71 lines
2.5 KiB
YAML
71 lines
2.5 KiB
YAML
name: Build Docker Image & Security
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
workflow_dispatch:
|
|
jobs:
|
|
build-scan-push:
|
|
runs-on: running-man
|
|
env:
|
|
# The image is under "homelab" namespace so it can stay private
|
|
IMAGE: git.sysmd.uk/homelab/sysmd-games:latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
- name: Login to registry
|
|
run: |
|
|
echo "$REGISTRY_TOKEN" | docker login git.sysmd.uk -u "$REGISTRY_USER" --password-stdin
|
|
env:
|
|
REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
|
|
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
- name: Build image
|
|
run: |
|
|
docker build --no-cache -t ${IMAGE} .
|
|
- name: Install Grype
|
|
uses: https://git.sysmd.uk/mdaleo404/actions/install-grype@v1
|
|
- name: Scan image with Grype
|
|
id: scan
|
|
continue-on-error: true
|
|
uses: https://git.sysmd.uk/mdaleo404/actions/scan-image@v1
|
|
with:
|
|
image: ${{ env.IMAGE }}
|
|
fail-on-fixable: 'false'
|
|
- name: Reconcile Grype ignores
|
|
id: reconcile
|
|
continue-on-error: true
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.AUTOUPDATE_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
curl -fsSL -H "Authorization: token ${GITEA_TOKEN}" \
|
|
"https://git.sysmd.uk/api/v1/repos/Homelab/renovate-runner/raw/scripts/reconcile-grype.sh?ref=main" \
|
|
-o /tmp/reconcile-grype.sh
|
|
bash /tmp/reconcile-grype.sh
|
|
- name: Notify Node-RED on vulnerabilities
|
|
if: steps.reconcile.outcome == 'failure'
|
|
run: |
|
|
jq -n --arg repo "${GITHUB_REPOSITORY,,}" '{ repo: $repo }' \
|
|
| curl -s -X POST https://nodered.sysmd.uk/vulns-alert \
|
|
-H "Content-Type: application/json" \
|
|
--data-binary @-
|
|
- name: Fail workflow if vulnerabilities found
|
|
if: steps.reconcile.outcome == 'failure'
|
|
run: exit 1
|
|
- name: Push image
|
|
if: steps.reconcile.outcome != 'failure'
|
|
run: |
|
|
docker push ${IMAGE}
|
|
- name: Deploy to server
|
|
if: steps.reconcile.outcome != 'failure'
|
|
uses: appleboy/ssh-action@v1.2.0
|
|
with:
|
|
host: ${{ secrets.DEPLOYMENT_HOST }}
|
|
username: ${{ secrets.DEPLOYMENT_USER }}
|
|
key: ${{ secrets.DEPLOYMENT_SSH_KEY }}
|
|
port: ${{ secrets.DEPLOYMENT_SSH_PORT }}
|
|
script: |
|
|
sudo docker compose -f /opt/sysmd-games/docker-compose.yml pull && \
|
|
sudo docker compose -f /opt/sysmd-games/docker-compose.yml up -d
|
|
host_key: 'false'
|