fix: cascaded registry host to inner jobs' stepps

filipeforattini · Aug 10, 2022 · c071c0f · c071c0f
1 parent a09bed5
commit c071c0f
Show file tree

Hide file tree

Showing 9 changed files with 60 additions and 11 deletions.
diff --git a/.github/actions/pack-docker-build/action.yml b/.github/actions/pack-docker-build/action.yml
@@ -22,6 +22,10 @@ inputs:
     description: "Push images"
     required: false
     default: "true"
+  containerRegistry:
+    description: "Image containers registry"
+    required: false
+    default: "true"
 
 runs:
   using: "composite"
@@ -38,6 +42,8 @@ runs:
     - name: Pipeline config scrapper
       id: analysis
       uses: filipeforattini/ff-iac-github-actions/.github/actions/config-scrapper@main
+      with:
+        containerRegistry: ${{inputs.containerRegistry}}
 
     - name: Build and push without cache
       uses: docker/build-push-action@v3

diff --git a/.github/actions/pack-static-code-analysis/action.yml b/.github/actions/pack-static-code-analysis/action.yml
@@ -15,12 +15,22 @@ runs:
   using: "composite"
 
   steps:
+    # GitLeaks
     - name: Run GitLeaks scanner
+      id: gitleaks
       if: inputs.runAnalysis == true
-      uses: docker://opendevsecops/gitleaks
+      uses: DariuszPorowski/github-action-gitleaks@v2
       with:
-        args: --repo=https://github.com/${{github.repository}}
+        report_format: "sarif"
+        fail: false
 
+    - name: Upload Gitleaks SARIF report to code scanning service
+      if: steps.gitleaks.outputs.exitcode == 1
+      uses: github/codeql-action/upload-sarif@v2
+      with:
+        sarif_file: ${{steps.gitleaks.outputs.report}}
+
+    # Trivy
     - name: Run Trivy scanner
       if: inputs.runAnalysis == true
       uses: aquasecurity/trivy-action@master
@@ -37,6 +47,7 @@ runs:
       with:
         sarif_file: 'trivy-results.sarif'
 
+    # OSSAR
     - name: Run OSSAR
       if: inputs.runAnalysis == true
       uses: github/ossar-action@v1
@@ -48,6 +59,7 @@ runs:
       with:
         sarif_file: ${{ steps.ossar.outputs.sarifFile }}
 
+    # CodeQL
     - name: Setup CodeQL for ${{ inputs.language }}
       uses: github/codeql-action/init@v2
       with:

diff --git a/.github/workflows/app.yml b/.github/workflows/app.yml
@@ -298,6 +298,7 @@ jobs:
         with:
           cached: true
           platforms: ${{inputs.platforms}}
+          containerRegistry: ${{inputs.containerRegistry}}
 
 
   #--------------------------------------------------#

diff --git a/.github/workflows/svc.yml b/.github/workflows/svc.yml
@@ -92,6 +92,7 @@ jobs:
         uses: filipeforattini/ff-iac-github-actions/.github/actions/config-scrapper@main
         with:
           writeSummary: true
+          containerRegistry: ${{inputs.containerRegistry}}
 
 
   #--------------------------------------------------#
@@ -335,6 +336,8 @@ jobs:
       - name: Pipeline config scrapper
         id: analysis
         uses: filipeforattini/ff-iac-github-actions/.github/actions/config-scrapper@main
+        with:
+          containerRegistry: ${{inputs.containerRegistry}}
 
       - name: Trigger
         run: |
@@ -374,6 +377,8 @@ jobs:
       - name: Pipeline config scrapper
         id: analysis
         uses: filipeforattini/ff-iac-github-actions/.github/actions/config-scrapper@main
+        with:
+          containerRegistry: ${{inputs.containerRegistry}}
 
       - name: Trigger
         run: |
@@ -413,6 +418,8 @@ jobs:
       - name: Pipeline config scrapper
         id: analysis
         uses: filipeforattini/ff-iac-github-actions/.github/actions/config-scrapper@main
+        with:
+          containerRegistry: ${{inputs.containerRegistry}}
 
       - name: Trigger
         run: |
@@ -454,6 +461,8 @@ jobs:
       - name: Pipeline config scrapper
         id: analysis
         uses: filipeforattini/ff-iac-github-actions/.github/actions/config-scrapper@main
+        with:
+          containerRegistry: ${{inputs.containerRegistry}}
 
       - name: Setup | Dependencies
         uses: filipeforattini/ff-iac-github-actions/.github/actions/setup-binaries@main
@@ -500,6 +509,7 @@ jobs:
         with:
           cached: true
           platforms: ${{inputs.platforms}}
+          containerRegistry: ${{inputs.containerRegistry}}
 
 
   #--------------------------------------------------#
@@ -525,6 +535,8 @@ jobs:
       - name: Pipeline config scrapper
         id: analysis
         uses: filipeforattini/ff-iac-github-actions/.github/actions/config-scrapper@main
+        with:
+          containerRegistry: ${{inputs.containerRegistry}}
 
       - name: Setup | Dependencies
         uses: filipeforattini/ff-iac-github-actions/.github/actions/setup-binaries@main
@@ -570,6 +582,7 @@ jobs:
         with:
           cached: true
           platforms: ${{inputs.platforms}}
+          containerRegistry: ${{inputs.containerRegistry}}
 
 
   #--------------------------------------------------#
@@ -613,6 +626,8 @@ jobs:
       - name: Pipeline config scrapper
         id: analysis
         uses: filipeforattini/ff-iac-github-actions/.github/actions/config-scrapper@main
+        with:
+          containerRegistry: ${{inputs.containerRegistry}}
 
       - name: Config | Version
         id: versioning
@@ -765,6 +780,8 @@ jobs:
       - name: Pipeline config scrapper
         id: analysis
         uses: filipeforattini/ff-iac-github-actions/.github/actions/config-scrapper@main
+        with:
+          containerRegistry: ${{inputs.containerRegistry}}
 
       - name: Config | Version
         id: versioning

diff --git a/README.md b/README.md
@@ -30,6 +30,7 @@ These workflows are highly opinionated **kubectl-apply** or **helm-upgrade** pip
     - [GitLeaks](https://github.com/zricethezav/gitleaks) for repository
     - [Trivy](https://github.com/aquasecurity/trivy) for repository and image
     - Open Source Static Analysis Runner
+- Dynamic container generator
 
 ### Repository Patterns
 

diff --git a/deploy/as-k8s/service.schema.yml b/deploy/as-k8s/service.schema.yml
@@ -73,6 +73,7 @@
 #! PIPELINE CONTROLE
 pipelineControl:
   datetime: 'today'
+  environmentAsSubdomains: true
   environmentsAsNamespaces: false
 
 

diff --git a/src/actions/k8s-install-dependencies/action.yml b/src/actions/k8s-install-dependencies/action.yml
@@ -170,10 +170,3 @@ runs:
         REPOSITORY_TAG_VERSION=${{inputs.version}} \
         DEPENDENCY_FILE=${{inputs.renderedOutput}} \
           ./.pipeline/src/dependency-install.sh
-
-        K8S_NAMESPACE=ff-svc-moleculer-dev \
-        K8S_REPOSITORY=ff-svc-moleculer \
-        DEPENDENCY_NAME=etcd \
-        REPOSITORY_TAG_VERSION=1.6.83 \
-        DEPENDENCY_FILE=./test/tmp/k8s-dependencies-full.yml \
-          ./src/dependency-install.sh
diff --git a/src/actions/pack-docker-build/action.yml b/src/actions/pack-docker-build/action.yml
@@ -22,6 +22,10 @@ inputs:
     description: "Push images"
     required: false
     default: "true"
+  containerRegistry:
+    description: "Image containers registry"
+    required: false
+    default: "true"
 
 runs:
   using: "composite"
@@ -38,6 +42,8 @@ runs:
     - name: Pipeline config scrapper
       id: analysis
       uses: filipeforattini/ff-iac-github-actions/.github/actions/config-scrapper@main
+      with:
+        containerRegistry: ${{inputs.containerRegistry}}
 
     - name: Build and push without cache
       uses: docker/build-push-action@v3

diff --git a/src/actions/pack-static-code-analysis/action.yml b/src/actions/pack-static-code-analysis/action.yml
@@ -15,12 +15,22 @@ runs:
   using: "composite"
 
   steps:
+    # GitLeaks
     - name: Run GitLeaks scanner
+      id: gitleaks
       if: inputs.runAnalysis == true
-      uses: docker://opendevsecops/gitleaks
+      uses: DariuszPorowski/github-action-gitleaks@v2
       with:
-        args: --repo=https://github.com/${{github.repository}}
+        report_format: "sarif"
+        fail: false
 
+    - name: Upload Gitleaks SARIF report to code scanning service
+      if: steps.gitleaks.outputs.exitcode == 1
+      uses: github/codeql-action/upload-sarif@v2
+      with:
+        sarif_file: ${{steps.gitleaks.outputs.report}}
+
+    # Trivy
     - name: Run Trivy scanner
       if: inputs.runAnalysis == true
       uses: aquasecurity/trivy-action@master
@@ -37,6 +47,7 @@ runs:
       with:
         sarif_file: 'trivy-results.sarif'
 
+    # OSSAR
     - name: Run OSSAR
       if: inputs.runAnalysis == true
       uses: github/ossar-action@v1
@@ -48,6 +59,7 @@ runs:
       with:
         sarif_file: ${{ steps.ossar.outputs.sarifFile }}
 
+    # CodeQL
     - name: Setup CodeQL for ${{ inputs.language }}
       uses: github/codeql-action/init@v2
       with: