ci: patch model images (#91)

Signed-off-by: Sertac Ozercan <[email protected]>

.github/workflows/patch-models.yaml

@@ -0,0 +1,69 @@
+name: Patch model images
+on:
+  # schedule:
+  #   - cron: "0 0 * * 0"
+  workflow_dispatch:
+
+permissions:
+  packages: write
+  id-token: write
+
+jobs:
+    patch-models:
+        runs-on: ubuntu-latest
+        timeout-minutes: 240
+        strategy:
+          fail-fast: false
+          matrix:
+            images:
+              - ghcr.io/sozercan/test/llama-2:7b
+              - ghcr.io/sozercan/test/llama-2:13b
+              - ghcr.io/sozercan/test/orca2:13b
+              # - ghcr.io/sozercan/mixtral:8x7b
+              - ghcr.io/sozercan/test/llama-2:7b-cuda
+              - ghcr.io/sozercan/test/llama-2:13b-cuda
+              - ghcr.io/sozercan/test/orca2:13b-cuda
+              # - ghcr.io/sozercan/mixtral:8x7b-cuda
+
+        steps:
+        - name: Set up Docker Buildx
+          uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
+
+        - name: Generate Trivy Report
+          uses: aquasecurity/trivy-action@d43c1f16c00cfd3978dde6c07f4bbcf9eb6993ca # 0.16.1
+          with:
+            scan-type: 'image'
+            format: 'json'
+            output: 'report.json'
+            ignore-unfixed: true
+            vuln-type: 'os'
+            image-ref: ${{ matrix.images }}
+
+        - name: Check Vuln Count
+          id: vuln_count
+          run: |
+            report_file="report.json"
+            vuln_count=$(jq '.Results | length' "$report_file")
+            echo "vuln_count=$vuln_count" >> $GITHUB_OUTPUT
+
+        - name: Copa Action
+          if: steps.vuln_count.outputs.vuln_count != '0'
+          id: copa
+          uses: project-copacetic/copa-action@04fbe0ef30896b3fef2280aa86365589cc524304 # v1.0.1
+          with:
+            image: ${{ matrix.images }}
+            image-report: 'report.json'
+            patched-tag: 'patched'
+
+        - name: Login to GHCR
+          if: steps.copa.conclusion == 'success'
+          uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
+          with:
+            registry: ghcr.io
+            username: ${{ github.actor }}
+            password: ${{ secrets.GITHUB_TOKEN }}
+
+        - name: Docker Push Patched Image
+          if: steps.login.conclusion == 'success'
+          run: |
+            docker push ${{ steps.copa.outputs.patched-image }}