steps.prepare-release.outputs.TAG_NAME }}" \ + .cr-release-packages/*.tgz \ + --latest \ + --target ${{ github.sha}} \ + --title "${{ steps.prepare-release.outputs.TAG_NAME }}" \ + --notes "Version from ${{ github.ref_name }}" \ + -F CHANGELOG.md + + - name: Update index.yaml on gh-pages + env: + CR_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + git config user.name "$GITHUB_ACTOR" + git config user.email "$GITHUB_ACTOR@users.noreply.github.com" + + # Get gh-pages + git fetch origin gh-pages + mkdir -p .cr-index + git show origin/gh-pages:index.yaml > .cr-index/index.yaml 2>/dev/null || echo "apiVersion: v1\nentries: {}" > .cr-index/index.yaml + + echo "Merge index.yaml with new chart version..." + helm repo index .cr-index \ + --url https://${{ github.repository_owner }}.github.io/${{ github.event.repository.name }} \ + --merge .cr-index/index.yaml + + args=(-o "${{ github.repository_owner }}" -r "${{ github.event.repository.name }}" --push) + + echo "Installing chart-releaser on $install_dir..." + curl -sSLo cr.tar.gz "https://github.com/helm/chart-releaser/releases/download/v1.8.1/chart-releaser_1.8.1_linux_amd64.tar.gz" + tar -xzf cr.tar.gz -C "/usr/local/bin/" + rm -f cr.tar.gz + + cr index "${args[@]}" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 75a32aa..5c81a8e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,36 +1,70 @@ ---- -name: CI - -# Controls when the workflow will run -on: - # Triggers the workflow on push or pull request events but only for the "main" branch - push: - branches-ignore: - - "main" - pull_request: - branches: ["main", "dev"] - - # Allows you to run this workflow manually from the Actions tab - workflow_dispatch: - -# A workflow run is made up of one or more jobs that can run sequentially or in parallel -jobs: - # This workflow contains a single job called "build" - build: - # The type of runner that the job will run on - runs-on: ubuntu-latest - - # Steps represent a sequence of tasks that will be executed as part of the job - steps: - # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it - - uses: actions/checkout@v4 - - name: yaml-lint - uses: ibiqlik/action-yamllint@v3.1.1 - with: - config_data: | - extends: default - rules: - trailing-spaces: - level: warning - line-length: disable # don't bother me with this rule - comments-indentation: disable # don't bother me with this rule +--- +name: CI + +# Controls when the workflow will run +on: + # Triggers the workflow on push or pull request events but only for the "main" branch + push: + branches-ignore: + - "main" + pull_request: + branches: ["main", "dev"] + + # Allows you to run this workflow manually from the Actions tab + workflow_dispatch: + inputs: + logLevel: + description: 'Log level' + required: true + default: 'warning' + type: choice + options: + - info + - warning + - debug + environment: + description: 'Environment to run tests against' + type: environment + required: true + +# A workflow run is made up of one or more jobs that can run sequentially or in parallel +jobs: + build: + # The type of runner that the job will run on + runs-on: ubuntu-latest + + # Steps represent a sequence of tasks that will be executed as part of the job + steps: + # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it + - uses: actions/checkout@v4 + - name: yaml-lint + uses: ibiqlik/action-yamllint@v3.1.1 + with: + config_data: | + extends: default + rules: + trailing-spaces: + level: warning + line-length: disable # don't bother me with this rule + comments-indentation: disable # don't bother me with this rule + + tests-container-ci: + uses: "aphp/ci-workflows/.github/workflows/container-ci.yml@main" + with: + dockerfile-path: "./test/container/build-notebook.yml" + hadolint-ignore: "DL3008,DL3016" + image-name: aphp-busybox + image-custom-tag: test + dockle-ignore: "CIS-DI-0010,DKL-DI-0001" + dockle-accept-file: + dockle-accept-key: + extra-build-args: | + KEY_TEST_1=value_test_1 + KEY_TEST_2="value test 2" + + trivy-ignore-vuln-ids: | + CVE-2024-21508 + trivy-ignore-license-ids: | + WTFPL + +# tests-container-chart: diff --git a/.github/workflows/container-ci.yml b/.github/workflows/container-ci.yml index ccc1662..16cc20a 100644 --- a/.github/workflows/container-ci.yml +++ b/.github/workflows/container-ci.yml @@ -1,450 +1,451 @@ ---- -name: build - -on: - workflow_call: - inputs: - dockerfile-path: - description: "Path to Dockerfile of your project" - required: false - type: string - default: "Dockerfile" - hadolint-ignore: - description: "Comma separated list of Hadolint rules to ignore (for scan only, will still be present in the generated report)" - required: false - default: '' - type: string - image-name: - description: "Image name" - required: true - type: string - image-custom-tag: - description: "Custom image tag, to be added to the ones generated by default" - required: false - default: '' - type: string - extra-build-args: - description: "Extra build args as KEY=VALUE, one per line, in a YAML scalar bloc" - required: false - default: '' - type: string - dockle-ignore: - description: "Comma separated list of Dockle rule IDs to ignore" - required: false - default: '' - type: string - dockle-accept-file: - description: "Comma separated list of filenames to accept (Dockle accept-file)" - required: false - default: '' - type: string - dockle-accept-key: - description: "Comma separated list of keys to accept (Dockle accept-key)" - required: false - default: '' - type: string - trivy-ignore-vuln-ids: - description: | - List of vulnerability IDs (CVE-..., GHSA-..., AVD-...) to ignore in Trivy. - One per line (recommended) or comma-separated. - required: false - default: '' - type: string - trivy-ignore-license-ids: - description: | - List of license IDs to ignore in Trivy (ex: GPL-3.0-only, MIT, Apache-2.0 WITH LLVM-exception). - One per line (recommended) or comma-separated. - required: false - default: '' - type: string - -jobs: - dockerfile-lint: - name: Dockerfile Lint - runs-on: ubuntu-latest - steps: - - name: Checkout code - uses: actions/checkout@v6 - - - name: Build Hadolint report - uses: hadolint/hadolint-action@v3.3.0 - with: - dockerfile: ${{ inputs.dockerfile-path }} - no-fail: true - no-color: true - failure-threshold: ignore - format: sarif - output-file: 'hadolint-report.sarif' - - - name: Upload Hadolint report to GitHub Security tab - uses: github/codeql-action/upload-sarif@v4 - with: - sarif_file: 'hadolint-report.sarif' - category: linting - - - name: Run Hadolint scan - uses: hadolint/hadolint-action@v3.3.0 - with: - dockerfile: ${{ inputs.dockerfile-path }} - ignore: ${{ inputs.hadolint-ignore }} - failure-threshold: warning - format: tty - - - image-build: - name: Image Build - runs-on: ubuntu-latest - needs: dockerfile-lint - steps: - - name: Checkout code - uses: actions/checkout@v6 - with: - fetch-depth: 0 - - - name: Parse build-args - id: args - shell: bash - run: | - { - echo "build-args<> "$GITHUB_OUTPUT" - - - name: Docker meta - id: meta - uses: docker/metadata-action@v6 - env: - DOCKER_METADATA_SHORT_SHA_LENGTH: 7 - with: - # list of Docker images to use as base name for tags - images: | - ${{ inputs.image-name }} - # Generate Docker tags based on the following events/attributes - tags: | - type=schedule - type=ref,event=branch - type=ref,event=pr - type=semver,pattern={{version}} - type=semver,pattern={{major}}.{{minor}} - type=semver,pattern={{major}} - type=sha - type=raw,value=${{ inputs.image-custom-tag }},enable=${{ inputs.image-custom-tag != '' }} - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - - name: Build and export - uses: docker/build-push-action@v6 - # Fixes CIS-DI-0005 - env: - DOCKER_CONTENT_TRUST: '1' - with: - file: ${{ inputs.dockerfile-path }} - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - build-args: | - ${{ steps.args.outputs.build-args }} - push: false - outputs: type=docker,dest=/tmp/container.image.${{ hashFiles(inputs.dockerfile-path) }}.tar - - - name: Upload artifact - uses: actions/upload-artifact@v7 - with: - name: container.image.${{ hashFiles(inputs.dockerfile-path) }} - path: /tmp/container.image.${{ hashFiles(inputs.dockerfile-path) }}.tar - - - image-audit: - name: Image Audit - needs: image-build - runs-on: ubuntu-latest - steps: - - name: Checkout code - uses: actions/checkout@v6 - - - name: Download image tarball - uses: actions/download-artifact@v8 - with: - name: container.image.${{ hashFiles(inputs.dockerfile-path) }} - path: /tmp - - - name: Load image - run: | - TARBALL="/tmp/container.image.${{ hashFiles(inputs.dockerfile-path) }}.tar" - echo "[INFO]: Importing container image from following tarball :" - ls -al "$TARBALL" - docker load --input "$TARBALL" - echo "[INFO]: The following images are now present in the local registry :" - docker image ls -a - - - name: Generate SHORT_SHA - id: short-sha - uses: benjlevesque/short-sha@v3.0 - with: - length: 7 - - - name: Build Dockle report - uses: goodwithtech/dockle-action@v0.4.15 - with: - image: "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" - format: sarif - output: 'dockle-report.sarif' - exit-code: 0 - - - name: Upload Dockle report to GitHub Security tab - uses: github/codeql-action/upload-sarif@v4 - with: - sarif_file: 'dockle-report.sarif' - category: code-quality - - - name: Download Dockle - run: | - curl -sSL "https://github.com/goodwithtech/dockle/releases/download/v0.4.15/dockle_0.4.15_Linux-386.tar.gz" -o dockle.tar.gz - tar -xzf dockle.tar.gz - sudo mv dockle /usr/local/bin/dockle - - - name: Run dockle - run: | - dockle_keys_formater(){ IFS=', ' read -r -a keys_list <<< "$VALUES" && \ - formated_keys="" && \ - for key in ${keys_list[@]}; do formated_keys="${formated_keys} $ARG $key" ; done && \ - echo "$formated_keys " ;} - - dockle \ - $(VALUES="${{ inputs.dockle-accept-key }}" ARG="--accept-key" dockle_keys_formater) \ - $(VALUES="${{ inputs.dockle-accept-file }}" ARG="--accept-file" dockle_keys_formater) \ - $(VALUES="${{ inputs.dockle-ignore }}" ARG="--ignore" dockle_keys_formater) \ - --exit-code 1 \ - --format json \ - "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" - - - image-scan: - name: Image Scan - needs: image-build - runs-on: ubuntu-latest - steps: - - name: Checkout code - uses: actions/checkout@v6 - - - name: Download image tarball - uses: actions/download-artifact@v8 - with: - name: container.image.${{ hashFiles(inputs.dockerfile-path) }} - path: /tmp - - - name: Load image - run: | - TARBALL="/tmp/container.image.${{ hashFiles(inputs.dockerfile-path) }}.tar" - echo "[INFO]: Importing container image from following tarball :" - ls -al "$TARBALL" - docker load --input "$TARBALL" - echo "[INFO]: The following images are now present in the local registry :" - docker image ls -a - - - name: Generate SHORT_SHA - id: short-sha - uses: benjlevesque/short-sha@v3.0 - with: - length: 7 - - - name: Generate Trivy ignore file from inputs - env: - TRIVY_IGNORE_VULN_IDS: ${{ inputs.trivy-ignore-vuln-ids }} - TRIVY_IGNORE_LICENSE_IDS: ${{ inputs.trivy-ignore-license-ids }} - run: | - IGNORE_FILE="ci-trivy-ignore.txt" - echo "# Generated by reusable build workflow" > "$IGNORE_FILE" - - if [ -n "$TRIVY_IGNORE_VULN_IDS" ]; then - echo "" >> "$IGNORE_FILE" - echo "# Vulnerabilities" >> "$IGNORE_FILE" - printf '%s\n' "$TRIVY_IGNORE_VULN_IDS" | tr ',' '\n' >> "$IGNORE_FILE" - fi - - if [ -n "$TRIVY_IGNORE_LICENSE_IDS" ]; then - echo "" >> "$IGNORE_FILE" - echo "# Licenses" >> "$IGNORE_FILE" - printf '%s\n' "$TRIVY_IGNORE_LICENSE_IDS" | tr ',' '\n' >> "$IGNORE_FILE" - fi - - echo "[INFO] Generated $IGNORE_FILE:" - cat "$IGNORE_FILE" - - - name: Generate SBOM (SPDX JSON) - uses: aquasecurity/trivy-action@v0.36.0 - with: - scan-type: 'image' - image-ref: "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" - format: 'spdx-json' - output: 'image-sbom.spdx.json' - exit-code: '0' - - - name: Submit SBOM to GitHub Dependency Graph - uses: advanced-security/spdx-dependency-submission-action@v0.2.0 - with: - filePath: 'image-sbom.spdx.json' - - - name: Build Trivy Vulnerability report - uses: aquasecurity/trivy-action@v0.36.0 - with: - image-ref: "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" - skip-setup-trivy: true - exit-code: '0' - ignore-unfixed: false - scanners: 'vuln,secret' - vuln-type: 'os,library' - severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL' - format: 'sarif' - limit-severities-for-sarif: 'false' - output: 'trivy-vuln-results.sarif' - - - name: Upload Trivy Vulnerability report to GitHub Security tab - uses: github/codeql-action/upload-sarif@v4 - with: - sarif_file: 'trivy-vuln-results.sarif' - category: vulnerability - - - name: Build Trivy License report - uses: aquasecurity/trivy-action@v0.36.0 - with: - image-ref: "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" - skip-setup-trivy: true - exit-code: '0' - ignore-unfixed: false - scanners: 'license' - vuln-type: 'os,library' - severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL' - format: 'sarif' - limit-severities-for-sarif: 'false' - output: 'trivy-license-results.sarif' - - - name: Patch Trivy Vulnerability SARIF rule IDs for GitHub - run: | - python3 <<'PY' - import json - import sys - from pathlib import Path - - max_len = 200 - paths = [Path("trivy-vuln-results.sarif"), Path("trivy-license-results.sarif")] - - for path in paths : - try: - with path.open("r", encoding="utf-8") as f: - sarif = json.load(f) - except FileNotFoundError: - print(f"ERROR: SARIF file not found: {path}") - sys.exit(1) - - total_id_fixed = 0 - total_ruleId_fixed = 0 - - for run in sarif.get("runs", []): - for rule in run.get("tool", {}).get("driver", {}).get("rules", []): - if isinstance(rule.get("id"), str) and len(rule["id"]) > max_len: - rule.setdefault("properties", {})["originalTrivyRuleId"] = rule["id"] - rule["id"] = rule["id"][:max_len] - total_id_fixed += 1 - - for result in run.get("results", []): - if isinstance(result.get("ruleId"), str) and len(result["ruleId"]) > max_len: - result.setdefault("properties", {})["originalTrivyRuleId"] = result["ruleId"] - result["ruleId"] = result["ruleId"][:max_len] - total_ruleId_fixed += 1 - - with path.open("w", encoding="utf-8") as f: - json.dump(sarif, f, ensure_ascii=False, indent=2) - - print("SARIF patched") - print(f"File: {path}") - print(f"id fixed: {total_id_fixed}") - print(f"ruleId fixed: {total_ruleId_fixed}") - PY - - - name: Upload Trivy License report to GitHub Security tab - uses: github/codeql-action/upload-sarif@v4 - with: - sarif_file: 'trivy-license-results.sarif' - category: license - - - name: Run Trivy Vulnerability scan - uses: aquasecurity/trivy-action@v0.36.0 - # Overriding env vars from previous steps for them not to interfere with the scan - env: - TRIVY_FORMAT: 'table' - TRIVY_OUTPUT: '' - with: - image-ref: "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" - skip-setup-trivy: true - exit-code: '1' - ignore-unfixed: true - scanners: 'vuln,secret' - vuln-type: 'os,library' - severity: 'CRITICAL' - format: 'table' - trivyignores: 'ci-trivy-ignore.txt' - - - name: Run Trivy License scan - uses: aquasecurity/trivy-action@v0.36.0 - # Overriding env vars from previous steps for them not to interfere with the scan - env: - TRIVY_FORMAT: 'table' - TRIVY_OUTPUT: '' - with: - image-ref: "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" - skip-setup-trivy: true - exit-code: '1' - ignore-unfixed: true - scanners: 'license' - vuln-type: 'os,library' - severity: 'CRITICAL' - format: 'table' - trivyignores: 'ci-trivy-ignore.txt' - - push-docker-image: - name: Image Push to GHCR - needs: - - image-audit - - image-scan - runs-on: ubuntu-24.04 - steps: - - name: Checkout code - uses: actions/checkout@v6 - - - name: Download image tarball - uses: actions/download-artifact@v8 - with: - name: container.image.${{ hashFiles(inputs.dockerfile-path) }} - path: /tmp - - - name: Load image - run: | - TARBALL="/tmp/container.image.${{ hashFiles(inputs.dockerfile-path) }}.tar" - echo "[INFO]: Importing container image from following tarball :" - ls -al "$TARBALL" - docker load --input "$TARBALL" - echo "[INFO]: The following images are now present in the local registry :" - docker image ls -a - - - name: Login to GitHub Container Registry - uses: docker/login-action@v4 - with: - registry: ghcr.io - username: ${{github.actor}} - password: ${{secrets.GITHUB_TOKEN}} - - - name: Push Image to GitHub Container Registry - run: | - docker push --all-tags ${{ inputs.image-name }} +--- +name: build + +on: + workflow_call: + inputs: + dockerfile-path: + description: "Path to Dockerfile of your project" + required: false + type: string + default: "Dockerfile" + hadolint-ignore: + description: "Comma separated list of Hadolint rules to ignore (for scan only, will still be present in the generated report)" + required: false + default: '' + type: string + image-name: + description: "Image name" + required: true + type: string + image-custom-tag: + description: "Custom image tag, to be added to the ones generated by default" + required: false + default: '' + type: string + extra-build-args: + description: "Extra build args as KEY=VALUE, one per line, in a YAML scalar bloc" + required: false + default: '' + type: string + dockle-ignore: + description: "Comma separated list of Dockle rule IDs to ignore" + required: false + default: '' + type: string + dockle-accept-file: + description: "Comma separated list of filenames to accept (Dockle accept-file)" + required: false + default: '' + type: string + dockle-accept-key: + description: "Comma separated list of keys to accept (Dockle accept-key)" + required: false + default: '' + type: string + trivy-ignore-vuln-ids: + description: | + List of vulnerability IDs (CVE-..., GHSA-..., AVD-...) to ignore in Trivy. + One per line (recommended) or comma-separated. + required: false + default: '' + type: string + trivy-ignore-license-ids: + description: | + List of license IDs to ignore in Trivy (ex: GPL-3.0-only, MIT, Apache-2.0 WITH LLVM-exception). + One per line (recommended) or comma-separated. + required: false + default: '' + type: string + +jobs: + dockerfile-lint: + name: Dockerfile Lint + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v6 + + - name: Build Hadolint report + uses: hadolint/hadolint-action@v3.3.0 + with: + dockerfile: ${{ inputs.dockerfile-path }} + no-fail: true + no-color: true + failure-threshold: ignore + format: sarif + output-file: 'hadolint-report.sarif' + + - name: Upload Hadolint report to GitHub Security tab + uses: github/codeql-action/upload-sarif@v4 + with: + sarif_file: 'hadolint-report.sarif' + category: linting + + - name: Run Hadolint scan + uses: hadolint/hadolint-action@v3.3.0 + with: + dockerfile: ${{ inputs.dockerfile-path }} + ignore: ${{ inputs.hadolint-ignore }} + failure-threshold: warning + format: tty + + + image-build: + name: Image Build + runs-on: ubuntu-latest + needs: dockerfile-lint + steps: + - name: Checkout code + uses: actions/checkout@v6 + with: + fetch-depth: 0 + + - name: Parse build-args + id: args + shell: bash + run: | + { + echo "build-args<> "$GITHUB_OUTPUT" + + - name: Docker meta + id: meta + uses: docker/metadata-action@v6 + env: + DOCKER_METADATA_SHORT_SHA_LENGTH: 7 + with: + # list of Docker images to use as base name for tags + images: | + ${{ inputs.image-name }} + # Generate Docker tags based on the following events/attributes + tags: | + type=schedule + type=ref,event=branch + type=ref,event=pr + type=semver,pattern={{version}} + type=semver,pattern={{major}}.{{minor}} + type=semver,pattern={{major}} + type=sha + type=raw,value=${{ inputs.image-custom-tag }},enable=${{ inputs.image-custom-tag != '' }} + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Build and export + uses: docker/build-push-action@v6 + # Fixes CIS-DI-0005 + env: + DOCKER_CONTENT_TRUST: '1' + with: + file: ${{ inputs.dockerfile-path }} + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + build-args: | + ${{ steps.args.outputs.build-args }} + push: false + outputs: type=docker,dest=/tmp/container.image.${{ hashFiles(inputs.dockerfile-path) }}.tar + + - name: Upload artifact + uses: actions/upload-artifact@v7 + with: + name: container.image.${{ hashFiles(inputs.dockerfile-path) }} + path: /tmp/container.image.${{ hashFiles(inputs.dockerfile-path) }}.tar + + + image-audit: + name: Image Audit + needs: image-build + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v6 + + - name: Download image tarball + uses: actions/download-artifact@v8 + with: + name: container.image.${{ hashFiles(inputs.dockerfile-path) }} + path: /tmp + + - name: Load image + run: | + TARBALL="/tmp/container.image.${{ hashFiles(inputs.dockerfile-path) }}.tar" + echo "[INFO]: Importing container image from following tarball :" + ls -al "$TARBALL" + docker load --input "$TARBALL" + echo "[INFO]: The following images are now present in the local registry :" + docker image ls -a + + - name: Generate SHORT_SHA + id: short-sha + uses: benjlevesque/short-sha@v3.0 + with: + length: 7 + + - name: Build Dockle report + uses: goodwithtech/dockle-action@v0.4.15 + with: + image: "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" + format: sarif + output: 'dockle-report.sarif' + exit-code: 0 + + - name: Upload Dockle report to GitHub Security tab + uses: github/codeql-action/upload-sarif@v4 + with: + sarif_file: 'dockle-report.sarif' + category: code-quality + + - name: Download Dockle + if: inputs.dockle-accept-key != "" || inputs.dockle-accept-file != "" || inputs.dockle-ignore != "" + run: | + curl -sSL "https://github.com/goodwithtech/dockle/releases/download/v0.4.15/dockle_0.4.15_Linux-386.tar.gz" -o dockle.tar.gz + tar -xzf dockle.tar.gz + sudo mv dockle /usr/local/bin/dockle + + - name: Run dockle + if: inputs.dockle-accept-key != "" || inputs.dockle-accept-file != "" || inputs.dockle-ignore != "" + run: | + dockle_keys_formater(){ IFS=', ' read -r -a keys_list <<< "$VALUES" && \ + formated_keys="" && \ + for key in ${keys_list[@]}; do formated_keys="${formated_keys} $ARG $key" ; done && \ + echo "$formated_keys " ;} + + dockle \ + $(VALUES="${{ inputs.dockle-accept-key }}" ARG="--accept-key" dockle_keys_formater) \ + $(VALUES="${{ inputs.dockle-accept-file }}" ARG="--accept-file" dockle_keys_formater) \ + $(VALUES="${{ inputs.dockle-ignore }}" ARG="--ignore" dockle_keys_formater) \ + --exit-code 1 \ + --format json \ + "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" + + image-scan: + name: Image Scan + needs: image-build + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v6 + + - name: Download image tarball + uses: actions/download-artifact@v8 + with: + name: container.image.${{ hashFiles(inputs.dockerfile-path) }} + path: /tmp + + - name: Load image + run: | + TARBALL="/tmp/container.image.${{ hashFiles(inputs.dockerfile-path) }}.tar" + echo "[INFO]: Importing container image from following tarball :" + ls -al "$TARBALL" + docker load --input "$TARBALL" + echo "[INFO]: The following images are now present in the local registry :" + docker image ls -a + + - name: Generate SHORT_SHA + id: short-sha + uses: benjlevesque/short-sha@v3.0 + with: + length: 7 + + - name: Generate Trivy ignore file from inputs + env: + TRIVY_IGNORE_VULN_IDS: ${{ inputs.trivy-ignore-vuln-ids }} + TRIVY_IGNORE_LICENSE_IDS: ${{ inputs.trivy-ignore-license-ids }} + run: | + IGNORE_FILE="ci-trivy-ignore.txt" + echo "# Generated by reusable build workflow" > "$IGNORE_FILE" + + if [ -n "$TRIVY_IGNORE_VULN_IDS" ]; then + echo "" >> "$IGNORE_FILE" + echo "# Vulnerabilities" >> "$IGNORE_FILE" + printf '%s\n' "$TRIVY_IGNORE_VULN_IDS" | tr ',' '\n' >> "$IGNORE_FILE" + fi + + if [ -n "$TRIVY_IGNORE_LICENSE_IDS" ]; then + echo "" >> "$IGNORE_FILE" + echo "# Licenses" >> "$IGNORE_FILE" + printf '%s\n' "$TRIVY_IGNORE_LICENSE_IDS" | tr ',' '\n' >> "$IGNORE_FILE" + fi + + echo "[INFO] Generated $IGNORE_FILE:" + cat "$IGNORE_FILE" + + - name: Generate SBOM (SPDX JSON) + uses: aquasecurity/trivy-action@v0.36.0 + with: + scan-type: 'image' + image-ref: "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" + format: 'spdx-json' + output: 'image-sbom.spdx.json' + exit-code: '0' + + - name: Submit SBOM to GitHub Dependency Graph + uses: advanced-security/spdx-dependency-submission-action@v0.2.0 + with: + filePath: 'image-sbom.spdx.json' + + - name: Build Trivy Vulnerability report + uses: aquasecurity/trivy-action@v0.36.0 + with: + image-ref: "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" + skip-setup-trivy: true + exit-code: '0' + ignore-unfixed: false + scanners: 'vuln,secret' + vuln-type: 'os,library' + severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL' + format: 'sarif' + limit-severities-for-sarif: 'false' + output: 'trivy-vuln-results.sarif' + + - name: Upload Trivy Vulnerability report to GitHub Security tab + uses: github/codeql-action/upload-sarif@v4 + with: + sarif_file: 'trivy-vuln-results.sarif' + category: vulnerability + + - name: Build Trivy License report + uses: aquasecurity/trivy-action@v0.36.0 + with: + image-ref: "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" + skip-setup-trivy: true + exit-code: '0' + ignore-unfixed: false + scanners: 'license' + vuln-type: 'os,library' + severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL' + format: 'sarif' + limit-severities-for-sarif: 'false' + output: 'trivy-license-results.sarif' + + - name: Patch Trivy Vulnerability SARIF rule IDs for GitHub + run: | + python3 <<'PY' + import json + import sys + from pathlib import Path + + max_len = 200 + paths = [Path("trivy-vuln-results.sarif"), Path("trivy-license-results.sarif")] + + for path in paths : + try: + with path.open("r", encoding="utf-8") as f: + sarif = json.load(f) + except FileNotFoundError: + print(f"ERROR: SARIF file not found: {path}") + sys.exit(1) + + total_id_fixed = 0 + total_ruleId_fixed = 0 + + for run in sarif.get("runs", []): + for rule in run.get("tool", {}).get("driver", {}).get("rules", []): + if isinstance(rule.get("id"), str) and len(rule["id"]) > max_len: + rule.setdefault("properties", {})["originalTrivyRuleId"] = rule["id"] + rule["id"] = rule["id"][:max_len] + total_id_fixed += 1 + + for result in run.get("results", []): + if isinstance(result.get("ruleId"), str) and len(result["ruleId"]) > max_len: + result.setdefault("properties", {})["originalTrivyRuleId"] = result["ruleId"] + result["ruleId"] = result["ruleId"][:max_len] + total_ruleId_fixed += 1 + + with path.open("w", encoding="utf-8") as f: + json.dump(sarif, f, ensure_ascii=False, indent=2) + + print("SARIF patched") + print(f"File: {path}") + print(f"id fixed: {total_id_fixed}") + print(f"ruleId fixed: {total_ruleId_fixed}") + PY + + - name: Upload Trivy License report to GitHub Security tab + uses: github/codeql-action/upload-sarif@v4 + with: + sarif_file: 'trivy-license-results.sarif' + category: license + + - name: Run Trivy Vulnerability scan + uses: aquasecurity/trivy-action@v0.36.0 + # Overriding env vars from previous steps for them not to interfere with the scan + env: + TRIVY_FORMAT: 'table' + TRIVY_OUTPUT: '' + with: + image-ref: "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" + skip-setup-trivy: true + exit-code: '1' + ignore-unfixed: true + scanners: 'vuln,secret' + vuln-type: 'os,library' + severity: 'CRITICAL' + format: 'table' + trivyignores: 'ci-trivy-ignore.txt' + + - name: Run Trivy License scan + uses: aquasecurity/trivy-action@v0.36.0 + # Overriding env vars from previous steps for them not to interfere with the scan + env: + TRIVY_FORMAT: 'table' + TRIVY_OUTPUT: '' + with: + image-ref: "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" + skip-setup-trivy: true + exit-code: '1' + ignore-unfixed: true + scanners: 'license' + vuln-type: 'os,library' + severity: 'CRITICAL' + format: 'table' + trivyignores: 'ci-trivy-ignore.txt' + + push-docker-image: + name: Image Push to GHCR + needs: + - image-audit + - image-scan + runs-on: ubuntu-24.04 + steps: + - name: Checkout code + uses: actions/checkout@v6 + + - name: Download image tarball + uses: actions/download-artifact@v8 + with: + name: container.image.${{ hashFiles(inputs.dockerfile-path) }} + path: /tmp + + - name: Load image + run: | + TARBALL="/tmp/container.image.${{ hashFiles(inputs.dockerfile-path) }}.tar" + echo "[INFO]: Importing container image from following tarball :" + ls -al "$TARBALL" + docker load --input "$TARBALL" + echo "[INFO]: The following images are now present in the local registry :" + docker image ls -a + + - name: Login to GitHub Container Registry + uses: docker/login-action@v4 + with: + registry: ghcr.io + username: ${{github.actor}} + password: ${{secrets.GITHUB_TOKEN}} + + - name: Push Image to GitHub Container Registry + run: | + docker push --all-tags ${{ inputs.image-name }} diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 469fa0f..8de3dc0 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,21 +1,21 @@ - -## How to contribute to the `aphp/ci-workflows` project - -#### **Did you find a bug?** - -* **Ensure the bug was not already reported** by searching on GitHub under [Issues](https://github.com/aphp/redcap-containers/issues). - -* If you're unable to find an open issue addressing the problem, [open a new one](https://github.com/aphp/redcap-containers/issues/new). Be sure to include a **title and clear description**, as much relevant information as possible, and a **code sample** or an **executable test case** demonstrating the expected behavior that is not occurring. - -#### **Did you write a patch that fixes a bug?** - -* Open a new GitHub pull request with the patch. - -* Ensure the PR description clearly describes the problem and solution. Include the relevant issue number if applicable. - -#### **Do you intend to add a new feature or change an existing one?** - -* Suggest your change in a dedicated issue. - -* Do not submit a PR on GitHub until you have collected positive feedback about the change. - + +## How to contribute to the `aphp/ci-workflows` project + +#### **Did you find a bug?** + +* **Ensure the bug was not already reported** by searching on GitHub under [Issues](https://github.com/aphp/redcap-containers/issues). + +* If you're unable to find an open issue addressing the problem, [open a new one](https://github.com/aphp/redcap-containers/issues/new). Be sure to include a **title and clear description**, as much relevant information as possible, and a **code sample** or an **executable test case** demonstrating the expected behavior that is not occurring. + +#### **Did you write a patch that fixes a bug?** + +* Open a new GitHub pull request with the patch. + +* Ensure the PR description clearly describes the problem and solution. Include the relevant issue number if applicable. + +#### **Do you intend to add a new feature or change an existing one?** + +* Suggest your change in a dedicated issue. + +* Do not submit a PR on GitHub until you have collected positive feedback about the change. + diff --git a/LICENSE b/LICENSE index 78cac7d..a93c433 100644 --- a/LICENSE +++ b/LICENSE @@ -1,203 +1,203 @@ - Apache License - Version 2.0, January 2004 - http://www.apache.org/licenses/ - - TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION - - 1. Definitions. - - "License" shall mean the terms and conditions for use, reproduction, - and distribution as defined by Sections 1 through 9 of this document. - - "Licensor" shall mean the copyright owner or entity authorized by - the copyright owner that is granting the License. - - "Legal Entity" shall mean the union of the acting entity and all - other entities that control, are controlled by, or are under common - control with that entity. For the purposes of this definition, - "control" means (i) the power, direct or indirect, to cause the - direction or management of such entity, whether by contract or - otherwise, or (ii) ownership of fifty percent (50%) or more of the - outstanding shares, or (iii) beneficial ownership of such entity. - - "You" (or "Your") shall mean an individual or Legal Entity - exercising permissions granted by this License. - - "Source" form shall mean the preferred form for making modifications, - including but not limited to software source code, documentation - source, and configuration files. - - "Object" form shall mean any form resulting from mechanical - transformation or translation of a Source form, including but - not limited to compiled object code, generated documentation, - and conversions to other media types. - - "Work" shall mean the work of authorship, whether in Source or - Object form, made available under the License, as indicated by a - copyright notice that is included in or attached to the work - (an example is provided in the Appendix below). - - "Derivative Works" shall mean any work, whether in Source or Object - form, that is based on (or derived from) the Work and for which the - editorial revisions, annotations, elaborations, or other modifications - represent, as a whole, an original work of authorship. For the purposes - of this License, Derivative Works shall not include works that remain - separable from, or merely link (or bind by name) to the interfaces of, - the Work and Derivative Works thereof. - - "Contribution" shall mean any work of authorship, including - the original version of the Work and any modifications or additions - to that Work or Derivative Works thereof, that is intentionally - submitted to Licensor for inclusion in the Work by the copyright owner - or by an individual or Legal Entity authorized to submit on behalf of - the copyright owner. For the purposes of this definition, "submitted" - means any form of electronic, verbal, or written communication sent - to the Licensor or its representatives, including but not limited to - communication on electronic mailing lists, source code control systems, - and issue tracking systems that are managed by, or on behalf of, the - Licensor for the purpose of discussing and improving the Work, but - excluding communication that is conspicuously marked or otherwise - designated in writing by the copyright owner as "Not a Contribution." - - "Contributor" shall mean Licensor and any individual or Legal Entity - on behalf of whom a Contribution has been received by Licensor and - subsequently incorporated within the Work. - - 2. Grant of Copyright License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - copyright license to reproduce, prepare Derivative Works of, - publicly display, publicly perform, sublicense, and distribute the - Work and such Derivative Works in Source or Object form. - - 3. Grant of Patent License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - (except as stated in this section) patent license to make, have made, - use, offer to sell, sell, import, and otherwise transfer the Work, - where such license applies only to those patent claims licensable - by such Contributor that are necessarily infringed by their - Contribution(s) alone or by combination of their Contribution(s) - with the Work to which such Contribution(s) was submitted. If You - institute patent litigation against any entity (including a - cross-claim or counterclaim in a lawsuit) alleging that the Work - or a Contribution incorporated within the Work constitutes direct - or contributory patent infringement, then any patent licenses - granted to You under this License for that Work shall terminate - as of the date such litigation is filed. - - 4. Redistribution. You may reproduce and distribute copies of the - Work or Derivative Works thereof in any medium, with or without - modifications, and in Source or Object form, provided that You - meet the following conditions: - - (a) You must give any other recipients of the Work or - Derivative Works a copy of this License; and - - (b) You must cause any modified files to carry prominent notices - stating that You changed the files; and - - (c) You must retain, in the Source form of any Derivative Works - that You distribute, all copyright, patent, trademark, and - attribution notices from the Source form of the Work, - excluding those notices that do not pertain to any part of - the Derivative Works; and - - (d) If the Work includes a "NOTICE" text file as part of its - distribution, then any Derivative Works that You distribute must - include a readable copy of the attribution notices contained - within such NOTICE file, excluding those notices that do not - pertain to any part of the Derivative Works, in at least one - of the following places: within a NOTICE text file distributed - as part of the Derivative Works; within the Source form or - documentation, if provided along with the Derivative Works; or, - within a display generated by the Derivative Works, if and - wherever such third-party notices normally appear. The contents - of the NOTICE file are for informational purposes only and - do not modify the License. You may add Your own attribution - notices within Derivative Works that You distribute, alongside - or as an addendum to the NOTICE text from the Work, provided - that such additional attribution notices cannot be construed - as modifying the License. - - You may add Your own copyright statement to Your modifications and - may provide additional or different license terms and conditions - for use, reproduction, or distribution of Your modifications, or - for any such Derivative Works as a whole, provided Your use, - reproduction, and distribution of the Work otherwise complies with - the conditions stated in this License. - - 5. Submission of Contributions. Unless You explicitly state otherwise, - any Contribution intentionally submitted for inclusion in the Work - by You to the Licensor shall be under the terms and conditions of - this License, without any additional terms or conditions. - Notwithstanding the above, nothing herein shall supersede or modify - the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. - - 6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. - - 7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. - - 8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. - - 9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. - - END OF TERMS AND CONDITIONS - - APPENDIX: How to apply the Apache License to your work. - - To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "[]" - replaced with your own identifying information. (Don't include - the brackets!) The text should be enclosed in the appropriate - comment syntax for the file format. We also recommend that a - file or class name and description of purpose be included on the - same "printed page" as the copyright notice for easier - identification within third-party archives. - - Copyright [yyyy] [name of copyright owner] - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. - + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + [2024 - 2025] [CI Workflows] © Assistance Publique – Hôpitaux de Paris. \ No newline at end of file diff --git a/README.md b/README.md index 1630024..39c15e0 100644 --- a/README.md +++ b/README.md @@ -1,341 +1,341 @@ -# APHP CI GitHub Reusable Workflows - -This repository hosts a collection of **reusable GitHub Actions workflows** for AP‑HP projects. - -The goal is to **centralize CI/CD best practices** (linting, security scans, packaging and publishing) so that each project can: - -- reuse the same, opinionated workflows, -- get consistent quality and security checks, -- keep CI configuration as small as possible. - -Current workflows mainly target: - -- **Container images** (build, scan and push to GHCR), -- **Helm charts** (lint, test, secure, document and publish). - ---- - -## Table of contents - -- [Overview](#overview) -- [Available reusable workflows](#available-reusable-workflows) - - [Container Images workflow](#container-images-workflow) - - [Helm Charts workflow](#helm-charts-workflow) -- [How to call a reusable workflow](#how-to-call-a-reusable-workflow) -- [Branching, versions and environments](#branching-versions-and-environments) -- [Contributing](#contributing) -- [License](#license) - ---- - -## Overview - -All workflows are stored under: - -```text -.github/workflows/ -``` - -You **do not copy** these YAML files into your own repositories. -Instead, your project **calls them as reusable workflows** using the `uses:` syntax described in the GitHub Actions documentation. - -This repository is meant to be used across all AP‑HP GitHub projects that need a **standard CI pipeline** for: - -- building and scanning Docker images, -- validating, scanning and releasing Helm charts. - ---- - -## Available reusable workflows - -Below is an overview of the main families of workflows currently documented. - -### Container Images workflow - -#### Description - -Provides **security and quality checks** for container images before pushing them to your project’s **GitHub Container Registry (GHCR)**. - -Typical use cases: - -- container images for applications (e.g. APIs, frontends, backends), -- base or runtime images (e.g. Jupyter EDS notebooks images), -- internal utilities or tools. - -#### Tools - -The workflow chains several tools: - -- **Hadolint** - - Linting of `Dockerfile` (style, best practices, common pitfalls). -- **Buildx** - - Docker image build (supports advanced features like build kits, multi‑arch, extra build args…). -- **Dockle** - - Image scan for misconfigurations and bad patterns. -- **Trivy** - - Vulnerability scanning of images. - - License scanning of included dependencies. -- **Docker / GHCR** - - Push of validated images to your project’s GHCR repository. - -#### Reports - -All tools that support it produce **SARIF reports**, automatically uploaded to your repository: - -- GitHub UI: `Security` tab → `Code scanning` section. -- You can browse findings by tool, severity, and impacted files. - -#### Prerequisites - -- Works **out of the box for public repositories**. -- For **private repositories**, you may need to: - - adjust **Actions permissions** so the workflow can push to your private GHCR, - - ensure the workflow can **write packages** (GHCR). - -> The exact permission model may depend on your organization policies; coordinate with your AP‑HP GitHub admins if needed. - -#### Inputs - -Inputs currently supported by the container images workflow: - -| Input | Type | Required | Default | Description | -|---------------------------:|:------:|:--------:|:------------------:|-------------| -| `dockerfile-path` | string | No | `Dockerfile` | Path to the Dockerfile of your project. | -| `hadolint-ignore` | string | No | `""` | Comma‑separated list of **Hadolint rule IDs** to ignore in **blocking** checks. Findings still appear in reports. | -| `image-name` | string | **Yes** | – | Full image name including registry and repository, e.g. `ghcr.io/aphp/my-service`. | -| `image-custom-tag` | string | No | `""` | Custom tag added **in addition** to automatically generated tags. Typical values: `x86_64-ubuntu-24.04`, `x86_64-ubuntu-24.04-dev`, `nightly`. | -| `extra-build-args` | string | No | `""` | Extra Docker build arguments, provided as `KEY=VALUE`. Usually passed as a multiline YAML scalar (one `KEY=VALUE` per line). | -| `dockle-ignore` | string | No | `""` | Comma‑separated list of **Dockle rule IDs** to ignore in **blocking** checks. | -| `dockle-accept-file` | string | No | `""` | Comma‑separated list of file names to accept in Dockle (`--accept-file`). | -| `dockle-accept-key` | string | No | `""` | Comma‑separated list of keys to accept in Dockle (`--accept-key`). | -| `trivy-ignore-vuln-ids` | string | No | `""` | List of vulnerability IDs (`CVE-…`, `GHSA-…`, `AVD-…`) to ignore for **blocking** Trivy checks. Can be comma‑separated or one per line. | -| `trivy-ignore-license-ids`| string | No | `""` | List of license identifiers (e.g. `GPL-3.0-only`, `MIT`) to ignore in **blocking** Trivy license checks. Can be comma‑separated or one per line. | - -Always refer to the workflow file in `.github/workflows/` for the most up‑to‑date list of inputs and defaults. - -#### Release management - -The workflow relies on a combination of actions and steps to handle **image tagging and publishing**: - -- During the build step, tags are computed according to **Docker Metadata Action** rules. -- If all scans pass successfully: - - the previously tagged image is pushed to your project’s GHCR repository. - -This behavior directly impacts your **release and tagging strategy**; make sure to align it with your project’s lifecycle (branching model, tags, environments). - ---- - -### Helm Charts workflow - -#### Description - -Provides **security and quality checks for Helm charts**, and automates **publishing** to a Helm repository hosted via your project’s GitHub Pages (`gh-pages` branch). - -Typical use cases: - -- Helm charts for applications like **HELIX**, **REDCap**, etc., -- any Kubernetes deployment managed via Helm within AP‑HP projects. - -#### Tools - -The Helm charts workflow is organized by job: - -- **Linting (`lint-test` job)** - - `ct lint` (Helm chart-testing), - - `kubeconform` (Kubernetes manifest validation against schemas). - -- **Security (`lint-test` job)** - - **Polaris** (configuration and security best practices), - - **Trivy** (vulnerability scanning on rendered manifests). - -- **Documentation (`generate-doc` job)** - - **helm-docs** (README / values documentation from chart), - - **Values schema JSON** generation (for validation and tooling). - -- **Publishing (`release` job)** - - **helm/chart-releaser** to package charts and update the Helm index. - -#### Reports - -Some tools (currently **Trivy**) generate **SARIF reports**, uploaded to: - -- `Security` tab → `Code scanning`. - -This allows you to track vulnerabilities and security issues directly in GitHub. - -#### Prerequisites - -To be able to **publish charts** and use the repository as a **Helm repository**, ensure: - -1. A branch named `gh-pages` exists in your repository. -2. In your repository **Settings**: - - `Code and automation / Pages` → `Branch`: select `gh-pages`. -3. In **Settings → Actions → General**: - - `Actions permissions`: set to **Allow all actions and reusable workflows**. - - `Workflow permissions`: set to **Read and write permissions**. -4. Your chart lives under a `charts` directory at the repository root: - - ```text - charts/ - mychart/ - Chart.yaml - values.yaml - templates/... - ``` - -#### Inputs - -Inputs currently supported by the Helm charts workflow: - -| Input | Type | Required | Default | Description | -|--------------------:|:------:|:--------:|:---------------------:|-------------| -| `chart-dir` | string | **Yes** | `chart` | Directory containing your Helm chart (must contain a `Chart.yaml`). | -| `chart-values` | string | No | `chart/values.yaml` | Values file used for `kubeconform`, Polaris, Trivy and `ct install` tests. | -| `kubernetes-version`| string| No | `1.24.2` | Target Kubernetes version used by kubeconform and Trivy for validations and scans. | - -Again, always check the workflow file in `.github/workflows/` for the authoritative list of inputs. - -#### Release management - -Chart releases are handled via the **Helm CR action**, with behavior depending on the branch: - -- On **`feature` branch**: - - Chart version in `Chart.yaml` is suffixed with `-snapshot`, - - A Git tag is created with this snapshot version, - - A **Release** is created containing the snapshot chart archive, - - `index.yaml` in the `gh-pages` branch is updated to reference the new **snapshot** chart. - -- On **`dev` branch**: - - Chart version in `Chart.yaml` is suffixed with `-dev`, - - A Git tag is created with this dev version, - - A **Release** is created containing the dev chart archive, - - `index.yaml` in the `gh-pages` branch is updated to reference the new **dev** chart. - -- On **`main` branch**: - - A Git tag is created with the chart version from `Chart.yaml`, - - A **Release** is created with the chart archive, marked as **latest**, - - `index.yaml` in `gh-pages` is updated to reference the new **stable** chart. - -This gives you a standard separation between **snapshot**,**dev** and **stable** releases for Helm charts. - ---- - -## How to call a reusable workflow - -To use one of these workflows from another repository: - -1. Create a workflow file in your project, e.g.: - - ```text - .github/workflows/container-ci.yml - ``` - -2. In that file, define a job that **uses** one of the workflows from this repo: - - ```yaml - name: Container CI - - on: - push: - branches: [ main, dev ] - pull_request: - - permissions: - contents: write - security-events: write - - jobs: - container-ci: - uses: aphp/ci-workflows/.github/workflows/.yml@main - with: - image-name: ghcr.io/aphp/my-service - dockerfile-path: Dockerfile - image-custom-tag: x86_64-ubuntu-24.04 - ``` - -3. For Helm charts, a similar pattern applies: - - ```yaml - name: Helm Chart CI - - on: - push: - branches: [ main, dev ] - pull_request: - - permissions: - contents: write - security-events: write - - jobs: - helm-ci: - uses: aphp/ci-workflows/.github/workflows/.yml@main - with: - chart-dir: charts/mychart - chart-values: charts/mychart/values.yaml - kubernetes-version: "1.24.2" - ``` - -> Replace `.yml` and `.yml` with the actual filenames from this repository’s `.github/workflows` directory. - -For a concrete example of usage, you can refer to a project CI configuration that calls these workflows (e.g. container image or Helm chart repositories within the AP‑HP GitHub organization). - ---- - -## Branching, versions and environments - -This repository is versioned like any other Git repository: - -- **Branches** such as `feature`, `dev` or `main` represent the maturity of workflows. -- In your consuming projects, you should: - - Prefer **tags** (once defined) for stable usage, e.g. `@v1`, - - Use the `dev` branch (`@dev`) when experimenting or adopting new features early. - -*note: `feature` name is the name of your branch created from Issue.* - -Examples: - -- Stable usage (recommended when available): - - ```yaml - uses: aphp/ci-workflows/.github/workflows/.yml@v1 - ``` - -- Development usage (bleeding edge): - - ```yaml - uses: aphp/ci-workflows/.github/workflows/.yml@dev - ``` - -Coordinate with the AP‑HP CI maintainers to know which refs are recommended for production usage. - ---- - -## Contributing - -Contributions, bug reports and improvement ideas are welcome. - -- See [`CONTRIBUTING.md`](CONTRIBUTING.md) for: - - coding standards, - - how to run tests/linters locally, - - the release workflow for this repository. -- Use **GitHub Issues** to: - - report problems with existing workflows, - - request new reusable workflows, - - ask for documentation improvements. - -Before opening a pull request: - -1. Check there is an existing issue (or open a new one) describing the change. -2. Update or add documentation for new inputs/behavior. -3. Run relevant tests or dry‑runs for the workflows you modify. - ---- - -## License - -This project is licensed under the **Apache License 2.0**. - -- See [`LICENSE`](LICENSE) for details. - -By contributing to this repository, you agree that your contributions will be licensed under the same terms. +# APHP CI GitHub Reusable Workflows + +This repository hosts a collection of **reusable GitHub Actions workflows** for AP‑HP projects. + +The goal is to **centralize CI/CD best practices** (linting, security scans, packaging and publishing) so that each project can: + +- reuse the same, opinionated workflows, +- get consistent quality and security checks, +- keep CI configuration as small as possible. + +Current workflows mainly target: + +- **Container images** (build, scan and push to GHCR), +- **Helm charts** (lint, test, secure, document and publish). + +--- + +## Table of contents + +- [Overview](#overview) +- [Available reusable workflows](#available-reusable-workflows) + - [Container Images workflow](#container-images-workflow) + - [Helm Charts workflow](#helm-charts-workflow) +- [How to call a reusable workflow](#how-to-call-a-reusable-workflow) +- [Branching, versions and environments](#branching-versions-and-environments) +- [Contributing](#contributing) +- [License](#license) + +--- + +## Overview + +All workflows are stored under: + +```text +.github/workflows/ +``` + +You **do not copy** these YAML files into your own repositories. +Instead, your project **calls them as reusable workflows** using the `uses:` syntax described in the GitHub Actions documentation. + +This repository is meant to be used across all AP‑HP GitHub projects that need a **standard CI pipeline** for: + +- building and scanning Docker images, +- validating, scanning and releasing Helm charts. + +--- + +## Available reusable workflows + +Below is an overview of the main families of workflows currently documented. + +### Container Images workflow + +#### Description + +Provides **security and quality checks** for container images before pushing them to your project’s **GitHub Container Registry (GHCR)**. + +Typical use cases: + +- container images for applications (e.g. APIs, frontends, backends), +- base or runtime images (e.g. Jupyter EDS notebooks images), +- internal utilities or tools. + +#### Tools + +The workflow chains several tools: + +- **Hadolint** + - Linting of `Dockerfile` (style, best practices, common pitfalls). +- **Buildx** + - Docker image build (supports advanced features like build kits, multi‑arch, extra build args…). +- **Dockle** + - Image scan for misconfigurations and bad patterns. +- **Trivy** + - Vulnerability scanning of images. + - License scanning of included dependencies. +- **Docker / GHCR** + - Push of validated images to your project’s GHCR repository. + +#### Reports + +All tools that support it produce **SARIF reports**, automatically uploaded to your repository: + +- GitHub UI: `Security` tab → `Code scanning` section. +- You can browse findings by tool, severity, and impacted files. + +#### Prerequisites + +- Works **out of the box for public repositories**. +- For **private repositories**, you may need to: + - adjust **Actions permissions** so the workflow can push to your private GHCR, + - ensure the workflow can **write packages** (GHCR). + +> The exact permission model may depend on your organization policies; coordinate with your AP‑HP GitHub admins if needed. + +#### Inputs + +Inputs currently supported by the container images workflow: + +| Input | Type | Required | Default | Description | +|---------------------------:|:------:|:--------:|:------------------:|-------------| +| `dockerfile-path` | string | No | `Dockerfile` | Path to the Dockerfile of your project. | +| `hadolint-ignore` | string | No | `""` | Comma‑separated list of **Hadolint rule IDs** to ignore in **blocking** checks. Findings still appear in reports. | +| `image-name` | string | **Yes** | – | Full image name including registry and repository, e.g. `ghcr.io/aphp/my-service`. | +| `image-custom-tag` | string | No | `""` | Custom tag added **in addition** to automatically generated tags. Typical values: `x86_64-ubuntu-24.04`, `x86_64-ubuntu-24.04-dev`, `nightly`. | +| `extra-build-args` | string | No | `""` | Extra Docker build arguments, provided as `KEY=VALUE`. Usually passed as a multiline YAML scalar (one `KEY=VALUE` per line). | +| `dockle-ignore` | string | No | `""` | Comma‑separated list of **Dockle rule IDs** to ignore in **blocking** checks. | +| `dockle-accept-file` | string | No | `""` | Comma‑separated list of file names to accept in Dockle (`--accept-file`). | +| `dockle-accept-key` | string | No | `""` | Comma‑separated list of keys to accept in Dockle (`--accept-key`). | +| `trivy-ignore-vuln-ids` | string | No | `""` | List of vulnerability IDs (`CVE-…`, `GHSA-…`, `AVD-…`) to ignore for **blocking** Trivy checks. Can be comma‑separated or one per line. | +| `trivy-ignore-license-ids`| string | No | `""` | List of license identifiers (e.g. `GPL-3.0-only`, `MIT`) to ignore in **blocking** Trivy license checks. Can be comma‑separated or one per line. | + +Always refer to the workflow file in `.github/workflows/` for the most up‑to‑date list of inputs and defaults. + +#### Release management + +The workflow relies on a combination of actions and steps to handle **image tagging and publishing**: + +- During the build step, tags are computed according to **Docker Metadata Action** rules. +- If all scans pass successfully: + - the previously tagged image is pushed to your project’s GHCR repository. + +This behavior directly impacts your **release and tagging strategy**; make sure to align it with your project’s lifecycle (branching model, tags, environments). + +--- + +### Helm Charts workflow + +#### Description + +Provides **security and quality checks for Helm charts**, and automates **publishing** to a Helm repository hosted via your project’s GitHub Pages (`gh-pages` branch). + +Typical use cases: + +- Helm charts for applications like **HELIX**, **REDCap**, etc., +- any Kubernetes deployment managed via Helm within AP‑HP projects. + +#### Tools + +The Helm charts workflow is organized by job: + +- **Linting (`lint-test` job)** + - `ct lint` (Helm chart-testing), + - `kubeconform` (Kubernetes manifest validation against schemas). + +- **Security (`lint-test` job)** + - **Polaris** (configuration and security best practices), + - **Trivy** (vulnerability scanning on rendered manifests). + +- **Documentation (`generate-doc` job)** + - **helm-docs** (README / values documentation from chart), + - **Values schema JSON** generation (for validation and tooling). + +- **Publishing (`release` job)** + - **helm/chart-releaser** to package charts and update the Helm index. + +#### Reports + +Some tools (currently **Trivy**) generate **SARIF reports**, uploaded to: + +- `Security` tab → `Code scanning`. + +This allows you to track vulnerabilities and security issues directly in GitHub. + +#### Prerequisites + +To be able to **publish charts** and use the repository as a **Helm repository**, ensure: + +1. A branch named `gh-pages` exists in your repository. +2. In your repository **Settings**: + - `Code and automation / Pages` → `Branch`: select `gh-pages`. +3. In **Settings → Actions → General**: + - `Actions permissions`: set to **Allow all actions and reusable workflows**. + - `Workflow permissions`: set to **Read and write permissions**. +4. Your chart lives under a `charts` directory at the repository root: + + ```text + charts/ + mychart/ + Chart.yaml + values.yaml + templates/... + ``` + +#### Inputs + +Inputs currently supported by the Helm charts workflow: + +| Input | Type | Required | Default | Description | +|--------------------:|:------:|:--------:|:---------------------:|-------------| +| `chart-dir` | string | **Yes** | `chart` | Directory containing your Helm chart (must contain a `Chart.yaml`). | +| `chart-values` | string | No | `chart/values.yaml` | Values file used for `kubeconform`, Polaris, Trivy and `ct install` tests. | +| `kubernetes-version`| string| No | `1.24.2` | Target Kubernetes version used by kubeconform and Trivy for validations and scans. | + +Again, always check the workflow file in `.github/workflows/` for the authoritative list of inputs. + +#### Release management + +Chart releases are handled via the **Helm CR action**, with behavior depending on the branch: + +- On **`feature` branch**: + - Chart version in `Chart.yaml` is suffixed with `-snapshot`, + - A Git tag is created with this snapshot version, + - A **Release** is created containing the snapshot chart archive, + - `index.yaml` in the `gh-pages` branch is updated to reference the new **snapshot** chart. + +- On **`dev` branch**: + - Chart version in `Chart.yaml` is suffixed with `-dev`, + - A Git tag is created with this dev version, + - A **Release** is created containing the dev chart archive, + - `index.yaml` in the `gh-pages` branch is updated to reference the new **dev** chart. + +- On **`main` branch**: + - A Git tag is created with the chart version from `Chart.yaml`, + - A **Release** is created with the chart archive, marked as **latest**, + - `index.yaml` in `gh-pages` is updated to reference the new **stable** chart. + +This gives you a standard separation between **snapshot**,**dev** and **stable** releases for Helm charts. + +--- + +## How to call a reusable workflow + +To use one of these workflows from another repository: + +1. Create a workflow file in your project, e.g.: + + ```text + .github/workflows/container-ci.yml + ``` + +2. In that file, define a job that **uses** one of the workflows from this repo: + + ```yaml + name: Container CI + + on: + push: + branches: [ main, dev ] + pull_request: + + permissions: + contents: write + security-events: write + + jobs: + container-ci: + uses: aphp/ci-workflows/.github/workflows/.yml@main + with: + image-name: ghcr.io/aphp/my-service + dockerfile-path: Dockerfile + image-custom-tag: x86_64-ubuntu-24.04 + ``` + +3. For Helm charts, a similar pattern applies: + + ```yaml + name: Helm Chart CI + + on: + push: + branches: [ main, dev ] + pull_request: + + permissions: + contents: write + security-events: write + + jobs: + helm-ci: + uses: aphp/ci-workflows/.github/workflows/.yml@main + with: + chart-dir: charts/mychart + chart-values: charts/mychart/values.yaml + kubernetes-version: "1.24.2" + ``` + +> Replace `.yml` and `.yml` with the actual filenames from this repository’s `.github/workflows` directory. + +For a concrete example of usage, you can refer to a project CI configuration that calls these workflows (e.g. container image or Helm chart repositories within the AP‑HP GitHub organization). + +--- + +## Branching, versions and environments + +This repository is versioned like any other Git repository: + +- **Branches** such as `feature`, `dev` or `main` represent the maturity of workflows. +- In your consuming projects, you should: + - Prefer **tags** (once defined) for stable usage, e.g. `@v1`, + - Use the `dev` branch (`@dev`) when experimenting or adopting new features early. + +*note: `feature` name is the name of your branch created from Issue.* + +Examples: + +- Stable usage (recommended when available): + + ```yaml + uses: aphp/ci-workflows/.github/workflows/.yml@v1 + ``` + +- Development usage (bleeding edge): + + ```yaml + uses: aphp/ci-workflows/.github/workflows/.yml@dev + ``` + +Coordinate with the AP‑HP CI maintainers to know which refs are recommended for production usage. + +--- + +## Contributing + +Contributions, bug reports and improvement ideas are welcome. + +- See [`CONTRIBUTING.md`](CONTRIBUTING.md) for: + - coding standards, + - how to run tests/linters locally, + - the release workflow for this repository. +- Use **GitHub Issues** to: + - report problems with existing workflows, + - request new reusable workflows, + - ask for documentation improvements. + +Before opening a pull request: + +1. Check there is an existing issue (or open a new one) describing the change. +2. Update or add documentation for new inputs/behavior. +3. Run relevant tests or dry‑runs for the workflows you modify. + +--- + +## License + +This project is licensed under the **Apache License 2.0**. + +- See [`LICENSE`](LICENSE) for details. + +By contributing to this repository, you agree that your contributions will be licensed under the same terms. diff --git a/test/container/Dockerfile b/test/container/Dockerfile new file mode 100644 index 0000000..165e4ae --- /dev/null +++ b/test/container/Dockerfile @@ -0,0 +1,5 @@ +ARG IMAGE=busybox + +FROM ${IMAGE} + + From efd851ac99bf0b0b7256c71a912978f4a7b001e9 Mon Sep 17 00:00:00 2001 From: 7066189 Date: Mon, 27 Jul 2026 13:59:15 +0200 Subject: [PATCH 05/20] revert change on conditional --- .github/workflows/container-ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/container-ci.yml b/.github/workflows/container-ci.yml index 16cc20a..bf50786 100644 --- a/.github/workflows/container-ci.yml +++ b/.github/workflows/container-ci.yml @@ -209,14 +209,14 @@ jobs: category: code-quality - name: Download Dockle - if: inputs.dockle-accept-key != "" || inputs.dockle-accept-file != "" || inputs.dockle-ignore != "" +# if: inputs.dockle-accept-key != "" || inputs.dockle-accept-file != "" || inputs.dockle-ignore != "" run: | curl -sSL "https://github.com/goodwithtech/dockle/releases/download/v0.4.15/dockle_0.4.15_Linux-386.tar.gz" -o dockle.tar.gz tar -xzf dockle.tar.gz sudo mv dockle /usr/local/bin/dockle - name: Run dockle - if: inputs.dockle-accept-key != "" || inputs.dockle-accept-file != "" || inputs.dockle-ignore != "" +# if: inputs.dockle-accept-key != "" || inputs.dockle-accept-file != "" || inputs.dockle-ignore != "" run: | dockle_keys_formater(){ IFS=', ' read -r -a keys_list <<< "$VALUES" && \ formated_keys="" && \ From 41ffd537fdc847de28a0ce91a4cb1e379c011838 Mon Sep 17 00:00:00 2001 From: 7066189 Date: Mon, 27 Jul 2026 14:04:04 +0200 Subject: [PATCH 06/20] Renmae Dockerfile to test --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5c81a8e..98a381e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -51,7 +51,7 @@ jobs: tests-container-ci: uses: "aphp/ci-workflows/.github/workflows/container-ci.yml@main" with: - dockerfile-path: "./test/container/build-notebook.yml" + dockerfile-path: "./test/container/Dockerfile" hadolint-ignore: "DL3008,DL3016" image-name: aphp-busybox image-custom-tag: test From 0f7e697df1c75655886e98d2d10bad59f44edb90 Mon Sep 17 00:00:00 2001 From: 7066189 Date: Mon, 27 Jul 2026 14:07:33 +0200 Subject: [PATCH 07/20] Fix Linter errors --- .github/workflows/chart-ci.yml | 2 +- .github/workflows/ci.yml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/chart-ci.yml b/.github/workflows/chart-ci.yml index e7306ac..c920c03 100644 --- a/.github/workflows/chart-ci.yml +++ b/.github/workflows/chart-ci.yml @@ -1,5 +1,5 @@ +--- name: Chart CI - on: workflow_call: inputs: diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 98a381e..b30f0e4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,9 +19,9 @@ on: default: 'warning' type: choice options: - - info - - warning - - debug + - info + - warning + - debug environment: description: 'Environment to run tests against' type: environment From 6aa6533ad5cca1419dd1c183d7c0f5e6d18b512a Mon Sep 17 00:00:00 2001 From: 7066189 Date: Mon, 27 Jul 2026 14:08:42 +0200 Subject: [PATCH 08/20] Fix yaml linter errors --- .github/workflows/chart-ci.yml | 1 - .github/workflows/ci.yml | 1 - .github/workflows/container-ci.yml | 1 - 3 files changed, 3 deletions(-) diff --git a/.github/workflows/chart-ci.yml b/.github/workflows/chart-ci.yml index c920c03..a1cd1ce 100644 --- a/.github/workflows/chart-ci.yml +++ b/.github/workflows/chart-ci.yml @@ -1,4 +1,3 @@ ---- name: Chart CI on: workflow_call: diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b30f0e4..61186bd 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,4 +1,3 @@ ---- name: CI # Controls when the workflow will run diff --git a/.github/workflows/container-ci.yml b/.github/workflows/container-ci.yml index bf50786..66e8613 100644 --- a/.github/workflows/container-ci.yml +++ b/.github/workflows/container-ci.yml @@ -1,4 +1,3 @@ ---- name: build on: From 95326483bb9c90b686d51760b50664ff7c3cc884 Mon Sep 17 00:00:00 2001 From: 7066189 Date: Mon, 27 Jul 2026 16:53:14 +0200 Subject: [PATCH 09/20] Update test ci to remove image from Docker. --- .github/workflows/chart-ci.yml | 724 +++++++++++------------ .github/workflows/ci.yml | 200 ++++--- .github/workflows/container-ci.yml | 900 ++++++++++++++--------------- 3 files changed, 943 insertions(+), 881 deletions(-) diff --git a/.github/workflows/chart-ci.yml b/.github/workflows/chart-ci.yml index a1cd1ce..6c0823f 100644 --- a/.github/workflows/chart-ci.yml +++ b/.github/workflows/chart-ci.yml @@ -1,362 +1,362 @@ -name: Chart CI -on: - workflow_call: - inputs: - chart-dir: - description: "Directory holding your Chart" - required: true - type: string - default: "chart" - chart-values: - description: "Chart values file that will be used for the testing and scanning steps" - required: false - type: string - default: "chart/values.yaml" - kubernetes-version: - description: "Version of the target Kubernetes cluster the Chart will run on" - required: false - type: string - default: "1.24.2" - - -jobs: - helm-build-chart: - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - - - name: Install Helm - uses: azure/setup-helm@v5 - with: - version: v3.14.4 - - - name: Extract and add Helm repositories - run: | - yq eval -r ' - .dependencies[] - | select(.repository != "oci://*") - | "\(.name) \(.repository)" - ' "${{ inputs.chart-dir }}/Chart.yaml" \ - | while read -r name repo; do - helm repo add "$name" "$repo" - done - - helm repo update - - - name: Install chart dependencies - run: | - helm dependency build ${{ inputs.chart-dir }} - - - name: Generate values schema json - uses: losisin/helm-values-schema-json-action@v2.5.0 - with: - values: ${{ inputs.chart-values }} - output: ${{ inputs.chart-dir }}/values.schema.json - - - name: Helm-docs - uses: losisin/helm-docs-github-action@v1.8.0 - with: - chart-search-root: ${{ inputs.chart-dir }} - values-file: ${{ inputs.chart-values }} - output-file: ${{ inputs.chart-dir }}/README.md - template-files: ${{ inputs.chart-dir }}/README.md.gotpl - sort-values-order: file - - - name: Upload packaged Chart - uses: actions/upload-artifact@v7 - with: - name: packaged-chart - path: ${{ inputs.chart-dir }} - if-no-files-found: error - retention-days: 1 - - - helm-ct-lint: - name: Helm CT - Chart Linting - runs-on: ubuntu-latest - needs: helm-build-chart - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - - - name: Download packaged Chart - uses: actions/download-artifact@v8 - with: - name: packaged-chart - path: ${{ inputs.chart-dir }} - - - name: Set up Helm - uses: azure/setup-helm@v5 - - - name: Set up chart-testing - uses: helm/chart-testing-action@v2.8.0 - - - name: Run ct lint - run: | - ct lint \ - --target-branch ${{ github.event.repository.default_branch }} \ - --chart-dirs ${{ inputs.chart-dir }} - - - kubeconform: - name: Kubeconform - Chart Validation - needs: helm-ct-lint - runs-on: ubuntu-latest - steps: - - name: Download packaged Chart - uses: actions/download-artifact@v8 - with: - name: packaged-chart - path: ${{ inputs.chart-dir }} - - - name: Set up Helm - uses: azure/setup-helm@v5 - with: - version: v3.14.4 - - - name: Setup Helm plugins - run: | - helm plugin install https://github.com/jtyr/kubeconform-helm - - - name: Run Kubeconform check - run: | - helm kubeconform ${{ inputs.chart-dir }} \ - --values ${{ inputs.chart-values }} \ - --schema-location ${{ inputs.chart-dir }}/values.schema.json \ - --output json \ - --kubernetes-version ${{ inputs.kubernetes-version }} \ - --strict \ - --summary - - - polaris: - name: Polaris - Chart Scan - needs: helm-ct-lint - runs-on: ubuntu-latest - steps: - - name: Download packaged Chart - uses: actions/download-artifact@v8 - with: - name: packaged-chart - path: ${{ inputs.chart-dir }} - - - name: Setup Polaris - run: | - mkdir -p .local/bin - curl -s https://api.github.com/repos/FairwindsOps/polaris/releases/latest | \ - jq '.assets[] | select(.name | endswith("linux_amd64.tar.gz"))'.browser_download_url | \ - xargs curl -s -L | \ - tar xvz -C .local/bin polaris - echo "$PWD/.local/bin" >> $GITHUB_PATH - - - name: Configure Polaris - run: | - echo "checks:" > $PWD/polaris_config.yaml - echo " sensitiveContainerEnvVar: warning" >> $PWD/polaris_config.yaml - - - name: Run chart-testing (polaris) - run: | - polaris audit \ - --config=$PWD/polaris_config.yaml \ - --only-show-failed-tests \ - --set-exit-code-below-score=80 \ - --set-exit-code-on-danger=true \ - --helm-chart ${{ inputs.chart-dir }} \ - --helm-values ${{ inputs.chart-values }} \ - --format=pretty \ - --color=true - - - trivy: - name: Trivy - Chart Vulnerability Scan - needs: helm-ct-lint - runs-on: ubuntu-latest - steps: - - name: Download packaged Chart - uses: actions/download-artifact@v8 - with: - name: packaged-chart - path: ${{ inputs.chart-dir }} - - - name: Build Trivy Vulnerability report - uses: aquasecurity/trivy-action@v0.36.0 - env: - TRIVY_HELM_KUBE_VERSION: ${{ inputs.kubernetes-version }} - TRIVY_HELM_SET_FILE: ${{ inputs.chart-values }} - with: - scan-type: 'config' - exit-code: '0' - ignore-unfixed: false - severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL' - format: 'sarif' - output: 'trivy-vuln-results.sarif' - - - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v4 - with: - sarif_file: 'trivy-vuln-results.sarif' - - - name: Run Trivy Vulnerability scan - uses: aquasecurity/trivy-action@v0.36.0 - env: - TRIVY_HELM_KUBE_VERSION: ${{ inputs.kubernetes-version }} - TRIVY_HELM_SET_FILE: ${{ inputs.chart-values }} - TRIVY_FORMAT: 'table' - TRIVY_OUTPUT: '' - with: - scan-type: 'config' - exit-code: '1' - ignore-unfixed: true - severity: 'CRITICAL' - - - helm-ct-test: - name: Helm CT - Chart Testing - runs-on: ubuntu-latest - needs: - - kubeconform - - polaris - - trivy - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - - - name: Download packaged Chart - uses: actions/download-artifact@v8 - with: - name: packaged-chart - path: ${{ inputs.chart-dir }} - - - name: Set up Helm - uses: azure/setup-helm@v5 - with: - version: v3.14.4 - - - name: Set up chart-testing - uses: helm/chart-testing-action@v2.8.0 - - - name: Run chart-testing (list-changed) - id: list-changed - run: | - changed=$(ct list-changed --target-branch ${{ github.event.repository.default_branch }}) - if [[ -n "$changed" ]]; then - echo "changed=true" >> "$GITHUB_OUTPUT" - fi - - - name: Create kind cluster - if: steps.list-changed.outputs.changed == 'true' - uses: helm/kind-action@v1.10.0 - - - name: Run chart-testing (install) - if: steps.list-changed.outputs.changed == 'true' - run: | - ct install \ - --target-branch ${{ github.event.repository.default_branch }} \ - --chart-dirs ${{ inputs.chart-dir }} \ - --helm-extra-args "-f ${{ inputs.chart-values }}" - - - helm-chart-releaser: - needs: helm-ct-test - name: Helm CR - Chart Release - runs-on: ubuntu-latest - permissions: - contents: write - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - - # ### Release steps specific to `feature` branch ### - - name: Add release suffix - SNAPSHOT - if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' - run: | - VERSION_SUFFIX="-snapshot-$(git rev-parse --short ${{ github.sha }})" \ - yq -i '.version |= . + env(VERSION_SUFFIX)' ${{ inputs.chart-dir }}/Chart.yaml - - ### Release steps specific to `dev` branch ### - - name: Add release suffix - DEV - if: github.ref == 'refs/heads/dev' - run: | - VERSION_SUFFIX="-dev-$(git rev-parse --short ${{ github.sha }})" \ - yq -i '.version |= . + env(VERSION_SUFFIX)' ${{ inputs.chart-dir }}/Chart.yaml - - - name: Package chart - run: | - helm package ${{ inputs.chart-dir }} -d .cr-release-packages/ - - # ### Prepare release variables ### - - name: Prepare release variables - id: prepare-release - run: | - git fetch origin gh-pages - name=$(git show origin/gh-pages:index.yaml | yq e '.entries | keys | .[0]' 2>/dev/null || echo " ??? ") - - VERSION=$(yq '.version' ${{ inputs.chart-dir }}/Chart.yaml) - - TAG_NAME="${name}-${VERSION}" - - echo "TAG_NAME=$TAG_NAME" >> $GITHUB_OUTPUT - echo "VERSION=$VERSION" >> $GITHUB_OUTPUT - - # ### Release steps specific to `feature` or `dev` branch ### - - name: Create GitHub pre-release + tag - if: github.ref != 'refs/heads/main' - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: | - gh release create "${{ steps.prepare-release.outputs.TAG_NAME }}" \ - .cr-release-packages/*.tgz \ - --prerelease \ - --title "${{ steps.prepare-release.outputs.TAG_NAME }}" \ - --target ${{ github.sha}} \ - --notes "Version from ${{ github.ref_name }}" \ - -F CHANGELOG.md - - # ### Release steps specific to `main` branch ### - - name: Create GitHub release + tag - if: github.ref == 'refs/heads/main' - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: | - gh release create "${{ steps.prepare-release.outputs.TAG_NAME }}" \ - .cr-release-packages/*.tgz \ - --latest \ - --target ${{ github.sha}} \ - --title "${{ steps.prepare-release.outputs.TAG_NAME }}" \ - --notes "Version from ${{ github.ref_name }}" \ - -F CHANGELOG.md - - - name: Update index.yaml on gh-pages - env: - CR_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: | - git config user.name "$GITHUB_ACTOR" - git config user.email "$GITHUB_ACTOR@users.noreply.github.com" - - # Get gh-pages - git fetch origin gh-pages - mkdir -p .cr-index - git show origin/gh-pages:index.yaml > .cr-index/index.yaml 2>/dev/null || echo "apiVersion: v1\nentries: {}" > .cr-index/index.yaml - - echo "Merge index.yaml with new chart version..." - helm repo index .cr-index \ - --url https://${{ github.repository_owner }}.github.io/${{ github.event.repository.name }} \ - --merge .cr-index/index.yaml - - args=(-o "${{ github.repository_owner }}" -r "${{ github.event.repository.name }}" --push) - - echo "Installing chart-releaser on $install_dir..." - curl -sSLo cr.tar.gz "https://github.com/helm/chart-releaser/releases/download/v1.8.1/chart-releaser_1.8.1_linux_amd64.tar.gz" - tar -xzf cr.tar.gz -C "/usr/local/bin/" - rm -f cr.tar.gz - - cr index "${args[@]}" +name: Chart CI +on: + workflow_call: + inputs: + chart-dir: + description: "Directory holding your Chart" + required: true + type: string + default: "chart" + chart-values: + description: "Chart values file that will be used for the testing and scanning steps" + required: false + type: string + default: "chart/values.yaml" + kubernetes-version: + description: "Version of the target Kubernetes cluster the Chart will run on" + required: false + type: string + default: "1.24.2" + + +jobs: + helm-build-chart: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v6 + with: + fetch-depth: 0 + + - name: Install Helm + uses: azure/setup-helm@v5 + with: + version: v3.14.4 + + - name: Extract and add Helm repositories + run: | + yq eval -r ' + .dependencies[] + | select(.repository != "oci://*") + | "\(.name) \(.repository)" + ' "${{ inputs.chart-dir }}/Chart.yaml" \ + | while read -r name repo; do + helm repo add "$name" "$repo" + done + + helm repo update + + - name: Install chart dependencies + run: | + helm dependency build ${{ inputs.chart-dir }} + + - name: Generate values schema json + uses: losisin/helm-values-schema-json-action@v2.5.0 + with: + values: ${{ inputs.chart-values }} + output: ${{ inputs.chart-dir }}/values.schema.json + + - name: Helm-docs + uses: losisin/helm-docs-github-action@v1.8.0 + with: + chart-search-root: ${{ inputs.chart-dir }} + values-file: ${{ inputs.chart-values }} + output-file: ${{ inputs.chart-dir }}/README.md + template-files: ${{ inputs.chart-dir }}/README.md.gotpl + sort-values-order: file + + - name: Upload packaged Chart + uses: actions/upload-artifact@v7 + with: + name: packaged-chart + path: ${{ inputs.chart-dir }} + if-no-files-found: error + retention-days: 1 + + + helm-ct-lint: + name: Helm CT - Chart Linting + runs-on: ubuntu-latest + needs: helm-build-chart + steps: + - name: Checkout + uses: actions/checkout@v6 + with: + fetch-depth: 0 + + - name: Download packaged Chart + uses: actions/download-artifact@v8 + with: + name: packaged-chart + path: ${{ inputs.chart-dir }} + + - name: Set up Helm + uses: azure/setup-helm@v5 + + - name: Set up chart-testing + uses: helm/chart-testing-action@v2.8.0 + + - name: Run ct lint + run: | + ct lint \ + --target-branch ${{ github.event.repository.default_branch }} \ + --chart-dirs ${{ inputs.chart-dir }} + + + kubeconform: + name: Kubeconform - Chart Validation + needs: helm-ct-lint + runs-on: ubuntu-latest + steps: + - name: Download packaged Chart + uses: actions/download-artifact@v8 + with: + name: packaged-chart + path: ${{ inputs.chart-dir }} + + - name: Set up Helm + uses: azure/setup-helm@v5 + with: + version: v3.14.4 + + - name: Setup Helm plugins + run: | + helm plugin install https://github.com/jtyr/kubeconform-helm + + - name: Run Kubeconform check + run: | + helm kubeconform ${{ inputs.chart-dir }} \ + --values ${{ inputs.chart-values }} \ + --schema-location ${{ inputs.chart-dir }}/values.schema.json \ + --output json \ + --kubernetes-version ${{ inputs.kubernetes-version }} \ + --strict \ + --summary + + + polaris: + name: Polaris - Chart Scan + needs: helm-ct-lint + runs-on: ubuntu-latest + steps: + - name: Download packaged Chart + uses: actions/download-artifact@v8 + with: + name: packaged-chart + path: ${{ inputs.chart-dir }} + + - name: Setup Polaris + run: | + mkdir -p .local/bin + curl -s https://api.github.com/repos/FairwindsOps/polaris/releases/latest | \ + jq '.assets[] | select(.name | endswith("linux_amd64.tar.gz"))'.browser_download_url | \ + xargs curl -s -L | \ + tar xvz -C .local/bin polaris + echo "$PWD/.local/bin" >> $GITHUB_PATH + + - name: Configure Polaris + run: | + echo "checks:" > $PWD/polaris_config.yaml + echo " sensitiveContainerEnvVar: warning" >> $PWD/polaris_config.yaml + + - name: Run chart-testing (polaris) + run: | + polaris audit \ + --config=$PWD/polaris_config.yaml \ + --only-show-failed-tests \ + --set-exit-code-below-score=80 \ + --set-exit-code-on-danger=true \ + --helm-chart ${{ inputs.chart-dir }} \ + --helm-values ${{ inputs.chart-values }} \ + --format=pretty \ + --color=true + + + trivy: + name: Trivy - Chart Vulnerability Scan + needs: helm-ct-lint + runs-on: ubuntu-latest + steps: + - name: Download packaged Chart + uses: actions/download-artifact@v8 + with: + name: packaged-chart + path: ${{ inputs.chart-dir }} + + - name: Build Trivy Vulnerability report + uses: aquasecurity/trivy-action@v0.36.0 + env: + TRIVY_HELM_KUBE_VERSION: ${{ inputs.kubernetes-version }} + TRIVY_HELM_SET_FILE: ${{ inputs.chart-values }} + with: + scan-type: 'config' + exit-code: '0' + ignore-unfixed: false + severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL' + format: 'sarif' + output: 'trivy-vuln-results.sarif' + + - name: Upload Trivy scan results to GitHub Security tab + uses: github/codeql-action/upload-sarif@v4 + with: + sarif_file: 'trivy-vuln-results.sarif' + + - name: Run Trivy Vulnerability scan + uses: aquasecurity/trivy-action@v0.36.0 + env: + TRIVY_HELM_KUBE_VERSION: ${{ inputs.kubernetes-version }} + TRIVY_HELM_SET_FILE: ${{ inputs.chart-values }} + TRIVY_FORMAT: 'table' + TRIVY_OUTPUT: '' + with: + scan-type: 'config' + exit-code: '1' + ignore-unfixed: true + severity: 'CRITICAL' + + + helm-ct-test: + name: Helm CT - Chart Testing + runs-on: ubuntu-latest + needs: + - kubeconform + - polaris + - trivy + steps: + - name: Checkout + uses: actions/checkout@v6 + with: + fetch-depth: 0 + + - name: Download packaged Chart + uses: actions/download-artifact@v8 + with: + name: packaged-chart + path: ${{ inputs.chart-dir }} + + - name: Set up Helm + uses: azure/setup-helm@v5 + with: + version: v3.14.4 + + - name: Set up chart-testing + uses: helm/chart-testing-action@v2.8.0 + + - name: Run chart-testing (list-changed) + id: list-changed + run: | + changed=$(ct list-changed --target-branch ${{ github.event.repository.default_branch }}) + if [[ -n "$changed" ]]; then + echo "changed=true" >> "$GITHUB_OUTPUT" + fi + + - name: Create kind cluster + if: steps.list-changed.outputs.changed == 'true' + uses: helm/kind-action@v1.10.0 + + - name: Run chart-testing (install) + if: steps.list-changed.outputs.changed == 'true' + run: | + ct install \ + --target-branch ${{ github.event.repository.default_branch }} \ + --chart-dirs ${{ inputs.chart-dir }} \ + --helm-extra-args "-f ${{ inputs.chart-values }}" + + + helm-chart-releaser: + needs: helm-ct-test + name: Helm CR - Chart Release + runs-on: ubuntu-latest + permissions: + contents: write + steps: + - name: Checkout + uses: actions/checkout@v6 + with: + fetch-depth: 0 + + # ### Release steps specific to `feature` branch ### + - name: Add release suffix - SNAPSHOT + if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' + run: | + VERSION_SUFFIX="-snapshot-$(git rev-parse --short ${{ github.sha }})" \ + yq -i '.version |= . + env(VERSION_SUFFIX)' ${{ inputs.chart-dir }}/Chart.yaml + + ### Release steps specific to `dev` branch ### + - name: Add release suffix - DEV + if: github.ref == 'refs/heads/dev' + run: | + VERSION_SUFFIX="-dev-$(git rev-parse --short ${{ github.sha }})" \ + yq -i '.version |= . + env(VERSION_SUFFIX)' ${{ inputs.chart-dir }}/Chart.yaml + + - name: Package chart + run: | + helm package ${{ inputs.chart-dir }} -d .cr-release-packages/ + + # ### Prepare release variables ### + - name: Prepare release variables + id: prepare-release + run: | + git fetch origin gh-pages + name=$(git show origin/gh-pages:index.yaml | yq e '.entries | keys | .[0]' 2>/dev/null || echo " ??? ") + + VERSION=$(yq '.version' ${{ inputs.chart-dir }}/Chart.yaml) + + TAG_NAME="${name}-${VERSION}" + + echo "TAG_NAME=$TAG_NAME" >> $GITHUB_OUTPUT + echo "VERSION=$VERSION" >> $GITHUB_OUTPUT + + # ### Release steps specific to `feature` or `dev` branch ### + - name: Create GitHub pre-release + tag + if: github.ref != 'refs/heads/main' + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + gh release create "${{ steps.prepare-release.outputs.TAG_NAME }}" \ + .cr-release-packages/*.tgz \ + --prerelease \ + --title "${{ steps.prepare-release.outputs.TAG_NAME }}" \ + --target ${{ github.sha}} \ + --notes "Version from ${{ github.ref_name }}" \ + -F CHANGELOG.md + + # ### Release steps specific to `main` branch ### + - name: Create GitHub release + tag + if: github.ref == 'refs/heads/main' + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + gh release create "${{ steps.prepare-release.outputs.TAG_NAME }}" \ + .cr-release-packages/*.tgz \ + --latest \ + --target ${{ github.sha}} \ + --title "${{ steps.prepare-release.outputs.TAG_NAME }}" \ + --notes "Version from ${{ github.ref_name }}" \ + -F CHANGELOG.md + + - name: Update index.yaml on gh-pages + env: + CR_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + git config user.name "$GITHUB_ACTOR" + git config user.email "$GITHUB_ACTOR@users.noreply.github.com" + + # Get gh-pages + git fetch origin gh-pages + mkdir -p .cr-index + git show origin/gh-pages:index.yaml > .cr-index/index.yaml 2>/dev/null || echo "apiVersion: v1\nentries: {}" > .cr-index/index.yaml + + echo "Merge index.yaml with new chart version..." + helm repo index .cr-index \ + --url https://${{ github.repository_owner }}.github.io/${{ github.event.repository.name }} \ + --merge .cr-index/index.yaml + + args=(-o "${{ github.repository_owner }}" -r "${{ github.event.repository.name }}" --push) + + echo "Installing chart-releaser on $install_dir..." + curl -sSLo cr.tar.gz "https://github.com/helm/chart-releaser/releases/download/v1.8.1/chart-releaser_1.8.1_linux_amd64.tar.gz" + tar -xzf cr.tar.gz -C "/usr/local/bin/" + rm -f cr.tar.gz + + cr index "${args[@]}" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 61186bd..d093e78 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,69 +1,131 @@ -name: CI - -# Controls when the workflow will run -on: - # Triggers the workflow on push or pull request events but only for the "main" branch - push: - branches-ignore: - - "main" - pull_request: - branches: ["main", "dev"] - - # Allows you to run this workflow manually from the Actions tab - workflow_dispatch: - inputs: - logLevel: - description: 'Log level' - required: true - default: 'warning' - type: choice - options: - - info - - warning - - debug - environment: - description: 'Environment to run tests against' - type: environment - required: true - -# A workflow run is made up of one or more jobs that can run sequentially or in parallel -jobs: - build: - # The type of runner that the job will run on - runs-on: ubuntu-latest - - # Steps represent a sequence of tasks that will be executed as part of the job - steps: - # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it - - uses: actions/checkout@v4 - - name: yaml-lint - uses: ibiqlik/action-yamllint@v3.1.1 - with: - config_data: | - extends: default - rules: - trailing-spaces: - level: warning - line-length: disable # don't bother me with this rule - comments-indentation: disable # don't bother me with this rule - - tests-container-ci: - uses: "aphp/ci-workflows/.github/workflows/container-ci.yml@main" - with: - dockerfile-path: "./test/container/Dockerfile" - hadolint-ignore: "DL3008,DL3016" - image-name: aphp-busybox - image-custom-tag: test - dockle-ignore: "CIS-DI-0010,DKL-DI-0001" - dockle-accept-file: - dockle-accept-key: - extra-build-args: | - KEY_TEST_1=value_test_1 - KEY_TEST_2="value test 2" - - trivy-ignore-vuln-ids: | - CVE-2024-21508 - trivy-ignore-license-ids: | - WTFPL - -# tests-container-chart: +name: CI + +# Controls when the workflow will run +on: + # Triggers the workflow on push or pull request events but only for the "main" branch + push: + branches-ignore: + - "main" + pull_request: + branches: ["main", "dev"] + + # Allows you to run this workflow manually from the Actions tab + workflow_dispatch: + inputs: + logLevel: + description: 'Log level' + required: true + default: 'warning' + type: choice + options: + - info + - warning + - debug + environment: + description: 'Environment to run tests against' + type: environment + required: true + +# A workflow run is made up of one or more jobs that can run sequentially or in parallel +jobs: + build: + # The type of runner that the job will run on + runs-on: ubuntu-latest + + # Steps represent a sequence of tasks that will be executed as part of the job + steps: + # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it + - uses: actions/checkout@v4 + - name: yaml-lint + uses: ibiqlik/action-yamllint@v3.1.1 + with: + config_data: | + extends: default + rules: + trailing-spaces: + level: warning + line-length: disable # don't bother me with this rule + comments-indentation: disable # don't bother me with this rule + + tests-container-ci-with-dockle-accept: + needs: build + uses: "aphp/ci-workflows/.github/workflows/container-ci.yml@main" + with: + dockerfile-path: "./test/container/Dockerfile" + hadolint-ignore: "DL3008,DL3016" + image-name: aphp-busybox + image-custom-tag: test-with-dockle-accept + dockle-ignore: "CIS-DI-0010,DKL-DI-0001" + dockle-accept-file: + dockle-accept-key: | + PHP_SHA256, + PHPIZE_DEPS, + PHP_INI_DIR, + savedAptMark, + PHP_CFLAGS, + PHP_CPPFLAGS, + PHP_VERSION, + PHP_URL, + PHP_LDFLAGS, + s!, + PHP_ASC_URL, + -D_FILE_OFFSET_BITS, + GNUPGHOME, + CFLAGS, + include, + CPPFLAGS, + LDFLAGS, + APT::AutoRemove::RecommendsImportant, + LDFLAGS + extra-build-args: | + KEY_TEST_1=value_test_1 + KEY_TEST_2="value test 2" + trivy-ignore-vuln-ids: | + CVE-2024-21508 + trivy-ignore-license-ids: | + WTFPL + + tests-container-ci-without-dockle-accept: + needs: build + uses: "aphp/ci-workflows/.github/workflows/container-ci.yml@main" + with: + dockerfile-path: "./test/container/Dockerfile" + image-name: aphp-busybox + image-custom-tag: test-without-dockle-accept + extra-build-args: | + KEY_TEST_1=value_test_1 + KEY_TEST_2="value test 2" + trivy-ignore-vuln-ids: | + CVE-2024-21508 + trivy-ignore-license-ids: | + WTFPL + + tests-container-ci-without-dockle-accept-without-trivyignore: + needs: build + uses: "aphp/ci-workflows/.github/workflows/container-ci.yml@main" + with: + dockerfile-path: "./test/container/Dockerfile" + image-name: aphp-busybox + image-custom-tag: test-without-dockle-accept-without-trivyignore + extra-build-args: | + KEY_TEST_1=value_test_1 + KEY_TEST_2="value test 2" + + + clean-up: + needs: tests-container-ci-without-dockle-accept-without-trivyignore, tests-container-ci-without-dockle-accept, tests-container-ci-with-dockle-accept + steps: + - name: Login to GitHub Container Registry + uses: docker/login-action@v4 + with: + registry: ghcr.io + username: ${{github.actor}} + password: ${{secrets.GITHUB_TOKEN}} + + - name: Push Image to GitHub Container Registry + run: | + docker rmi --all-tags aphp-busybox + + + +# tests-container-chart: diff --git a/.github/workflows/container-ci.yml b/.github/workflows/container-ci.yml index 66e8613..076fe18 100644 --- a/.github/workflows/container-ci.yml +++ b/.github/workflows/container-ci.yml @@ -1,450 +1,450 @@ -name: build - -on: - workflow_call: - inputs: - dockerfile-path: - description: "Path to Dockerfile of your project" - required: false - type: string - default: "Dockerfile" - hadolint-ignore: - description: "Comma separated list of Hadolint rules to ignore (for scan only, will still be present in the generated report)" - required: false - default: '' - type: string - image-name: - description: "Image name" - required: true - type: string - image-custom-tag: - description: "Custom image tag, to be added to the ones generated by default" - required: false - default: '' - type: string - extra-build-args: - description: "Extra build args as KEY=VALUE, one per line, in a YAML scalar bloc" - required: false - default: '' - type: string - dockle-ignore: - description: "Comma separated list of Dockle rule IDs to ignore" - required: false - default: '' - type: string - dockle-accept-file: - description: "Comma separated list of filenames to accept (Dockle accept-file)" - required: false - default: '' - type: string - dockle-accept-key: - description: "Comma separated list of keys to accept (Dockle accept-key)" - required: false - default: '' - type: string - trivy-ignore-vuln-ids: - description: | - List of vulnerability IDs (CVE-..., GHSA-..., AVD-...) to ignore in Trivy. - One per line (recommended) or comma-separated. - required: false - default: '' - type: string - trivy-ignore-license-ids: - description: | - List of license IDs to ignore in Trivy (ex: GPL-3.0-only, MIT, Apache-2.0 WITH LLVM-exception). - One per line (recommended) or comma-separated. - required: false - default: '' - type: string - -jobs: - dockerfile-lint: - name: Dockerfile Lint - runs-on: ubuntu-latest - steps: - - name: Checkout code - uses: actions/checkout@v6 - - - name: Build Hadolint report - uses: hadolint/hadolint-action@v3.3.0 - with: - dockerfile: ${{ inputs.dockerfile-path }} - no-fail: true - no-color: true - failure-threshold: ignore - format: sarif - output-file: 'hadolint-report.sarif' - - - name: Upload Hadolint report to GitHub Security tab - uses: github/codeql-action/upload-sarif@v4 - with: - sarif_file: 'hadolint-report.sarif' - category: linting - - - name: Run Hadolint scan - uses: hadolint/hadolint-action@v3.3.0 - with: - dockerfile: ${{ inputs.dockerfile-path }} - ignore: ${{ inputs.hadolint-ignore }} - failure-threshold: warning - format: tty - - - image-build: - name: Image Build - runs-on: ubuntu-latest - needs: dockerfile-lint - steps: - - name: Checkout code - uses: actions/checkout@v6 - with: - fetch-depth: 0 - - - name: Parse build-args - id: args - shell: bash - run: | - { - echo "build-args<> "$GITHUB_OUTPUT" - - - name: Docker meta - id: meta - uses: docker/metadata-action@v6 - env: - DOCKER_METADATA_SHORT_SHA_LENGTH: 7 - with: - # list of Docker images to use as base name for tags - images: | - ${{ inputs.image-name }} - # Generate Docker tags based on the following events/attributes - tags: | - type=schedule - type=ref,event=branch - type=ref,event=pr - type=semver,pattern={{version}} - type=semver,pattern={{major}}.{{minor}} - type=semver,pattern={{major}} - type=sha - type=raw,value=${{ inputs.image-custom-tag }},enable=${{ inputs.image-custom-tag != '' }} - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - - name: Build and export - uses: docker/build-push-action@v6 - # Fixes CIS-DI-0005 - env: - DOCKER_CONTENT_TRUST: '1' - with: - file: ${{ inputs.dockerfile-path }} - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - build-args: | - ${{ steps.args.outputs.build-args }} - push: false - outputs: type=docker,dest=/tmp/container.image.${{ hashFiles(inputs.dockerfile-path) }}.tar - - - name: Upload artifact - uses: actions/upload-artifact@v7 - with: - name: container.image.${{ hashFiles(inputs.dockerfile-path) }} - path: /tmp/container.image.${{ hashFiles(inputs.dockerfile-path) }}.tar - - - image-audit: - name: Image Audit - needs: image-build - runs-on: ubuntu-latest - steps: - - name: Checkout code - uses: actions/checkout@v6 - - - name: Download image tarball - uses: actions/download-artifact@v8 - with: - name: container.image.${{ hashFiles(inputs.dockerfile-path) }} - path: /tmp - - - name: Load image - run: | - TARBALL="/tmp/container.image.${{ hashFiles(inputs.dockerfile-path) }}.tar" - echo "[INFO]: Importing container image from following tarball :" - ls -al "$TARBALL" - docker load --input "$TARBALL" - echo "[INFO]: The following images are now present in the local registry :" - docker image ls -a - - - name: Generate SHORT_SHA - id: short-sha - uses: benjlevesque/short-sha@v3.0 - with: - length: 7 - - - name: Build Dockle report - uses: goodwithtech/dockle-action@v0.4.15 - with: - image: "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" - format: sarif - output: 'dockle-report.sarif' - exit-code: 0 - - - name: Upload Dockle report to GitHub Security tab - uses: github/codeql-action/upload-sarif@v4 - with: - sarif_file: 'dockle-report.sarif' - category: code-quality - - - name: Download Dockle -# if: inputs.dockle-accept-key != "" || inputs.dockle-accept-file != "" || inputs.dockle-ignore != "" - run: | - curl -sSL "https://github.com/goodwithtech/dockle/releases/download/v0.4.15/dockle_0.4.15_Linux-386.tar.gz" -o dockle.tar.gz - tar -xzf dockle.tar.gz - sudo mv dockle /usr/local/bin/dockle - - - name: Run dockle -# if: inputs.dockle-accept-key != "" || inputs.dockle-accept-file != "" || inputs.dockle-ignore != "" - run: | - dockle_keys_formater(){ IFS=', ' read -r -a keys_list <<< "$VALUES" && \ - formated_keys="" && \ - for key in ${keys_list[@]}; do formated_keys="${formated_keys} $ARG $key" ; done && \ - echo "$formated_keys " ;} - - dockle \ - $(VALUES="${{ inputs.dockle-accept-key }}" ARG="--accept-key" dockle_keys_formater) \ - $(VALUES="${{ inputs.dockle-accept-file }}" ARG="--accept-file" dockle_keys_formater) \ - $(VALUES="${{ inputs.dockle-ignore }}" ARG="--ignore" dockle_keys_formater) \ - --exit-code 1 \ - --format json \ - "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" - - image-scan: - name: Image Scan - needs: image-build - runs-on: ubuntu-latest - steps: - - name: Checkout code - uses: actions/checkout@v6 - - - name: Download image tarball - uses: actions/download-artifact@v8 - with: - name: container.image.${{ hashFiles(inputs.dockerfile-path) }} - path: /tmp - - - name: Load image - run: | - TARBALL="/tmp/container.image.${{ hashFiles(inputs.dockerfile-path) }}.tar" - echo "[INFO]: Importing container image from following tarball :" - ls -al "$TARBALL" - docker load --input "$TARBALL" - echo "[INFO]: The following images are now present in the local registry :" - docker image ls -a - - - name: Generate SHORT_SHA - id: short-sha - uses: benjlevesque/short-sha@v3.0 - with: - length: 7 - - - name: Generate Trivy ignore file from inputs - env: - TRIVY_IGNORE_VULN_IDS: ${{ inputs.trivy-ignore-vuln-ids }} - TRIVY_IGNORE_LICENSE_IDS: ${{ inputs.trivy-ignore-license-ids }} - run: | - IGNORE_FILE="ci-trivy-ignore.txt" - echo "# Generated by reusable build workflow" > "$IGNORE_FILE" - - if [ -n "$TRIVY_IGNORE_VULN_IDS" ]; then - echo "" >> "$IGNORE_FILE" - echo "# Vulnerabilities" >> "$IGNORE_FILE" - printf '%s\n' "$TRIVY_IGNORE_VULN_IDS" | tr ',' '\n' >> "$IGNORE_FILE" - fi - - if [ -n "$TRIVY_IGNORE_LICENSE_IDS" ]; then - echo "" >> "$IGNORE_FILE" - echo "# Licenses" >> "$IGNORE_FILE" - printf '%s\n' "$TRIVY_IGNORE_LICENSE_IDS" | tr ',' '\n' >> "$IGNORE_FILE" - fi - - echo "[INFO] Generated $IGNORE_FILE:" - cat "$IGNORE_FILE" - - - name: Generate SBOM (SPDX JSON) - uses: aquasecurity/trivy-action@v0.36.0 - with: - scan-type: 'image' - image-ref: "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" - format: 'spdx-json' - output: 'image-sbom.spdx.json' - exit-code: '0' - - - name: Submit SBOM to GitHub Dependency Graph - uses: advanced-security/spdx-dependency-submission-action@v0.2.0 - with: - filePath: 'image-sbom.spdx.json' - - - name: Build Trivy Vulnerability report - uses: aquasecurity/trivy-action@v0.36.0 - with: - image-ref: "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" - skip-setup-trivy: true - exit-code: '0' - ignore-unfixed: false - scanners: 'vuln,secret' - vuln-type: 'os,library' - severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL' - format: 'sarif' - limit-severities-for-sarif: 'false' - output: 'trivy-vuln-results.sarif' - - - name: Upload Trivy Vulnerability report to GitHub Security tab - uses: github/codeql-action/upload-sarif@v4 - with: - sarif_file: 'trivy-vuln-results.sarif' - category: vulnerability - - - name: Build Trivy License report - uses: aquasecurity/trivy-action@v0.36.0 - with: - image-ref: "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" - skip-setup-trivy: true - exit-code: '0' - ignore-unfixed: false - scanners: 'license' - vuln-type: 'os,library' - severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL' - format: 'sarif' - limit-severities-for-sarif: 'false' - output: 'trivy-license-results.sarif' - - - name: Patch Trivy Vulnerability SARIF rule IDs for GitHub - run: | - python3 <<'PY' - import json - import sys - from pathlib import Path - - max_len = 200 - paths = [Path("trivy-vuln-results.sarif"), Path("trivy-license-results.sarif")] - - for path in paths : - try: - with path.open("r", encoding="utf-8") as f: - sarif = json.load(f) - except FileNotFoundError: - print(f"ERROR: SARIF file not found: {path}") - sys.exit(1) - - total_id_fixed = 0 - total_ruleId_fixed = 0 - - for run in sarif.get("runs", []): - for rule in run.get("tool", {}).get("driver", {}).get("rules", []): - if isinstance(rule.get("id"), str) and len(rule["id"]) > max_len: - rule.setdefault("properties", {})["originalTrivyRuleId"] = rule["id"] - rule["id"] = rule["id"][:max_len] - total_id_fixed += 1 - - for result in run.get("results", []): - if isinstance(result.get("ruleId"), str) and len(result["ruleId"]) > max_len: - result.setdefault("properties", {})["originalTrivyRuleId"] = result["ruleId"] - result["ruleId"] = result["ruleId"][:max_len] - total_ruleId_fixed += 1 - - with path.open("w", encoding="utf-8") as f: - json.dump(sarif, f, ensure_ascii=False, indent=2) - - print("SARIF patched") - print(f"File: {path}") - print(f"id fixed: {total_id_fixed}") - print(f"ruleId fixed: {total_ruleId_fixed}") - PY - - - name: Upload Trivy License report to GitHub Security tab - uses: github/codeql-action/upload-sarif@v4 - with: - sarif_file: 'trivy-license-results.sarif' - category: license - - - name: Run Trivy Vulnerability scan - uses: aquasecurity/trivy-action@v0.36.0 - # Overriding env vars from previous steps for them not to interfere with the scan - env: - TRIVY_FORMAT: 'table' - TRIVY_OUTPUT: '' - with: - image-ref: "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" - skip-setup-trivy: true - exit-code: '1' - ignore-unfixed: true - scanners: 'vuln,secret' - vuln-type: 'os,library' - severity: 'CRITICAL' - format: 'table' - trivyignores: 'ci-trivy-ignore.txt' - - - name: Run Trivy License scan - uses: aquasecurity/trivy-action@v0.36.0 - # Overriding env vars from previous steps for them not to interfere with the scan - env: - TRIVY_FORMAT: 'table' - TRIVY_OUTPUT: '' - with: - image-ref: "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" - skip-setup-trivy: true - exit-code: '1' - ignore-unfixed: true - scanners: 'license' - vuln-type: 'os,library' - severity: 'CRITICAL' - format: 'table' - trivyignores: 'ci-trivy-ignore.txt' - - push-docker-image: - name: Image Push to GHCR - needs: - - image-audit - - image-scan - runs-on: ubuntu-24.04 - steps: - - name: Checkout code - uses: actions/checkout@v6 - - - name: Download image tarball - uses: actions/download-artifact@v8 - with: - name: container.image.${{ hashFiles(inputs.dockerfile-path) }} - path: /tmp - - - name: Load image - run: | - TARBALL="/tmp/container.image.${{ hashFiles(inputs.dockerfile-path) }}.tar" - echo "[INFO]: Importing container image from following tarball :" - ls -al "$TARBALL" - docker load --input "$TARBALL" - echo "[INFO]: The following images are now present in the local registry :" - docker image ls -a - - - name: Login to GitHub Container Registry - uses: docker/login-action@v4 - with: - registry: ghcr.io - username: ${{github.actor}} - password: ${{secrets.GITHUB_TOKEN}} - - - name: Push Image to GitHub Container Registry - run: | - docker push --all-tags ${{ inputs.image-name }} +name: build + +on: + workflow_call: + inputs: + dockerfile-path: + description: "Path to Dockerfile of your project" + required: false + type: string + default: "Dockerfile" + hadolint-ignore: + description: "Comma separated list of Hadolint rules to ignore (for scan only, will still be present in the generated report)" + required: false + default: '' + type: string + image-name: + description: "Image name" + required: true + type: string + image-custom-tag: + description: "Custom image tag, to be added to the ones generated by default" + required: false + default: '' + type: string + extra-build-args: + description: "Extra build args as KEY=VALUE, one per line, in a YAML scalar bloc" + required: false + default: '' + type: string + dockle-ignore: + description: "Comma separated list of Dockle rule IDs to ignore" + required: false + default: '' + type: string + dockle-accept-file: + description: "Comma separated list of filenames to accept (Dockle accept-file)" + required: false + default: '' + type: string + dockle-accept-key: + description: "Comma separated list of keys to accept (Dockle accept-key)" + required: false + default: '' + type: string + trivy-ignore-vuln-ids: + description: | + List of vulnerability IDs (CVE-..., GHSA-..., AVD-...) to ignore in Trivy. + One per line (recommended) or comma-separated. + required: false + default: '' + type: string + trivy-ignore-license-ids: + description: | + List of license IDs to ignore in Trivy (ex: GPL-3.0-only, MIT, Apache-2.0 WITH LLVM-exception). + One per line (recommended) or comma-separated. + required: false + default: '' + type: string + +jobs: + dockerfile-lint: + name: Dockerfile Lint + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v6 + + - name: Build Hadolint report + uses: hadolint/hadolint-action@v3.3.0 + with: + dockerfile: ${{ inputs.dockerfile-path }} + no-fail: true + no-color: true + failure-threshold: ignore + format: sarif + output-file: 'hadolint-report.sarif' + + - name: Upload Hadolint report to GitHub Security tab + uses: github/codeql-action/upload-sarif@v4 + with: + sarif_file: 'hadolint-report.sarif' + category: linting + + - name: Run Hadolint scan + uses: hadolint/hadolint-action@v3.3.0 + with: + dockerfile: ${{ inputs.dockerfile-path }} + ignore: ${{ inputs.hadolint-ignore }} + failure-threshold: warning + format: tty + + + image-build: + name: Image Build + runs-on: ubuntu-latest + needs: dockerfile-lint + steps: + - name: Checkout code + uses: actions/checkout@v6 + with: + fetch-depth: 0 + + - name: Parse build-args + id: args + shell: bash + run: | + { + echo "build-args<> "$GITHUB_OUTPUT" + + - name: Docker meta + id: meta + uses: docker/metadata-action@v6 + env: + DOCKER_METADATA_SHORT_SHA_LENGTH: 7 + with: + # list of Docker images to use as base name for tags + images: | + ${{ inputs.image-name }} + # Generate Docker tags based on the following events/attributes + tags: | + type=schedule + type=ref,event=branch + type=ref,event=pr + type=semver,pattern={{version}} + type=semver,pattern={{major}}.{{minor}} + type=semver,pattern={{major}} + type=sha + type=raw,value=${{ inputs.image-custom-tag }},enable=${{ inputs.image-custom-tag != '' }} + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Build and export + uses: docker/build-push-action@v6 + # Fixes CIS-DI-0005 + env: + DOCKER_CONTENT_TRUST: '1' + with: + file: ${{ inputs.dockerfile-path }} + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + build-args: | + ${{ steps.args.outputs.build-args }} + push: false + outputs: type=docker,dest=/tmp/container.image.${{ hashFiles(inputs.dockerfile-path) }}.tar + + - name: Upload artifact + uses: actions/upload-artifact@v7 + with: + name: container.image.${{ hashFiles(inputs.dockerfile-path) }} + path: /tmp/container.image.${{ hashFiles(inputs.dockerfile-path) }}.tar + + + image-audit: + name: Image Audit + needs: image-build + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v6 + + - name: Download image tarball + uses: actions/download-artifact@v8 + with: + name: container.image.${{ hashFiles(inputs.dockerfile-path) }} + path: /tmp + + - name: Load image + run: | + TARBALL="/tmp/container.image.${{ hashFiles(inputs.dockerfile-path) }}.tar" + echo "[INFO]: Importing container image from following tarball :" + ls -al "$TARBALL" + docker load --input "$TARBALL" + echo "[INFO]: The following images are now present in the local registry :" + docker image ls -a + + - name: Generate SHORT_SHA + id: short-sha + uses: benjlevesque/short-sha@v3.0 + with: + length: 7 + + - name: Build Dockle report + uses: goodwithtech/dockle-action@v0.4.15 + with: + image: "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" + format: sarif + output: 'dockle-report.sarif' + exit-code: 0 + + - name: Upload Dockle report to GitHub Security tab + uses: github/codeql-action/upload-sarif@v4 + with: + sarif_file: 'dockle-report.sarif' + category: code-quality + + - name: Download Dockle +# if: inputs.dockle-accept-key != "" || inputs.dockle-accept-file != "" || inputs.dockle-ignore != "" + run: | + curl -sSL "https://github.com/goodwithtech/dockle/releases/download/v0.4.15/dockle_0.4.15_Linux-386.tar.gz" -o dockle.tar.gz + tar -xzf dockle.tar.gz + sudo mv dockle /usr/local/bin/dockle + + - name: Run dockle +# if: inputs.dockle-accept-key != "" || inputs.dockle-accept-file != "" || inputs.dockle-ignore != "" + run: | + dockle_keys_formater(){ IFS=', ' read -r -a keys_list <<< "$VALUES" && \ + formated_keys="" && \ + for key in ${keys_list[@]}; do formated_keys="${formated_keys} $ARG $key" ; done && \ + echo "$formated_keys " ;} + + dockle \ + $(VALUES="${{ inputs.dockle-accept-key }}" ARG="--accept-key" dockle_keys_formater) \ + $(VALUES="${{ inputs.dockle-accept-file }}" ARG="--accept-file" dockle_keys_formater) \ + $(VALUES="${{ inputs.dockle-ignore }}" ARG="--ignore" dockle_keys_formater) \ + --exit-code 1 \ + --format json \ + "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" + + image-scan: + name: Image Scan + needs: image-build + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v6 + + - name: Download image tarball + uses: actions/download-artifact@v8 + with: + name: container.image.${{ hashFiles(inputs.dockerfile-path) }} + path: /tmp + + - name: Load image + run: | + TARBALL="/tmp/container.image.${{ hashFiles(inputs.dockerfile-path) }}.tar" + echo "[INFO]: Importing container image from following tarball :" + ls -al "$TARBALL" + docker load --input "$TARBALL" + echo "[INFO]: The following images are now present in the local registry :" + docker image ls -a + + - name: Generate SHORT_SHA + id: short-sha + uses: benjlevesque/short-sha@v3.0 + with: + length: 7 + + - name: Generate Trivy ignore file from inputs + env: + TRIVY_IGNORE_VULN_IDS: ${{ inputs.trivy-ignore-vuln-ids }} + TRIVY_IGNORE_LICENSE_IDS: ${{ inputs.trivy-ignore-license-ids }} + run: | + IGNORE_FILE="ci-trivy-ignore.txt" + echo "# Generated by reusable build workflow" > "$IGNORE_FILE" + + if [ -n "$TRIVY_IGNORE_VULN_IDS" ]; then + echo "" >> "$IGNORE_FILE" + echo "# Vulnerabilities" >> "$IGNORE_FILE" + printf '%s\n' "$TRIVY_IGNORE_VULN_IDS" | tr ',' '\n' >> "$IGNORE_FILE" + fi + + if [ -n "$TRIVY_IGNORE_LICENSE_IDS" ]; then + echo "" >> "$IGNORE_FILE" + echo "# Licenses" >> "$IGNORE_FILE" + printf '%s\n' "$TRIVY_IGNORE_LICENSE_IDS" | tr ',' '\n' >> "$IGNORE_FILE" + fi + + echo "[INFO] Generated $IGNORE_FILE:" + cat "$IGNORE_FILE" + + - name: Generate SBOM (SPDX JSON) + uses: aquasecurity/trivy-action@v0.36.0 + with: + scan-type: 'image' + image-ref: "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" + format: 'spdx-json' + output: 'image-sbom.spdx.json' + exit-code: '0' + + - name: Submit SBOM to GitHub Dependency Graph + uses: advanced-security/spdx-dependency-submission-action@v0.2.0 + with: + filePath: 'image-sbom.spdx.json' + + - name: Build Trivy Vulnerability report + uses: aquasecurity/trivy-action@v0.36.0 + with: + image-ref: "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" + skip-setup-trivy: true + exit-code: '0' + ignore-unfixed: false + scanners: 'vuln,secret' + vuln-type: 'os,library' + severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL' + format: 'sarif' + limit-severities-for-sarif: 'false' + output: 'trivy-vuln-results.sarif' + + - name: Upload Trivy Vulnerability report to GitHub Security tab + uses: github/codeql-action/upload-sarif@v4 + with: + sarif_file: 'trivy-vuln-results.sarif' + category: vulnerability + + - name: Build Trivy License report + uses: aquasecurity/trivy-action@v0.36.0 + with: + image-ref: "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" + skip-setup-trivy: true + exit-code: '0' + ignore-unfixed: false + scanners: 'license' + vuln-type: 'os,library' + severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL' + format: 'sarif' + limit-severities-for-sarif: 'false' + output: 'trivy-license-results.sarif' + + - name: Patch Trivy Vulnerability SARIF rule IDs for GitHub + run: | + python3 <<'PY' + import json + import sys + from pathlib import Path + + max_len = 200 + paths = [Path("trivy-vuln-results.sarif"), Path("trivy-license-results.sarif")] + + for path in paths : + try: + with path.open("r", encoding="utf-8") as f: + sarif = json.load(f) + except FileNotFoundError: + print(f"ERROR: SARIF file not found: {path}") + sys.exit(1) + + total_id_fixed = 0 + total_ruleId_fixed = 0 + + for run in sarif.get("runs", []): + for rule in run.get("tool", {}).get("driver", {}).get("rules", []): + if isinstance(rule.get("id"), str) and len(rule["id"]) > max_len: + rule.setdefault("properties", {})["originalTrivyRuleId"] = rule["id"] + rule["id"] = rule["id"][:max_len] + total_id_fixed += 1 + + for result in run.get("results", []): + if isinstance(result.get("ruleId"), str) and len(result["ruleId"]) > max_len: + result.setdefault("properties", {})["originalTrivyRuleId"] = result["ruleId"] + result["ruleId"] = result["ruleId"][:max_len] + total_ruleId_fixed += 1 + + with path.open("w", encoding="utf-8") as f: + json.dump(sarif, f, ensure_ascii=False, indent=2) + + print("SARIF patched") + print(f"File: {path}") + print(f"id fixed: {total_id_fixed}") + print(f"ruleId fixed: {total_ruleId_fixed}") + PY + + - name: Upload Trivy License report to GitHub Security tab + uses: github/codeql-action/upload-sarif@v4 + with: + sarif_file: 'trivy-license-results.sarif' + category: license + + - name: Run Trivy Vulnerability scan + uses: aquasecurity/trivy-action@v0.36.0 + # Overriding env vars from previous steps for them not to interfere with the scan + env: + TRIVY_FORMAT: 'table' + TRIVY_OUTPUT: '' + with: + image-ref: "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" + skip-setup-trivy: true + exit-code: '1' + ignore-unfixed: true + scanners: 'vuln,secret' + vuln-type: 'os,library' + severity: 'CRITICAL' + format: 'table' + trivyignores: 'ci-trivy-ignore.txt' + + - name: Run Trivy License scan + uses: aquasecurity/trivy-action@v0.36.0 + # Overriding env vars from previous steps for them not to interfere with the scan + env: + TRIVY_FORMAT: 'table' + TRIVY_OUTPUT: '' + with: + image-ref: "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" + skip-setup-trivy: true + exit-code: '1' + ignore-unfixed: true + scanners: 'license' + vuln-type: 'os,library' + severity: 'CRITICAL' + format: 'table' + trivyignores: 'ci-trivy-ignore.txt' + + push-docker-image: + name: Image Push to GHCR + needs: + - image-audit + - image-scan + runs-on: ubuntu-24.04 + steps: + - name: Checkout code + uses: actions/checkout@v6 + + - name: Download image tarball + uses: actions/download-artifact@v8 + with: + name: container.image.${{ hashFiles(inputs.dockerfile-path) }} + path: /tmp + + - name: Load image + run: | + TARBALL="/tmp/container.image.${{ hashFiles(inputs.dockerfile-path) }}.tar" + echo "[INFO]: Importing container image from following tarball :" + ls -al "$TARBALL" + docker load --input "$TARBALL" + echo "[INFO]: The following images are now present in the local registry :" + docker image ls -a + + - name: Login to GitHub Container Registry + uses: docker/login-action@v4 + with: + registry: ghcr.io + username: ${{github.actor}} + password: ${{secrets.GITHUB_TOKEN}} + + - name: Push Image to GitHub Container Registry + run: | + docker push --all-tags ${{ inputs.image-name }} From 4a4af6783be350dc1b404c2dd1cf7459f6579957 Mon Sep 17 00:00:00 2001 From: 7066189 Date: Mon, 27 Jul 2026 16:54:16 +0200 Subject: [PATCH 10/20] Fic CI step errors --- .github/workflows/ci.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d093e78..f64d9ce 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -114,6 +114,8 @@ jobs: clean-up: needs: tests-container-ci-without-dockle-accept-without-trivyignore, tests-container-ci-without-dockle-accept, tests-container-ci-with-dockle-accept + # The type of runner that the job will run on + runs-on: ubuntu-latest steps: - name: Login to GitHub Container Registry uses: docker/login-action@v4 From 13f9532ab7e8b9b816906a497c91357c357bf4a9 Mon Sep 17 00:00:00 2001 From: 7066189 Date: Mon, 27 Jul 2026 16:55:52 +0200 Subject: [PATCH 11/20] Fix CI errors --- .github/workflows/ci.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f64d9ce..c977687 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -48,7 +48,7 @@ jobs: comments-indentation: disable # don't bother me with this rule tests-container-ci-with-dockle-accept: - needs: build + needs: [build] uses: "aphp/ci-workflows/.github/workflows/container-ci.yml@main" with: dockerfile-path: "./test/container/Dockerfile" @@ -86,7 +86,7 @@ jobs: WTFPL tests-container-ci-without-dockle-accept: - needs: build + needs: [build] uses: "aphp/ci-workflows/.github/workflows/container-ci.yml@main" with: dockerfile-path: "./test/container/Dockerfile" @@ -113,7 +113,7 @@ jobs: clean-up: - needs: tests-container-ci-without-dockle-accept-without-trivyignore, tests-container-ci-without-dockle-accept, tests-container-ci-with-dockle-accept + needs: [tests-container-ci-without-dockle-accept-without-trivyignore && tests-container-ci-without-dockle-accept, tests-container-ci-with-dockle-accept] # The type of runner that the job will run on runs-on: ubuntu-latest steps: From df91c71abf5fec702d62daf10f8427b68f8740fc Mon Sep 17 00:00:00 2001 From: 7066189 Date: Mon, 27 Jul 2026 16:56:37 +0200 Subject: [PATCH 12/20] Fix dependency steps in CI workflow --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c977687..ffb5649 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -113,7 +113,7 @@ jobs: clean-up: - needs: [tests-container-ci-without-dockle-accept-without-trivyignore && tests-container-ci-without-dockle-accept, tests-container-ci-with-dockle-accept] + needs: [tests-container-ci-without-dockle-accept-without-trivyignore, tests-container-ci-without-dockle-accept, tests-container-ci-with-dockle-accept] # The type of runner that the job will run on runs-on: ubuntu-latest steps: From 209e3d23ba105e65a7aa5eac5d5eb0145fdcefc4 Mon Sep 17 00:00:00 2001 From: 7066189 Date: Mon, 27 Jul 2026 17:15:30 +0200 Subject: [PATCH 13/20] remove duplicate step --- .github/workflows/container-ci.yml | 30 +++++++++++++++++++----------- 1 file changed, 19 insertions(+), 11 deletions(-) diff --git a/.github/workflows/container-ci.yml b/.github/workflows/container-ci.yml index 076fe18..c379442 100644 --- a/.github/workflows/container-ci.yml +++ b/.github/workflows/container-ci.yml @@ -193,19 +193,27 @@ jobs: with: length: 7 - - name: Build Dockle report - uses: goodwithtech/dockle-action@v0.4.15 - with: - image: "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" - format: sarif - output: 'dockle-report.sarif' - exit-code: 0 + # - name: Build Dockle report + # uses: goodwithtech/dockle-action@v0.4.15 + # with: + # image: "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" + # format: sarif + # output: 'dockle-report.sarif' + # exit-code: 0 - - name: Upload Dockle report to GitHub Security tab - uses: github/codeql-action/upload-sarif@v4 + # - name: Upload Dockle report to GitHub Security tab + # uses: github/codeql-action/upload-sarif@v4 + # with: + # sarif_file: 'dockle-report.sarif' + # category: code-quality + + + - name: Login to GitHub Container Registry + uses: docker/login-action@v4 with: - sarif_file: 'dockle-report.sarif' - category: code-quality + registry: ghcr.io + username: ${{github.actor}} + password: ${{secrets.GITHUB_TOKEN}} - name: Download Dockle # if: inputs.dockle-accept-key != "" || inputs.dockle-accept-file != "" || inputs.dockle-ignore != "" From d9fe9a7256d4c08e8be36ef2a84b492e00775be6 Mon Sep 17 00:00:00 2001 From: 7066189 Date: Mon, 27 Jul 2026 17:25:41 +0200 Subject: [PATCH 14/20] fix ignore --- .github/workflows/ci.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ffb5649..f514f1b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -55,7 +55,7 @@ jobs: hadolint-ignore: "DL3008,DL3016" image-name: aphp-busybox image-custom-tag: test-with-dockle-accept - dockle-ignore: "CIS-DI-0010,DKL-DI-0001" + dockle-ignore: "CIS-DI-0010,DKL-DI-0001,CIS-DI-0001" dockle-accept-file: dockle-accept-key: | PHP_SHA256, @@ -92,6 +92,7 @@ jobs: dockerfile-path: "./test/container/Dockerfile" image-name: aphp-busybox image-custom-tag: test-without-dockle-accept + dockle-ignore: "CIS-DI-0010,DKL-DI-0001,CIS-DI-0001" extra-build-args: | KEY_TEST_1=value_test_1 KEY_TEST_2="value test 2" @@ -107,6 +108,7 @@ jobs: dockerfile-path: "./test/container/Dockerfile" image-name: aphp-busybox image-custom-tag: test-without-dockle-accept-without-trivyignore + dockle-ignore: "CIS-DI-0010,DKL-DI-0001,CIS-DI-0001" extra-build-args: | KEY_TEST_1=value_test_1 KEY_TEST_2="value test 2" From 5a9877719d41065ee38dd16e8dcaf43a4c975287 Mon Sep 17 00:00:00 2001 From: 7066189 Date: Mon, 27 Jul 2026 17:34:59 +0200 Subject: [PATCH 15/20] Adddry-run option for testing activity --- .github/workflows/ci.yml | 3 +++ .github/workflows/container-ci.yml | 7 +++++++ 2 files changed, 10 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f514f1b..b52369f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -84,6 +84,7 @@ jobs: CVE-2024-21508 trivy-ignore-license-ids: | WTFPL + dry-run: true tests-container-ci-without-dockle-accept: needs: [build] @@ -100,6 +101,7 @@ jobs: CVE-2024-21508 trivy-ignore-license-ids: | WTFPL + dry-run: true tests-container-ci-without-dockle-accept-without-trivyignore: needs: build @@ -112,6 +114,7 @@ jobs: extra-build-args: | KEY_TEST_1=value_test_1 KEY_TEST_2="value test 2" + dry-run: true clean-up: diff --git a/.github/workflows/container-ci.yml b/.github/workflows/container-ci.yml index c379442..9145ab8 100644 --- a/.github/workflows/container-ci.yml +++ b/.github/workflows/container-ci.yml @@ -56,6 +56,12 @@ on: required: false default: '' type: string + dry-run: + description: | + Run Jobs but donn't push image in Docker registry. + required: false + default: false + type: boolean jobs: dockerfile-lint: @@ -454,5 +460,6 @@ jobs: password: ${{secrets.GITHUB_TOKEN}} - name: Push Image to GitHub Container Registry + if: ${{ !inputs.dry-run }} run: | docker push --all-tags ${{ inputs.image-name }} From 7dfebbaee2ab698bed280627900b392dbc3d1823 Mon Sep 17 00:00:00 2001 From: 7066189 Date: Mon, 27 Jul 2026 17:36:49 +0200 Subject: [PATCH 16/20] Add dry-run in test jobs --- .github/workflows/ci.yml | 16 ---------------- 1 file changed, 16 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b52369f..76c5b1a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -61,22 +61,6 @@ jobs: PHP_SHA256, PHPIZE_DEPS, PHP_INI_DIR, - savedAptMark, - PHP_CFLAGS, - PHP_CPPFLAGS, - PHP_VERSION, - PHP_URL, - PHP_LDFLAGS, - s!, - PHP_ASC_URL, - -D_FILE_OFFSET_BITS, - GNUPGHOME, - CFLAGS, - include, - CPPFLAGS, - LDFLAGS, - APT::AutoRemove::RecommendsImportant, - LDFLAGS extra-build-args: | KEY_TEST_1=value_test_1 KEY_TEST_2="value test 2" From ded24a9c46779d3689e6dbccf4c80f63721cc16e Mon Sep 17 00:00:00 2001 From: 7066189 Date: Mon, 27 Jul 2026 17:39:13 +0200 Subject: [PATCH 17/20] change link tp container.yml --- .github/workflows/ci.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 76c5b1a..c0fe66b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -49,7 +49,7 @@ jobs: tests-container-ci-with-dockle-accept: needs: [build] - uses: "aphp/ci-workflows/.github/workflows/container-ci.yml@main" + uses: "./.github/workflows/container-ci.yml" with: dockerfile-path: "./test/container/Dockerfile" hadolint-ignore: "DL3008,DL3016" @@ -72,7 +72,7 @@ jobs: tests-container-ci-without-dockle-accept: needs: [build] - uses: "aphp/ci-workflows/.github/workflows/container-ci.yml@main" + uses: "./.github/workflows/container-ci.yml" with: dockerfile-path: "./test/container/Dockerfile" image-name: aphp-busybox @@ -89,7 +89,7 @@ jobs: tests-container-ci-without-dockle-accept-without-trivyignore: needs: build - uses: "aphp/ci-workflows/.github/workflows/container-ci.yml@main" + uses: "./.github/workflows/container-ci.yml" with: dockerfile-path: "./test/container/Dockerfile" image-name: aphp-busybox From 69ad66a35968c0ea4b0a2a7d9f79494f0b34fa93 Mon Sep 17 00:00:00 2001 From: 7066189 Date: Mon, 27 Jul 2026 17:48:06 +0200 Subject: [PATCH 18/20] Debug mode --- .github/workflows/ci.yml | 2 +- .github/workflows/container-ci.yml | 22 +++++++--------------- 2 files changed, 8 insertions(+), 16 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c0fe66b..df6686b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -115,7 +115,7 @@ jobs: - name: Push Image to GitHub Container Registry run: | - docker rmi --all-tags aphp-busybox + docker rmi aphp-busybox diff --git a/.github/workflows/container-ci.yml b/.github/workflows/container-ci.yml index 9145ab8..c4ea1a6 100644 --- a/.github/workflows/container-ci.yml +++ b/.github/workflows/container-ci.yml @@ -199,21 +199,6 @@ jobs: with: length: 7 - # - name: Build Dockle report - # uses: goodwithtech/dockle-action@v0.4.15 - # with: - # image: "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" - # format: sarif - # output: 'dockle-report.sarif' - # exit-code: 0 - - # - name: Upload Dockle report to GitHub Security tab - # uses: github/codeql-action/upload-sarif@v4 - # with: - # sarif_file: 'dockle-report.sarif' - # category: code-quality - - - name: Login to GitHub Container Registry uses: docker/login-action@v4 with: @@ -231,6 +216,13 @@ jobs: - name: Run dockle # if: inputs.dockle-accept-key != "" || inputs.dockle-accept-file != "" || inputs.dockle-ignore != "" run: | + + echo "===== Docker images =====" + docker image ls + + echo "===== Inspect =====" + docker image inspect "${{ inputs.image-name }}:sha-${{ steps.short-sha.outputs.sha }}" + dockle_keys_formater(){ IFS=', ' read -r -a keys_list <<< "$VALUES" && \ formated_keys="" && \ for key in ${keys_list[@]}; do formated_keys="${formated_keys} $ARG $key" ; done && \ From 6428e5ec9ba5305ba742422456c5f15563fa9c7b Mon Sep 17 00:00:00 2001 From: 7066189 Date: Tue, 28 Jul 2026 08:55:39 +0200 Subject: [PATCH 19/20] clean up test workflow --- .github/workflows/ci.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index df6686b..d6ecebd 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -115,7 +115,9 @@ jobs: - name: Push Image to GitHub Container Registry run: | - docker rmi aphp-busybox + docker images + docker rmi -f aphp-busybox:test-without-dockle-accept-without-trivyignore aphp-busybox:test-without-dockle-accept aphp-busybox:test-with-dockle-accept + docker images From 335f9d3d49ff3846b7dd739d74d5b315de1a6fb6 Mon Sep 17 00:00:00 2001 From: 7066189 Date: Tue, 28 Jul 2026 09:02:03 +0200 Subject: [PATCH 20/20] Clean last step of TEst Ci Workflow Workflow --- .github/workflows/ci.yml | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d6ecebd..be42afc 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -106,18 +106,9 @@ jobs: # The type of runner that the job will run on runs-on: ubuntu-latest steps: - - name: Login to GitHub Container Registry - uses: docker/login-action@v4 - with: - registry: ghcr.io - username: ${{github.actor}} - password: ${{secrets.GITHUB_TOKEN}} - - - name: Push Image to GitHub Container Registry + - name: End Test Workflow run: | docker images - docker rmi -f aphp-busybox:test-without-dockle-accept-without-trivyignore aphp-busybox:test-without-dockle-accept aphp-busybox:test-with-dockle-accept - docker images