104 lines
3.3 KiB
YAML
104 lines
3.3 KiB
YAML
name: Build Docker Image & Security
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
workflow_dispatch:
|
|
jobs:
|
|
build-scan-push:
|
|
runs-on: running-man
|
|
env:
|
|
# The image is under "homelab" namespace so it can stay private
|
|
IMAGE: git.sysmd.uk/homelab/sysmd-games:latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
- name: Login to registry
|
|
run: |
|
|
echo "$REGISTRY_TOKEN" | docker login git.sysmd.uk -u "$REGISTRY_USER" --password-stdin
|
|
env:
|
|
REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
|
|
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
- name: Build image
|
|
run: |
|
|
docker build --no-cache -t ${IMAGE} .
|
|
- name: Install Grype
|
|
uses: self:Homelab/actions/install-grype@v1
|
|
- name: Scan image with Grype
|
|
id: scan
|
|
continue-on-error: true
|
|
uses: self:Homelab/actions/scan-image@v1
|
|
with:
|
|
image: ${{ env.IMAGE }}
|
|
- name: Notify Node-RED on vulnerabilities
|
|
if: steps.scan.outcome == 'failure'
|
|
run: |
|
|
jq '
|
|
{
|
|
repo: "mdaleo404/games",
|
|
image: "'${IMAGE}'",
|
|
summary: (
|
|
"Total: " +
|
|
(
|
|
[
|
|
.matches[]
|
|
| select(
|
|
(
|
|
.vulnerability.severity == "High" or
|
|
.vulnerability.severity == "Critical"
|
|
)
|
|
and
|
|
(
|
|
(.vulnerability.fix.versions | length) > 0
|
|
)
|
|
)
|
|
] | length | tostring
|
|
)
|
|
),
|
|
vulnerabilities: [
|
|
.matches[]
|
|
| select(
|
|
(
|
|
.vulnerability.severity == "High" or
|
|
.vulnerability.severity == "Critical"
|
|
)
|
|
and
|
|
(
|
|
(.vulnerability.fix.versions | length) > 0
|
|
)
|
|
)
|
|
| {
|
|
library: .artifact.name,
|
|
cve: .vulnerability.id,
|
|
severity: .vulnerability.severity,
|
|
installed: .artifact.version,
|
|
fixed: (.vulnerability.fix.versions[0]),
|
|
title: .vulnerability.description,
|
|
url: .vulnerability.dataSource
|
|
}
|
|
]
|
|
}
|
|
' grype.json \
|
|
| curl -s -X POST https://nodered.sysmd.uk/vulns-alert \
|
|
-H "Content-Type: application/json" \
|
|
--data-binary @-
|
|
- name: Fail workflow if vulnerabilities found
|
|
if: steps.scan.outcome == 'failure'
|
|
run: exit 1
|
|
- name: Push image
|
|
if: steps.scan.outcome != 'failure'
|
|
run: |
|
|
docker push ${IMAGE}
|
|
- name: Deploy to server
|
|
if: steps.scan.outcome != 'failure'
|
|
uses: appleboy/ssh-action@v1.2.0
|
|
with:
|
|
host: ${{ secrets.DEPLOYMENT_HOST }}
|
|
username: ${{ secrets.DEPLOYMENT_USER }}
|
|
key: ${{ secrets.DEPLOYMENT_SSH_KEY }}
|
|
port: ${{ secrets.DEPLOYMENT_SSH_PORT }}
|
|
script: |
|
|
sudo docker compose -f /opt/sysmd-games/docker-compose.yml pull && \
|
|
sudo docker compose -f /opt/sysmd-games/docker-compose.yml up -d
|
|
host_key: 'false'
|