Add aws-profile zsh function #54
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and scan 🕷️📦 | |
| on: | |
| push: | |
| tags: | |
| - 'v*.*.*' | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| env: | |
| REPOSITORY: docker.io/containerscrew/infratools | |
| jobs: | |
| build: | |
| name: build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v3 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Login to Docker Hub | |
| uses: docker/login-action@v3 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_AUTH_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_AUTH_TOKEN }} | |
| # Step to set Docker tag based on the generated GitHub tag | |
| - name: Set container tag | |
| id: set_tag | |
| run: | | |
| # Extract the tag name from the full reference | |
| IMAGE_TAG=$(echo "${{ github.ref }}" | sed 's|.*/||') | |
| echo "IMAGE_TAG=$IMAGE_TAG" >> "$GITHUB_ENV" | |
| - name: Build and push | |
| uses: docker/build-push-action@v6 | |
| with: | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: ${{ env.REPOSITORY }}:latest,${{ env.REPOSITORY }}:${{ env.IMAGE_TAG }} | |
| sec: | |
| name: sec | |
| runs-on: ubuntu-latest | |
| needs: build | |
| steps: | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: '${{env.REPOSITORY}}:${{env.IMAGE_TAG}}' | |
| format: 'sarif' | |
| output: 'trivy-results.sarif' | |
| vuln-type: 'os,library' | |
| ignore-unfixed: false | |
| env: | |
| TRIVY_USERNAME: ${{ secrets.DOCKERHUB_AUTH_USERNAME }} | |
| TRIVY_PASSWORD: ${{ secrets.DOCKERHUB_AUTH_TOKEN }} | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: 'trivy-results.sarif' | |
| changelog: | |
| name: Generate CHANGELOG | |
| needs: | |
| - build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Install git cliff | |
| run: | | |
| rustup default stable | |
| cargo install git-cliff | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set tag | |
| id: set_tag | |
| run: | | |
| # Extract the tag name from the full reference | |
| TAG_NAME=$(echo "${{ github.ref }}" | sed 's|.*/||') | |
| echo "TAG_NAME=$TAG_NAME" >> "$GITHUB_ENV" | |
| - name: Update CHANGELOG.md in main branch | |
| # if: github.ref == 'refs/tags/v*.*.*' | |
| run: | | |
| git checkout main | |
| git pull origin main | |
| git config --global user.name 'containerscrew' | |
| git config --global user.email '[email protected]' | |
| make generate-changelog | |
| git add CHANGELOG.md | |
| git commit -m "Update CHANGELOG.md for release ${{ env.TAG_NAME }}" | |
| git push origin main |