Add build-scan-push workflow

2026-07-07 11:27:14 +01:00
parent 890a16aef9
commit 68223b681a
1 changed files with 169 additions and 0 deletions
@@ -0,0 +1,169 @@
 name: Build Docker Image & Security
 on:
  push:
    branches:
      - main
  workflow_dispatch:
 jobs:
  build-scan-push:
    runs-on: running-man
    env:
      # The image is under "homelab" namespace so it can stay private
      IMAGE: git.sysmd.uk/homelab/sysmd-games:latest
      COSIGN_VERSION: v3.0.5
      GRYPE_VERSION: v0.110.0
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Login to registry
        run: |
          echo "$REGISTRY_TOKEN" | docker login git.sysmd.uk -u "$REGISTRY_USER" --password-stdin
        env:
          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
      - name: Build image
        run: |
          docker build --no-cache -t ${IMAGE} .
      - name: Install Cosign
        run: |
          set -euo pipefail
          curl -fLO https://github.com/sigstore/cosign/releases/download/${COSIGN_VERSION}/cosign-linux-amd64
          chmod +x cosign-linux-amd64
          mv cosign-linux-amd64 /usr/local/bin/cosign
      - name: Install Grype
        run: |
          set -euo pipefail
          VERSION_NO_V="${GRYPE_VERSION#v}"
          FILE="grype_${VERSION_NO_V}_linux_amd64.tar.gz"
          BASE="https://github.com/anchore/grype/releases/download/${GRYPE_VERSION}"
          curl -fLO ${BASE}/${FILE}
          curl -fLO ${BASE}/grype_${VERSION_NO_V}_checksums.txt
          curl -fLO ${BASE}/grype_${VERSION_NO_V}_checksums.txt.sig
          curl -fLO ${BASE}/grype_${VERSION_NO_V}_checksums.txt.pem
          cosign verify-blob \
            --signature grype_${VERSION_NO_V}_checksums.txt.sig \
            --certificate grype_${VERSION_NO_V}_checksums.txt.pem \
            --certificate-identity-regexp "https://github.com/anchore/grype" \
            --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
            grype_${VERSION_NO_V}_checksums.txt
          CHECK=$(grep " ${FILE}$" grype_${VERSION_NO_V}_checksums.txt)
          [ -n "$CHECK" ] || { echo "Missing checksum"; exit 1; }
          echo "$CHECK" | sha256sum -c -
          tar -xzf ${FILE}
          mv grype /usr/local/bin/
      - name: Scan image with Grype
        id: grype
        continue-on-error: true
        run: |
          grype ${IMAGE} -o json > grype.json
          echo "Fixable HIGH/CRITICAL vulnerabilities:"
          jq -r '
            .matches[]
            | select(
                (
                  .vulnerability.severity == "High" or
                  .vulnerability.severity == "Critical"
                )
                and
                (
                  (.vulnerability.fix.versions | length) > 0
                )
              )
            | "\(.artifact.name)@\(.artifact.version) -> \(.vulnerability.id) [\(.vulnerability.severity)] | fixed: \(.vulnerability.fix.versions[0])"
          ' grype.json
          # Fail only on fixable HIGH/CRITICAL
          jq -e '
            [
              .matches[]
              | select(
                  (
                    .vulnerability.severity == "High" or
                    .vulnerability.severity == "Critical"
                  )
                  and
                  (
                    (.vulnerability.fix.versions | length) > 0
                  )
                )
            ]
            | length == 0
          ' grype.json
      - name: Notify Node-RED on vulnerabilities
        if: steps.grype.outcome == 'failure'
        run: |
          jq '
          {
            repo: "mdaleo404/games",
            image: "'${IMAGE}'",
            summary: (
              "Total: " +
              (
                [
                  .matches[]
                  | select(
                      (
                        .vulnerability.severity == "High" or
                        .vulnerability.severity == "Critical"
                      )
                      and
                      (
                        (.vulnerability.fix.versions | length) > 0
                      )
                    )
                ] | length | tostring
              )
            ),
            vulnerabilities: [
              .matches[]
              | select(
                  (
                    .vulnerability.severity == "High" or
                    .vulnerability.severity == "Critical"
                  )
                  and
                  (
                    (.vulnerability.fix.versions | length) > 0
                  )
                )
              | {
                library: .artifact.name,
                cve: .vulnerability.id,
                severity: .vulnerability.severity,
                installed: .artifact.version,
                fixed: (.vulnerability.fix.versions[0]),
                title: .vulnerability.description,
                url: .vulnerability.dataSource
              }
            ]
          }
          ' grype.json \
          | curl -s -X POST https://nodered.sysmd.uk/vulns-alert \
              -H "Content-Type: application/json" \
              --data-binary @-
      - name: Fail workflow if vulnerabilities found
        if: steps.grype.outcome == 'failure'
        run: exit 1
      - name: Push image
        if: steps.grype.outcome != 'failure'
        run: |
          docker push ${IMAGE}
      - name: Deploy to server
        if: steps.grype.outcome != 'failure'
        uses: appleboy/ssh-action@v1.2.0
        with:
          host: ${{ secrets.DEPLOYMENT_HOST }}
          username: ${{ secrets.DEPLOYMENT_USER }}
          key: ${{ secrets.DEPLOYMENT_SSH_KEY }}
          port: ${{ secrets.DEPLOYMENT_SSH_PORT }}
          script: |
            sudo docker compose -f /opt/sysmd-games/docker-compose.yml pull && \
            sudo docker compose -f /opt/sysmd-games/docker-compose.yml up -d
          host_key: 'false'