Skip to content

Commit f452232

Browse files
author
wwanarif
committed
updated GHA workflows and app-frontend dockerfile
Signed-off-by: wwanarif <[email protected]>
1 parent fb7be22 commit f452232

File tree

7 files changed

+206
-3
lines changed

7 files changed

+206
-3
lines changed

‎.github/workflows/_build-image-to-registry.yml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
# Copyright (C) 2024 Intel Corporation
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
name: Uses - Build Images to Registry
5+
permissions: read-all
6+
on:
7+
workflow_call:
8+
inputs:
9+
node:
10+
required: true
11+
type: string
12+
tag:
13+
default: "latest"
14+
required: false
15+
type: string
16+
test_e2e:
17+
default: true
18+
required: false
19+
type: boolean
20+
21+
jobs:
22+
build-images:
23+
runs-on: "docker-build-${{ inputs.node }}"
24+
steps:
25+
- name: Clean Up Working Directory
26+
run: sudo rm -rf ${{github.workspace}}/*
27+
28+
- name: Get Checkout Ref
29+
run: |
30+
if [ "${{ github.event_name }}" == "pull_request" ] || [ "${{ github.event_name }}" == "pull_request_target" ]; then
31+
echo "CHECKOUT_REF=refs/pull/${{ github.event.number }}/merge" >> $GITHUB_ENV
32+
else
33+
echo "CHECKOUT_REF=${{ github.ref }}" >> $GITHUB_ENV
34+
fi
35+
36+
- name: Checkout out Repo
37+
uses: actions/checkout@v4
38+
with:
39+
ref: ${{ env.CHECKOUT_REF }}
40+
fetch-depth: 0
41+
42+
- name: Build Image and Push Image
43+
run: |
44+
whoami
45+
echo ${OPEA_IMAGE_REPO}
46+
cd ${{ github.workspace }}/setup-scripts/build-image-to-registry
47+
ansible-playbook build-image-to-registry.yml -e "container_registry=${OPEA_IMAGE_REPO}opea" -e "container_tag=${{ inputs.tag }}"

‎.github/workflows/manual-docker-build.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# Copyright (C) 2024 Intel Corporation
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
name: Manual Build Images
5+
on:
6+
workflow_dispatch:
7+
inputs:
8+
nodes:
9+
default: "gaudi"
10+
description: "Hardware to run test"
11+
required: true
12+
type: string
13+
tag:
14+
default: "latest"
15+
description: "Tag to apply to images"
16+
required: true
17+
type: string
18+
19+
concurrency:
20+
group: ${{ github.workflow }}-${{ github.ref }}-on-manual-dispatch
21+
cancel-in-progress: true
22+
23+
jobs:
24+
image-build:
25+
uses: ./.github/workflows/_build-image-to-registry.yml
26+
with:
27+
node: ${{ inputs.nodes }}
28+
tag: ${{ inputs.tag }}
29+
secrets: inherit

‎.github/workflows/manual-docker-scan.yml‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
# Copyright (C) 2024 Intel Corporation
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
name: Manual Image BoM and CVE Scan
5+
on:
6+
workflow_dispatch:
7+
inputs:
8+
node:
9+
default: "gaudi"
10+
description: "Hardware to run scan"
11+
required: true
12+
type: string
13+
tag:
14+
# default: "latest"
15+
default: "test1"
16+
description: "Tag for images to scan"
17+
required: true
18+
type: string
19+
sbom_scan:
20+
default: true
21+
description: 'Scan images for BoM'
22+
required: false
23+
type: boolean
24+
trivy_scan:
25+
default: true
26+
description: 'Scan images for CVE'
27+
required: false
28+
type: boolean
29+
30+
permissions: read-all
31+
jobs:
32+
clean-workspace:
33+
runs-on: "docker-build-${{ inputs.node }}"
34+
steps:
35+
- name: Clean up Working Directory
36+
run: |
37+
sudo rm -rf ${{github.workspace}}/* || true
38+
# docker system prune -f
39+
40+
scan-docker:
41+
needs: clean-workspace
42+
runs-on: "docker-build-${{ inputs.node }}"
43+
strategy:
44+
matrix:
45+
image: ["studio-frontend", "studio-backend", "app-frontend", "app-backend"]
46+
fail-fast: false
47+
steps:
48+
- name: Pull Image
49+
run: |
50+
docker pull ${OPEA_IMAGE_REPO}opea/${{ matrix.image }}:${{ inputs.tag }}
51+
echo "OPEA_IMAGE_REPO=${OPEA_IMAGE_REPO}" >> $GITHUB_ENV
52+
53+
- name: SBOM Scan Container
54+
uses: anchore/[email protected]
55+
if: ${{ inputs.sbom_scan }}
56+
with:
57+
image: ${{ env.OPEA_IMAGE_REPO }}opea/${{ matrix.image }}:${{ inputs.tag }}
58+
output-file: ${{ matrix.image }}-sbom-scan.txt
59+
format: 'spdx-json'
60+
61+
- name: Security Scan Container
62+
uses: aquasecurity/[email protected]
63+
if: ${{ inputs.trivy_scan }}
64+
with:
65+
image-ref: ${{ env.OPEA_IMAGE_REPO }}opea/${{ matrix.image }}:${{ inputs.tag }}
66+
output: ${{ matrix.image }}-trivy-scan.txt
67+
format: 'table'
68+
exit-code: '1'
69+
ignore-unfixed: true
70+
vuln-type: 'os,library'
71+
severity: 'CRITICAL,HIGH'
72+
73+
- name: Cleanup
74+
if: always()
75+
run: docker rmi -f ${OPEA_IMAGE_REPO}opea/${{ matrix.image }}:${{ inputs.tag }} || true
76+
77+
- name: Collect Logs
78+
if: always()
79+
run: |
80+
mkdir -p /tmp/scan-${{ inputs.tag }}-${{ github.run_number }}
81+
mv ${{ matrix.image }}-*-scan.txt /tmp/scan-${{ inputs.tag }}-${{ github.run_number }}
82+
83+
upload-artifacts:
84+
needs: scan-docker
85+
runs-on: "docker-build-${{ inputs.node }}"
86+
if: always()
87+
steps:
88+
- name: Upload SBOM Artifacts
89+
uses: actions/[email protected]
90+
with:
91+
name: sbom-scan-${{ inputs.tag }}-${{ github.run_number }}
92+
path: /tmp/scan-${{ inputs.tag }}-${{ github.run_number }}/*-sbom-scan.txt
93+
overwrite: true
94+
95+
- name: Upload Trivy Artifacts
96+
uses: actions/[email protected]
97+
with:
98+
name: trivy-scan-${{ inputs.tag }}-${{ github.run_number }}
99+
path: /tmp/scan-${{ inputs.tag }}-${{ github.run_number }}/*-trivy-scan.txt
100+
overwrite: true
101+
102+
- name: Remove Logs
103+
run: rm -rf /tmp/scan-${{ inputs.tag }}-${{ github.run_number }} && rm -rf /tmp/sbom-action-*

‎.github/workflows/pr-code-scan.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# Copyright (C) 2024 Intel Corporation
22
# SPDX-License-Identifier: Apache-2.0
33

4-
name: Code Scan
4+
name: PR Code Scan
55

66
on:
77
pull_request:

‎.github/workflows/pr-e2e-test.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# Copyright (C) 2024 Intel Corporation
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
name: PR E2E test
5+
6+
on:
7+
pull_request:
8+
branches: ["main", "*rc"]
9+
types: [opened, reopened, ready_for_review, synchronize] # added `ready_for_review` since draft is skipped
10+
paths-ignore:
11+
- "**.md"
12+
workflow_dispatch:
13+
14+
concurrency:
15+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
16+
cancel-in-progress: true
17+
18+
jobs:
19+
pr-image-build:
20+
uses: ./.github/workflows/_build-image-to-registry.yml
21+
with:
22+
node: gaudi
23+
tag: ${{ github.event_name == 'workflow_dispatch' && 'latest' || github.event.pull_request.head.sha }}
24+
secrets: inherit

‎.github/workflows/weekly-trellix-scan.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# Copyright (C) 2024 Intel Corporation
22
# SPDX-License-Identifier: Apache-2.0
33

4-
name: Trellix Command Line Scanner
4+
name: Weekly Trellix Scan
55

66
on:
77
workflow_dispatch:

‎app-frontend/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ FROM node:20.11.1 AS vite-app
77
COPY react /usr/app/react
88
WORKDIR /usr/app/react
99

10-
RUN npm install && npm run build
10+
RUN npm install --legacy-peer-deps && npm run build
1111

1212
FROM nginx:alpine
1313

0 commit comments

Comments
 (0)