79 lines
2.6 KiB
YAML
79 lines
2.6 KiB
YAML
name: 'Scan Backend Image'
|
|
run-name: '${{ inputs.repo_path }} → trivy [${{ inputs.branch }}]'
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
repo_path:
|
|
description: 'Репозиторий'
|
|
required: true
|
|
type: choice
|
|
options:
|
|
- devspace-apiregistry-core-service
|
|
- devspace-apiregistry-generator-service
|
|
- devspace-gateway
|
|
- devspace-api
|
|
default: devspace-apiregistry-core-service
|
|
branch:
|
|
description: 'Ветка'
|
|
required: true
|
|
type: string
|
|
default: master
|
|
jobs:
|
|
scan:
|
|
name: 'Trivy scan'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: 'Print Info'
|
|
run: |
|
|
echo "Repository: ${{ github.event.inputs.repo_path }}"
|
|
echo "Branch: ${{ github.event.inputs.branch }}"
|
|
- name: Cloning
|
|
uses: https://git.binom.pw/otp/devops/clone@main
|
|
with:
|
|
ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
|
|
repository: "devspc/${{ github.event.inputs.repo_path }}"
|
|
branch: ${{ github.event.inputs.branch }}
|
|
- uses: https://git.binom.pw/otp/devops/config-gradle@main
|
|
- uses: https://git.binom.pw/otp/devops/setup-gradle@main
|
|
- name: Setup Jvm
|
|
uses: actions/setup-java@v4
|
|
with:
|
|
java-version: 21
|
|
distribution: "adopt"
|
|
- name: Building
|
|
run: |
|
|
./gradlew bootJar --no-daemon -x cyclonedxBom
|
|
echo 'Jar in libs folder'
|
|
ls ./build/libs
|
|
- name: Build Docker Image
|
|
uses: https://git.binom.pw/otp/devops/docker@main
|
|
with:
|
|
image-name: "otp/devspc/${{ github.event.inputs.repo_path }}"
|
|
tags: scan
|
|
push: false
|
|
nexus-username: ${{ secrets.NEXUS_USERNAME }}
|
|
nexus-password: ${{ secrets.NEXUS_PASSWORD }}
|
|
- name: Export Image to tar
|
|
run: |
|
|
rm -f /tmp/image.tar
|
|
buildah push "otp/devspc/${{ github.event.inputs.repo_path }}:scan" docker-archive:/tmp/image.tar
|
|
ls -lh /tmp/image.tar
|
|
- name: Install Trivy
|
|
run: |
|
|
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
|
|
trivy --version
|
|
- name: Scan Image
|
|
run: |
|
|
trivy image --input /tmp/image.tar \
|
|
--scanners vuln,secret,misconfig \
|
|
--format table
|
|
- name: 'Cleanup'
|
|
if: always()
|
|
shell: bash
|
|
run: |
|
|
echo 'Cleaning...'
|
|
rm -f /tmp/image.tar
|
|
rm -rf ~/.gradle/init.gradle.kts
|
|
rm -rf ~/.ssh/config
|
|
rm -rf ~/.ssh/my_key
|