Skip to content

Commit 842b78e

Browse files
fcecagnoprlanzarin
fcecagno
authored and
prlanzarin
committedJan 25, 2024
feat: pipelines with GitHub Actions
chore: remove unneeded bash installation from container feature: add pipeline to run the tests feature: add hadolint to build pipeline fix: copy configs for testing chore: split jobs chore: remove build cache chore: update build-push-action to v5 fix: unauthorized to push image fix: syntax feature: trivy pipeline fix: provide write access to trivy to upload the vulnerability report chore: add cache to build chore: update permissions and severity to trivy report fix: adjust cache chore: add trivy scanner to docker image as well fix: set trivy credentials fix: trivy format chore: activate cache chore: try to use github action cache for the image refactor: .dockerignore refactor: updates to build cache, image labels and tags, and conditions when the workflows run fix: make workflows reusable fix: yaml syntax fix: step name key chore: only build and push after hadolint and tests fix: add permission to write comments on issues/pr fix: adjust permissions chore: do not run workflows on release, only on tag fix: do not try to add comment to pr if not pr chore: add docs for the workflows refactor: change action to add pr comment which doesn't duplicate the same content Revert "refactor: change action to add pr comment which doesn't duplicate the same content" This reverts commit 4042453. chore: update comment message
·
v3.0.0v2.0.0
1 parent ff0cbf5 commit 842b78e

8 files changed

+229
-6
lines changed
 

‎.dockerignore

+13-4
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,17 @@
1+
.dockerignore
2+
.env
13
.git/
2-
node_modules/
4+
.github/
5+
.gitignore
6+
.nvmrc
7+
*~
8+
*log.*
39
*swn
410
*swo
511
*swp
6-
*~
7-
*log.*
8-
.env
12+
docker-compose.yaml
13+
Dockerfile
14+
example/
15+
extra/
16+
node_modules/
17+
test/

‎.github/workflows/README.md

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
Add the following secrets to the GitHub repo:
2+
```
3+
REGISTRY_USERNAME
4+
REGISTRY_TOKEN
5+
```
6+
They are the credentials to be used to push the image to the docker images registry.
7+
8+
Add the following variables to the GitHub repo:
9+
```
10+
REGISTRY_URI
11+
REGISTRY_ORGANIZATION
12+
```
13+
Considering the image `bigbluebutton/bbb-webhooks:v3.0.0`, the value for `REGISTRY_URI` would be `docker.io` (URI for DockerHub) and `REGISTRY_ORGANIZATION` would be `bigbluebutton`. The image name `bbb-webhooks` isn't configurable, and the tag will be the GitHub tag OR `pr-<pr number>`.

‎.github/workflows/docker-image.yml

+100
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
name: Build and push image to registry
2+
on:
3+
pull_request:
4+
types:
5+
- synchronize
6+
push:
7+
tags:
8+
- '*'
9+
permissions:
10+
contents: read
11+
jobs:
12+
hadolint:
13+
uses: ./.github/workflows/docker-lint.yml
14+
15+
tests:
16+
uses: ./.github/workflows/docker-tests.yml
17+
18+
build:
19+
permissions:
20+
contents: read # for actions/checkout to fetch code
21+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
22+
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
23+
pull-requests: write
24+
name: Build and push
25+
runs-on: ubuntu-22.04
26+
needs:
27+
- hadolint
28+
- tests
29+
30+
steps:
31+
- name: Checkout
32+
uses: actions/checkout@v4
33+
34+
- name: Set up Docker Buildx
35+
uses: docker/setup-buildx-action@v3
36+
37+
- name: Login to DockerHub
38+
uses: docker/login-action@v3
39+
with:
40+
registry: ${{ vars.REGISTRY_URI }}
41+
username: ${{ secrets.REGISTRY_USERNAME }}
42+
password: ${{ secrets.REGISTRY_TOKEN }}
43+
44+
- uses: rlespinasse/github-slug-action@v4
45+
46+
- name: Calculate tag
47+
id: tag
48+
run: |
49+
if [ "$GITHUB_EVENT_NAME" == "pull_request" ]; then
50+
TAG="pr-${{ github.event.number }}"
51+
else
52+
TAG=${{ github.ref_name }}
53+
fi
54+
echo "IMAGE=${{ vars.REGISTRY_URI }}/${{ vars.REGISTRY_ORGANIZATION }}/bbb-webhooks:$TAG" >> $GITHUB_OUTPUT
55+
56+
- name: Docker meta
57+
id: meta
58+
uses: docker/metadata-action@v4
59+
with:
60+
images: ${{ steps.tag.outputs.IMAGE }}
61+
62+
- name: Build and push image
63+
uses: docker/build-push-action@v5
64+
with:
65+
push: true
66+
tags: ${{ steps.tag.outputs.IMAGE }}
67+
context: .
68+
platforms: linux/amd64
69+
cache-from: type=registry,ref=${{ steps.tag.outputs.IMAGE }}
70+
cache-to: type=registry,ref=${{ steps.tag.outputs.IMAGE }},image-manifest=true,oci-mediatypes=true,mode=max
71+
labels: |
72+
${{ steps.meta.outputs.labels }}
73+
74+
- name: Add comment to pr
75+
if: ${{ github.event_name == 'pull_request' }}
76+
uses: actions/github-script@v7
77+
with:
78+
script: |
79+
github.rest.issues.createComment({
80+
issue_number: context.issue.number,
81+
owner: context.repo.owner,
82+
repo: context.repo.repo,
83+
body: "Updated Docker image pushed to `${{ steps.tag.outputs.IMAGE }}`"
84+
})
85+
86+
- name: Run Trivy vulnerability scanner
87+
uses: aquasecurity/trivy-action@master
88+
with:
89+
image-ref: ${{ steps.tag.outputs.IMAGE }}
90+
format: 'sarif'
91+
output: 'trivy-results.sarif'
92+
severity: 'CRITICAL,HIGH'
93+
env:
94+
TRIVY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
95+
TRIVY_PASSWORD: ${{ secrets.REGISTRY_TOKEN }}
96+
97+
- name: Upload Trivy scan results to GitHub Security tab
98+
uses: github/codeql-action/upload-sarif@v2
99+
with:
100+
sarif_file: 'trivy-results.sarif'

‎.github/workflows/docker-lint.yml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: Run hadolint
2+
on:
3+
workflow_dispatch:
4+
workflow_call:
5+
permissions:
6+
contents: read
7+
jobs:
8+
hadolint:
9+
name: Run hadolint check
10+
runs-on: ubuntu-22.04
11+
12+
steps:
13+
- uses: actions/checkout@v3
14+
15+
# TODO add hadolint output as comment on PR
16+
# https://github.com/hadolint/hadolint-action#output
17+
- uses: hadolint/hadolint-action@v3.1.0
18+
with:
19+
dockerfile: Dockerfile

‎.github/workflows/docker-scan.yml

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
name: Run trivy on filesystem
2+
on:
3+
workflow_dispatch:
4+
permissions:
5+
contents: read
6+
jobs:
7+
trivy:
8+
permissions:
9+
contents: read # for actions/checkout to fetch code
10+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
11+
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
12+
name: Run trivy check
13+
runs-on: ubuntu-22.04
14+
15+
steps:
16+
- uses: actions/checkout@v3
17+
18+
- name: Run Trivy vulnerability scanner in repo mode
19+
uses: aquasecurity/trivy-action@master
20+
with:
21+
scan-type: 'fs'
22+
ignore-unfixed: true
23+
format: 'sarif'
24+
output: 'trivy-results.sarif'
25+
severity: 'CRITICAL,HIGH'
26+
27+
- name: Upload Trivy scan results to GitHub Security tab
28+
uses: github/codeql-action/upload-sarif@v2
29+
with:
30+
sarif_file: 'trivy-results.sarif'

‎.github/workflows/docker-tests.yml

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
name: Run tests
2+
on:
3+
workflow_dispatch:
4+
workflow_call:
5+
permissions:
6+
contents: read
7+
jobs:
8+
tests:
9+
name: Run tests
10+
# https://docs.github.com/en/actions/using-containerized-services/creating-redis-service-containers#running-jobs-in-containers
11+
# Containers must run in Linux based operating systems
12+
runs-on: ubuntu-22.04
13+
# Docker Hub image that `container-job` executes in
14+
container: node:20-alpine
15+
16+
# Service containers to run with `container-job`
17+
services:
18+
# Label used to access the service container
19+
redis:
20+
# Docker Hub image
21+
image: redis
22+
# Set health checks to wait until redis has started
23+
options: >-
24+
--health-cmd "redis-cli ping"
25+
--health-interval 10s
26+
--health-timeout 5s
27+
--health-retries 5
28+
29+
steps:
30+
# Downloads a copy of the code in your repository before running CI tests
31+
- name: Check out repository code
32+
uses: actions/checkout@v4
33+
34+
# Performs a clean installation of all dependencies in the `package.json` file
35+
# For more information, see https://docs.npmjs.com/cli/ci.html
36+
- name: Install dependencies
37+
run: npm ci
38+
39+
- name: Copy config
40+
run: cp config/default.example.yml config/default.yml
41+
42+
- name: Run tests
43+
# Runs a script that creates a Redis client, populates
44+
# the client with data, and retrieves data
45+
run: npm run test
46+
# Environment variable used by the `client.js` script to create a new Redis client.
47+
env:
48+
# The hostname used to communicate with the Redis service container
49+
REDIS_HOST: redis
50+
# The default Redis port
51+
REDIS_PORT: 6379
52+
XAPI_ENABLED: true

‎Dockerfile

-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,5 @@
11
FROM node:20-alpine
22

3-
RUN apk add --no-cache bash
4-
53
WORKDIR /app
64

75
COPY package.json package-lock.json ./

‎config/custom-environment-variables.yml

+2
Original file line numberDiff line numberDiff line change
@@ -57,3 +57,5 @@ modules:
5757
requestTimeout:
5858
__name: REQUEST_TIMEOUT
5959
__format: json
60+
../out/xapi/index.js:
61+
enabled: XAPI_ENABLED

0 commit comments

Comments
 (0)
Please sign in to comment.