Skip to content

Commit cc3406d

Browse files
author
Gonzalo Diaz
committed
[CONFIG] [Gihub Actions] Docker running in splitted jobs.
1 parent 994655e commit cc3406d

File tree

1 file changed

+150
-20
lines changed

1 file changed

+150
-20
lines changed

‎.github/workflows/docker-image.yml‎

Lines changed: 150 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -10,29 +10,132 @@ on: # yamllint disable-line rule:truthy
1010

1111
env:
1212
IMAGE_NAME: algorithm-exercises-js
13+
ARTIFACT_NAME: algorithm-exercises-js_${{ github.sha }}
1314

1415
jobs:
1516

1617
build:
17-
name: "Build & Test in Docker"
18+
name: "Build Docker images"
19+
runs-on: ubuntu-latest
20+
steps:
21+
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
22+
23+
# - name: Build the Docker image
24+
# run: make compose/rebuild
25+
# - name: Image List
26+
# run: docker image ls -a
27+
# - name: Lint in Docker image
28+
# run: make compose/lint
29+
# - name: Test in Docker image
30+
# run: make compose/test
31+
# - name: Run in Docker image
32+
# run: make compose/run
33+
34+
- name: Set up Docker Buildx
35+
uses: docker/setup-buildx-action@v3
36+
37+
- name: "LINT: Build and push"
38+
uses: docker/build-push-action@v6
39+
with:
40+
context: .
41+
target: lint
42+
outputs: |
43+
type=docker,dest=/tmp/${{ env.ARTIFACT_NAME }}_lint.tar
44+
tags: |
45+
${{ env.IMAGE_NAME }}:lint
46+
- name: "LINT: Upload artifact"
47+
uses: actions/upload-artifact@v4
48+
with:
49+
name: ${{ env.ARTIFACT_NAME }}_lint
50+
path: /tmp/${{ env.ARTIFACT_NAME }}_lint.tar
51+
52+
- name: "TEST: Build and push"
53+
uses: docker/build-push-action@v6
54+
with:
55+
context: .
56+
target: testing
57+
outputs: |
58+
type=docker,dest=/tmp/${{ env.ARTIFACT_NAME }}_test.tar
59+
tags: |
60+
${{ env.IMAGE_NAME }}:test
61+
- name: "TEST: Upload artifact"
62+
uses: actions/upload-artifact@v4
63+
with:
64+
name: ${{ env.ARTIFACT_NAME }}_test
65+
path: /tmp/${{ env.ARTIFACT_NAME }}_test.tar
66+
67+
- name: "PRODUCTION: Build and push"
68+
uses: docker/build-push-action@v6
69+
with:
70+
context: .
71+
target: production
72+
outputs: |
73+
type=docker,dest=/tmp/${{ env.ARTIFACT_NAME }}_prod.tar
74+
tags: |
75+
${{ env.IMAGE_NAME }}:latest
76+
${{ env.IMAGE_NAME }}:${{ github.sha }}
77+
- name: "PRODUCTION: Upload artifact"
78+
uses: actions/upload-artifact@v4
79+
with:
80+
name: ${{ env.ARTIFACT_NAME }}_prod
81+
path: /tmp/${{ env.ARTIFACT_NAME }}_prod.tar
1882

83+
lint:
84+
name: "Run in docker: LINT"
1985
runs-on: ubuntu-latest
86+
needs: build
87+
steps:
88+
- name: Download artifact
89+
uses: actions/download-artifact@v4
90+
with:
91+
name: ${{ env.ARTIFACT_NAME }}_lint
92+
path: /tmp/
93+
94+
- name: Load image
95+
run: |
96+
docker load --input /tmp/${{ env.ARTIFACT_NAME }}_lint.tar
97+
docker image ls -a
98+
99+
- name: Run lint
100+
run: |
101+
docker run --rm ${{ env.IMAGE_NAME }}:lint make lint
20102
103+
test:
104+
name: "Run in docker: TEST"
105+
runs-on: ubuntu-latest
106+
needs: build
107+
steps:
108+
- name: Download artifact
109+
uses: actions/download-artifact@v4
110+
with:
111+
name: ${{ env.ARTIFACT_NAME }}_test
112+
path: /tmp/
113+
114+
- name: Load image
115+
run: |
116+
docker load --input /tmp/${{ env.ARTIFACT_NAME }}_test.tar
117+
docker image ls -a
118+
119+
- name: Run lint
120+
run: |
121+
docker run --rm ${{ env.IMAGE_NAME }}:test make test
122+
123+
security:
124+
name: "Snyk Container"
125+
runs-on: ubuntu-latest
126+
needs: build
21127
steps:
22128
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
23-
- name: Build the Docker image
24-
run: make compose/rebuild
25-
- name: Lint in Docker image
26-
run: make compose/lint
27-
- name: Test in Docker image
28-
run: make compose/test
29-
- name: Run in Docker image
30-
run: make compose/run
31-
- name: Tag Docker image
32-
run: >
33-
docker tag
34-
${{ env.IMAGE_NAME }}:latest
35-
${{ env.IMAGE_NAME }}:${{ github.sha }}
129+
- name: Download artifact
130+
uses: actions/download-artifact@v4
131+
with:
132+
name: ${{ env.ARTIFACT_NAME }}_prod
133+
path: /tmp/
134+
135+
- name: Load image
136+
run: |
137+
docker load --input /tmp/${{ env.ARTIFACT_NAME }}_prod.tar
138+
docker image ls -a
36139
37140
- name: Run Snyk to check Docker image for vulnerabilities
38141
# Snyk can be used to break the build when it detects vulnerabilities.
@@ -49,9 +152,36 @@ jobs:
49152
with:
50153
image: ${{ env.IMAGE_NAME }}:${{ github.sha }}
51154
args: --file=Dockerfile
52-
# yamllint disable rule:comments-indentation
53-
# - name: Upload result to GitHub Code Scanning
54-
# uses: github/codeql-action/upload-sarif@v2
55-
# with:
56-
# sarif_file: snyk.sarif
57-
# yamllint enable rule:comments-indentation
155+
156+
scan:
157+
name: "Trivy"
158+
runs-on: ubuntu-latest
159+
needs: build
160+
steps:
161+
- name: Download artifact
162+
uses: actions/download-artifact@v4
163+
with:
164+
name: ${{ env.ARTIFACT_NAME }}_prod
165+
path: /tmp/
166+
167+
- name: Load image
168+
run: |
169+
docker load --input /tmp/${{ env.ARTIFACT_NAME }}_prod.tar
170+
docker image ls -a
171+
172+
- name: Run Trivy vulnerability scanner
173+
uses: aquasecurity/trivy-action@0.20.0
174+
with:
175+
image-ref: ${{ env.IMAGE_NAME }}:${{ github.sha }}
176+
format: 'table'
177+
exit-code: '1'
178+
ignore-unfixed: true
179+
vuln-type: 'os,library'
180+
severity: 'CRITICAL,HIGH'
181+
182+
# yamllint disable rule:comments-indentation
183+
# - name: Upload Trivy scan results to GitHub Security tab
184+
# uses: github/codeql-action/upload-sarif@v2
185+
# with:
186+
# sarif_file: 'trivy-results.sarif'
187+
# yamllint enable rule:comments-indentation

0 commit comments

Comments
 (0)