Skip to content

Commit e041c4b

Browse files
joshuafernandesjoshuafernandes
committed
add an action for docker scan and push
1 parent 5523bc3 commit e041c4b

File tree

2 files changed

+266
-0
lines changed

2 files changed

+266
-0
lines changed

‎dockerhub-scan-push/action.yml‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
# SPDX-License-Identifier: Apache-2.0
2+
---
3+
name: 'ecr-scan-push'
4+
description: 'Composite action to build, scan and push a container'
5+
6+
7+
inputs:
8+
DOCKER_CONTEXT_PATH:
9+
description: "the location of the Dockerfile"
10+
required: false
11+
default: "./"
12+
DOCKER_REPO:
13+
description: "the repo of the docker image"
14+
required: true
15+
16+
runs:
17+
using: "composite"
18+
steps:
19+
- name: Checkout tools repo
20+
uses: actions/checkout@v4
21+
with:
22+
repository: Consensys/github-actions
23+
path: .github-actions
24+
25+
- name: set up docker buildx
26+
uses: docker/setup-buildx-action@v3
27+
28+
- name: prep for container
29+
shell: bash
30+
run: |
31+
echo "BUILD_DATE=$(date --rfc-3339=date)" >> ${GITHUB_ENV}
32+
33+
- name: build the container
34+
uses: docker/build-push-action@v6
35+
env:
36+
DOCKER_BUILD_SUMMARY: false
37+
with:
38+
context: ${{ inputs.DOCKER_CONTEXT_PATH }}
39+
platforms: linux/amd64,linux/arm64
40+
provenance: mode=max
41+
sbom: true
42+
push: false
43+
cache-from: type=local,src=/tmp/.buildx-cache
44+
cache-to: type=local,dest=/tmp/.buildx-cache
45+
build-args: |
46+
VCS_REF=${{ github.sha }}
47+
BUILD_DATE=${{ env.BUILD_DATE }}
48+
tags: ${{ inputs.DOCKER_REPO }}:latest
49+
50+
- name: Run Trivy vulnerability scanner
51+
uses: aquasecurity/[email protected]
52+
with:
53+
image-ref: ${{ inputs.DOCKER_REPO }}:latest
54+
format: 'sarif'
55+
output: 'trivy-results.sarif'
56+
vuln-type: 'os,library'
57+
severity: 'CRITICAL,HIGH'
58+
59+
- name: Show Trivy results
60+
shell: bash
61+
run: |
62+
sudo apt-get update -y
63+
sudo apt-get install -y jq
64+
echo "## Trivy findings (CRITICAL/HIGH)" >> "$GITHUB_STEP_SUMMARY"
65+
if [ ! -s trivy-results.sarif ]; then
66+
echo "_No SARIF produced or file is empty._" >> "$GITHUB_STEP_SUMMARY"
67+
exit 0
68+
fi
69+
jq -r '
70+
.runs[].results[]?
71+
| [.ruleId,
72+
(.level|ascii_upcase),
73+
(.message.text|tostring|gsub("\n"; " ")),
74+
(.locations[0].physicalLocation.artifactLocation.uri // "?"),
75+
(.locations[0].physicalLocation.region.startLine // 0)]
76+
| @tsv
77+
' trivy-results.sarif \
78+
| awk -F'\t' '
79+
BEGIN {
80+
print "| Rule | Level | Message | File | Line |";
81+
print "|---|---|---|---|---|";
82+
}
83+
{
84+
# Truncate overly long messages for summary readability
85+
msg=$3; if (length(msg)>180) msg=substr(msg,1,180)"…";
86+
printf("| `%s` | %s | %s | %s | %s |\n", $1, $2, msg, $4, $5);
87+
}
88+
' >> "$GITHUB_STEP_SUMMARY"
89+
90+
- name: push the container
91+
uses: docker/build-push-action@v6
92+
if: success()
93+
env:
94+
DOCKER_BUILD_SUMMARY: false
95+
with:
96+
context: ${{ inputs.DOCKER_CONTEXT_PATH }}
97+
platforms: linux/amd64,linux/arm64
98+
provenance: mode=max
99+
sbom: true
100+
push: true
101+
cache-from: type=local,src=/tmp/.buildx-cache
102+
cache-to: type=local,dest=/tmp/.buildx-cache
103+
build-args: |
104+
VCS_REF=${{ github.sha }}
105+
BUILD_DATE=${{ env.BUILD_DATE }}
106+
tags: |
107+
${{ inputs.DOCKER_REPO }}:${{ env.BUILD_DATE }}
108+
${{ inputs.DOCKER_REPO }}:latest

‎ecr-scan-push/action.yml‎

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
# SPDX-License-Identifier: Apache-2.0
2+
---
3+
name: 'ecr-scan-push'
4+
description: 'Composite action to build, scan and push a container'
5+
6+
7+
inputs:
8+
ECR_ROLE_TO_ASSUME:
9+
description: "the ecr role to assume"
10+
required: true
11+
DOCKER_CONTEXT_PATH:
12+
description: "the location of the Dockerfile"
13+
required: false
14+
default: "./"
15+
DOCKER_REPO:
16+
description: "the repo of the docker image"
17+
required: true
18+
19+
runs:
20+
using: "composite"
21+
steps:
22+
- name: Checkout tools repo
23+
uses: actions/checkout@v4
24+
with:
25+
repository: Consensys/github-actions
26+
path: .github-actions
27+
28+
- name: set up docker buildx
29+
uses: docker/setup-buildx-action@v3
30+
31+
- name: configure aws credentials
32+
uses: aws-actions/configure-aws-credentials@v4
33+
with:
34+
role-to-assume: ${{ inputs.ECR_ROLE_TO_ASSUME }}
35+
role-session-name: ecr-scan-push
36+
role-duration-seconds: 1200
37+
aws-region: us-east-1
38+
39+
- name: login to amazon ecr
40+
id: login-ecr
41+
uses: aws-actions/amazon-ecr-login@v2
42+
43+
- name: prep for container
44+
shell: bash
45+
run: |
46+
echo "BUILD_DATE=$(date --rfc-3339=date)" >> ${GITHUB_ENV}
47+
48+
- name: build the container
49+
uses: docker/build-push-action@v6
50+
env:
51+
DOCKER_BUILD_SUMMARY: false
52+
with:
53+
context: ${{ inputs.DOCKER_CONTEXT_PATH }}
54+
platforms: linux/amd64,linux/arm64
55+
provenance: false
56+
push: false
57+
cache-from: type=local,src=/tmp/.buildx-cache
58+
cache-to: type=local,dest=/tmp/.buildx-cache
59+
build-args: |
60+
VCS_REF=${{ github.sha }}
61+
BUILD_DATE=${{ env.BUILD_DATE }}
62+
tags: ${{ steps.login-ecr.outputs.registry }}${{ inputs.DOCKER_REPO }}:latest
63+
64+
- name: Run Trivy vulnerability scanner
65+
uses: aquasecurity/[email protected]
66+
with:
67+
image-ref: ${{ inputs.DOCKER_REPO }}:latest
68+
format: 'sarif'
69+
output: 'trivy-results.sarif'
70+
vuln-type: 'os,library'
71+
severity: 'CRITICAL,HIGH'
72+
73+
- name: Show Trivy results
74+
shell: bash
75+
run: |
76+
sudo apt-get update -y
77+
sudo apt-get install -y jq
78+
echo "## Trivy findings (CRITICAL/HIGH)" >> "$GITHUB_STEP_SUMMARY"
79+
if [ ! -s trivy-results.sarif ]; then
80+
echo "_No SARIF produced or file is empty._" >> "$GITHUB_STEP_SUMMARY"
81+
exit 0
82+
fi
83+
jq -r '
84+
.runs[].results[]?
85+
| [.ruleId,
86+
(.level|ascii_upcase),
87+
(.message.text|tostring|gsub("\n"; " ")),
88+
(.locations[0].physicalLocation.artifactLocation.uri // "?"),
89+
(.locations[0].physicalLocation.region.startLine // 0)]
90+
| @tsv
91+
' trivy-results.sarif \
92+
| awk -F'\t' '
93+
BEGIN {
94+
print "| Rule | Level | Message | File | Line |";
95+
print "|---|---|---|---|---|";
96+
}
97+
{
98+
# Truncate overly long messages for summary readability
99+
msg=$3; if (length(msg)>180) msg=substr(msg,1,180)"…";
100+
printf("| `%s` | %s | %s | %s | %s |\n", $1, $2, msg, $4, $5);
101+
}
102+
' >> "$GITHUB_STEP_SUMMARY"
103+
104+
# on ecr this doesn't tag the individual images, so we do this 3x (the last two are merely tags)
105+
- name: build and push the combined manifest
106+
uses: docker/build-push-action@v6
107+
if: success()
108+
env:
109+
DOCKER_BUILD_SUMMARY: false
110+
with:
111+
context: ${{ inputs.DOCKER_CONTEXT_PATH }}
112+
platforms: linux/amd64,linux/arm64
113+
provenance: false
114+
push: true
115+
cache-from: type=local,src=/tmp/.buildx-cache
116+
cache-to: type=local,dest=/tmp/.buildx-cache
117+
build-args: |
118+
VCS_REF=${{ github.sha }}
119+
BUILD_DATE=${{ env.BUILD_DATE }}
120+
tags: |
121+
${{ inputs.DOCKER_REPO }}:${{ env.BUILD_DATE }}
122+
${{ inputs.DOCKER_REPO }}:latest
123+
124+
- name: tag the linux/amd64
125+
uses: docker/build-push-action@v6
126+
env:
127+
DOCKER_BUILD_SUMMARY: false
128+
with:
129+
context: ${{ inputs.DOCKER_CONTEXT_PATH }}
130+
platforms: linux/amd64
131+
provenance: false
132+
push: true
133+
cache-from: type=local,src=/tmp/.buildx-cache
134+
cache-to: type=local,dest=/tmp/.buildx-cache
135+
build-args: |
136+
VCS_REF=${{ github.sha }}
137+
BUILD_DATE=${{ env.BUILD_DATE }}
138+
tags: |
139+
${{ inputs.DOCKER_REPO }}:${{ env.BUILD_DATE }}-amd64
140+
${{ inputs.DOCKER_REPO }}:latest-amd64
141+
142+
- name: tag the linux/arm64
143+
uses: docker/build-push-action@v6
144+
env:
145+
DOCKER_BUILD_SUMMARY: false
146+
with:
147+
context: ${{ inputs.DOCKER_CONTEXT_PATH }}
148+
platforms: linux/arm64
149+
provenance: false
150+
push: true
151+
cache-from: type=local,src=/tmp/.buildx-cache
152+
cache-to: type=local,dest=/tmp/.buildx-cache
153+
build-args: |
154+
VCS_REF=${{ github.sha }}
155+
BUILD_DATE=${{ env.BUILD_DATE }}
156+
tags: |
157+
${{ inputs.DOCKER_REPO }}:${{ env.BUILD_DATE }}-arm64
158+
${{ inputs.DOCKER_REPO }}:latest-arm64

0 commit comments

Comments
 (0)