v0.13.2 #39
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # This Github Action workflow is triggered, when a new release is created. | |
| on: | |
| release: | |
| types: [created] | |
| permissions: | |
| contents: write | |
| packages: write | |
| jobs: | |
| scan_sourcecode: | |
| name: Scanning sourcecode to find vulberabilities, misconfigurations and exposed secrets | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Create outputs directory | |
| run: mkdir -p /tmp/trivy | |
| - name: Run Trivy security scan against the sourcecode | |
| uses: aquasecurity/[email protected] | |
| with: | |
| scan-type: fs | |
| vuln-type: library | |
| scan-ref: . | |
| trivy-config: trivy.yaml | |
| format: table | |
| output: security-scan-result.txt | |
| - name: Append the security scan result to the job summary | |
| run: | | |
| { | |
| echo "### 🛡️ Sourcecode security scan result :" | |
| echo "" | |
| echo '```terraform' | |
| cat security-scan-result.txt | |
| echo '```' | |
| } >> $GITHUB_STEP_SUMMARY | |
| build_and_publish_binaries: | |
| name: Build and publish binary | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| goos: [linux, darwin] | |
| goarch: [amd64, arm64] | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Create outputs directory | |
| run: mkdir -p ./outputs/trivy | |
| - uses: wangyoucao577/go-release-action@v1 | |
| with: | |
| goos: ${{ matrix.goos }} | |
| goarch: ${{ matrix.goarch }} | |
| project_path: ./cmd | |
| binary_name: kubeaid-bootstrap-script-${{ matrix.goos }}-${{ matrix.goarch }} | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| compress_assets: OFF | |
| build_and_push_container_images: | |
| name: Build and push container images | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v3 | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v2 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v2 | |
| - name: Login to GitHub Container Registry | |
| uses: docker/[email protected] | |
| with: | |
| registry: ghcr.io | |
| username: obmondo | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build and push KubeAid Bootstrap Script AMD64 and ARM64 container images | |
| uses: docker/build-push-action@v4 | |
| with: | |
| context: . | |
| file: Dockerfile | |
| # NOTE : It takes pretty long to build container images for the ARM64 platform (even when | |
| # using QEMU). | |
| platforms: linux/amd64,linux/arm64 | |
| tags: ghcr.io/obmondo/kubeaid-bootstrap-script:${{ github.event.release.tag_name }} | |
| push: true | |
| # Experimental cache exporter for GitHub Actions provided by buildx and BuildKit. | |
| # It uses the GitHub Cache API to fetch and load the Docker layer cache blobs across | |
| # builds. | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max |