Skip to content

Bump github.com/docker/docker when building #37

Bump github.com/docker/docker when building

Bump github.com/docker/docker when building #37

Workflow file for this run

on:
push:
branches:
- master
pull_request:
permissions:
contents: read
security-events: write # upload Sarif results
name: Build
jobs:
build-amd64:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Set the TAG value
id: get-TAG
run: |
echo "$(make -s log | grep TAG)" >> "$GITHUB_ENV"
- name: Build container image
uses: docker/build-push-action@v6
with:
context: .
push: false
tags: rancher/hardened-crictl:${{ env.TAG }}-amd64
file: Dockerfile
build-args: |
TAG=${{ env.TAG }}
- name: Run Trivy vulnerability scanner
uses: aquasecurity/[email protected]
with:
image-ref: rancher/hardened-crictl:${{ env.TAG }}-amd64
ignore-unfixed: true
vuln-type: 'os,library'
severity: 'CRITICAL,HIGH'
format: 'sarif'
output: 'trivy-results.sarif'
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v3
if: always()
with:
sarif_file: 'trivy-results.sarif'
build-arm64:
runs-on: ubuntu-latest
steps:
- name: Check out code
uses: actions/checkout@v4
- name: Set up QEMU
uses: docker/setup-qemu-action@v3
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Set the TAG value
id: get-TAG
run: |
echo "$(make -s log | grep TAG)" >> "$GITHUB_ENV"
- name: Build container image
uses: docker/build-push-action@v6
with:
context: .
push: false
tags: rancher/hardened-crictl:${{ env.TAG }}-arm64
file: Dockerfile
outputs: type=docker
platforms: linux/arm64
build-args: |
TAG=${{ env.TAG }}