-
Notifications
You must be signed in to change notification settings - Fork 2
109 lines (92 loc) · 3.38 KB
/
vault-agent.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
---
name: vault-agent
run-name: Build vault-agent container
on:
pull_request:
paths:
- pipelines/dockerfiles/vault-agent/**
- '!pipelines/dockerfiles/vault-agent/Jenkinsfile'
- '!pipelines/dockerfiles/vault-agent/config.yml'
- '!pipelines/dockerfiles/vault-agent/Makefile'
- .github/workflows/vault-agent.yml
branches: [ master ]
push:
paths:
- pipelines/dockerfiles/vault-agent/**
- '!pipelines/dockerfiles/vault-agent/Jenkinsfile'
- '!pipelines/dockerfiles/vault-agent/config.yml'
- '!pipelines/dockerfiles/vault-agent/Makefile'
- .github/workflows/vault-agent.yml
branches: [ master ]
workflow_dispatch:
env:
REPOSITORY: constantin07/vault-agent
jobs:
build:
runs-on: ubuntu-22.04
permissions:
security-events: write
defaults:
run:
working-directory: pipelines/dockerfiles/vault-agent
steps:
- name: Checkout source code
uses: actions/checkout@v4
- name: Set up QEMU
uses: docker/[email protected]
- name: Set up Docker Buildx
uses: docker/[email protected]
with:
driver-opts: image=moby/buildkit:master
- name: Login to Docker Hub
uses: docker/[email protected]
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Get version
run: |
VAULT_VERSION=$(grep -E "^VAULT_VERSION" Makefile | awk '{print $3}')
echo "VAULT_VERSION=$VAULT_VERSION" >> $GITHUB_ENV
echo $VAULT_VERSION
- name: Build image and export to docker
uses: docker/[email protected]
with:
context: pipelines/dockerfiles/vault
platforms: linux/amd64,linux/arm64
push: false
cache-from: type=gha
cache-to: type=gha,mode=max
build-args: VAULT_VERSION=${{ env.VAULT_VERSION }}
tags: ${{ env.REPOSITORY }}:${{ env.VAULT_VERSION }}
provenance: true
load: false
- name: Load amd64 platform image
run: |
docker buildx build --load --platform 'linux/amd64' \
--build-arg VAULT_VERSION=${{ env.VAULT_VERSION }} \
-t ${{ env.REPOSITORY }}:${{ env.VAULT_VERSION }} .
- name: Load arm64 platform image
run: |
docker buildx build --load --platform 'linux/arm64' \
--build-arg VAULT_VERSION=${{ env.VAULT_VERSION }} \
-t ${{ env.REPOSITORY }}:${{ env.VAULT_VERSION }}-arm64 .
- name: Run trivy scan
uses: aquasecurity/[email protected]
with:
image-ref: ${{ env.REPOSITORY }}:${{ env.VAULT_VERSION }}
format: sarif
output: trivy-results.sarif
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: trivy-results.sarif
- name: Test image
run: docker run --rm -t --cap-add IPC_LOCK ${{ env.REPOSITORY }}:${{ env.VAULT_VERSION }} vault --version
- name: Push amd64 & arm64 platform images
uses: docker/[email protected]
with:
context: pipelines/dockerfiles/vault
platforms: linux/amd64,linux/arm64
push: true
build-args: VAULT_VERSION=${{ env.VAULT_VERSION }}
tags: ${{ env.REPOSITORY }}:${{ env.VAULT_VERSION }}