chore: docker login step to avoid docker hub 429 #6
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "PR Security Scan" | ||
|
Check failure on line 1 in .github/workflows/pr-security-scan.yml
|
||
| # This reusable workflow handles security scanning for pull requests | ||
| # - If filter_paths is provided: treats as monorepo and scans changed components | ||
| # - If filter_paths is empty/not provided: treats as single app and scans entire repo | ||
| on: | ||
| workflow_call: | ||
| inputs: | ||
| runner_type: | ||
| description: 'GitHub runner type to use' | ||
| type: string | ||
| default: 'ubuntu-latest' | ||
| filter_paths: | ||
| description: 'Paths to monitor for changes (newline separated). If not provided, treats as single app repo' | ||
| type: string | ||
| required: false | ||
| path_level: | ||
| description: 'Directory depth level to extract app name (only used for monorepo)' | ||
| type: string | ||
| default: '2' | ||
| dockerhub_org: | ||
| description: 'DockerHub organization name' | ||
| type: string | ||
| default: 'lerianstudio' | ||
| docker_registry: | ||
| description: 'Docker registry URL' | ||
| type: string | ||
| default: 'docker.io' | ||
| secrets: | ||
| manage_token: | ||
| description: 'GitHub token for accessing private repositories during Docker build' | ||
| required: false | ||
| docker_username: | ||
| description: 'Docker registry username' | ||
| required: false | ||
| docker_password: | ||
| description: 'Docker registry password' | ||
| required: false | ||
| permissions: | ||
| id-token: write # Required for OIDC authentication | ||
| contents: read # Required to checkout the repository | ||
| pull-requests: write # Allows commenting on PRs | ||
| security-events: write # Required for security scanning | ||
| jobs: | ||
| docker_login: | ||
| runs-on: ${{ inputs.runner_type }} | ||
| steps: | ||
| - name: Login to Docker Registry | ||
| if: secrets.docker_username != '' && secrets.docker_password != '' | ||
| uses: docker/login-action@v3 | ||
| with: | ||
| registry: ${{ inputs.docker_registry }} | ||
| username: ${{ secrets.docker_username }} | ||
| password: ${{ secrets.docker_password }} | ||
| prepare_matrix: | ||
| needs: docker_login | ||
| runs-on: ${{ inputs.runner_type }} | ||
| outputs: | ||
| matrix: ${{ steps.set-matrix.outputs.matrix }} | ||
| steps: | ||
| - name: Get changed paths (monorepo) | ||
| if: inputs.filter_paths != '' | ||
| id: changed-paths | ||
| uses: LerianStudio/github-actions-changed-paths@main | ||
| with: | ||
| filter_paths: |- | ||
| ${{ inputs.filter_paths }} | ||
| get_app_name: true | ||
| path_level: ${{ inputs.path_level }} | ||
| - name: Set matrix | ||
| id: set-matrix | ||
| run: | | ||
| if [ "${{ inputs.filter_paths }}" = "" ]; then | ||
| # Single app mode | ||
| echo 'matrix=[{"name": "${{ github.event.repository.name }}", "working_dir": "."}]' >> $GITHUB_OUTPUT | ||
| else | ||
| # Monorepo mode | ||
| echo 'matrix=${{ steps.changed-paths.outputs.matrix }}' >> $GITHUB_OUTPUT | ||
| fi | ||
| security_scan: | ||
| needs: [docker_login, prepare_matrix] | ||
| if: needs.prepare_matrix.outputs.matrix != '[]' | ||
| runs-on: ${{ inputs.runner_type }} | ||
| strategy: | ||
| max-parallel: 1 | ||
| fail-fast: false | ||
| matrix: | ||
| include: ${{ fromJson(needs.prepare_matrix.outputs.matrix) }} | ||
| env: | ||
| DOCKERHUB_ORG: ${{ inputs.dockerhub_org }} | ||
| APP_NAME: ${{ matrix.name }} | ||
| DOCKERFILE_PATH: ${{ matrix.working_dir == '.' && './Dockerfile' || format('{0}/Dockerfile', matrix.working_dir) }} | ||
| steps: | ||
| - name: Checkout Repository | ||
| uses: actions/checkout@v4 | ||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
| # ----------------- Security Scans ----------------- | ||
| - name: Trivy Secret Scan - Repository (Table Output) | ||
| uses: aquasecurity/trivy-action@0.28.0 | ||
| if: always() | ||
| with: | ||
| scan-type: fs | ||
| scan-ref: . | ||
| format: table | ||
| exit-code: '1' | ||
| hide-progress: true | ||
| security-checks: secret | ||
| skip-dirs: '.git,node_modules,dist,build,.next,coverage,vendor' | ||
| - name: Trivy Secret Scan - Repository (SARIF Output) | ||
| uses: aquasecurity/trivy-action@0.28.0 | ||
| if: always() | ||
| with: | ||
| scan-type: fs | ||
| scan-ref: . | ||
| format: sarif | ||
| output: 'trivy-secret-scan-repo-${{ env.APP_NAME }}.sarif' | ||
| exit-code: '0' | ||
| hide-progress: true | ||
| security-checks: secret | ||
| skip-dirs: '.git,node_modules,dist,build,.next,coverage,vendor' | ||
| - name: Build Docker Image for Scanning | ||
| if: always() | ||
| uses: docker/build-push-action@v5 | ||
| with: | ||
| context: . | ||
| file: ${{ env.DOCKERFILE_PATH }} | ||
| platforms: linux/amd64 | ||
| load: true | ||
| push: false | ||
| tags: ${{ env.DOCKERHUB_ORG }}/${{ env.APP_NAME }}:pr-scan-${{ github.sha }} | ||
| secrets: ${{ secrets.manage_token && format('github_token={0}', secrets.manage_token) || '' }} | ||
| - name: Trivy Vulnerability Scan - Docker Image (Table Output) | ||
| if: always() | ||
| uses: aquasecurity/trivy-action@master | ||
| with: | ||
| image-ref: '${{ env.DOCKERHUB_ORG }}/${{ env.APP_NAME }}:pr-scan-${{ github.sha }}' | ||
| format: 'table' | ||
| ignore-unfixed: true | ||
| vuln-type: 'os,library' | ||
| severity: 'CRITICAL,HIGH' | ||
| exit-code: '0' | ||
| - name: Trivy Vulnerability Scan - Docker Image (SARIF Output) | ||
| if: always() | ||
| uses: aquasecurity/trivy-action@0.28.0 | ||
| with: | ||
| image-ref: '${{ env.DOCKERHUB_ORG }}/${{ env.APP_NAME }}:pr-scan-${{ github.sha }}' | ||
| format: sarif | ||
| output: 'trivy-vulnerability-scan-docker-${{ env.APP_NAME }}.sarif' | ||
| ignore-unfixed: true | ||
| vuln-type: os,library | ||
| severity: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL | ||
| exit-code: '0' # Do not fail; gate failures in the table step | ||
| ## To be fixed | ||
| # - name: Upload Secret Scan Results - Repository (SARIF) to GitHub Security Tab | ||
| # uses: github/codeql-action/upload-sarif@v3 | ||
| # if: always() | ||
| # continue-on-error: true | ||
| # with: | ||
| # sarif_file: 'trivy-secret-scan-repo-${{ env.APP_NAME }}.sarif' | ||
| # - name: Upload Vulnerability Scan Results - Docker Image (SARIF) to GitHub Security Tab | ||
| # uses: github/codeql-action/upload-sarif@v3 | ||
| # if: always() | ||
| # continue-on-error: true | ||
| # with: | ||
| # sarif_file: 'trivy-vulnerability-scan-docker-${{ env.APP_NAME }}.sarif' | ||
