Maksim ShulgaandMaxim Shulga
b0dfc1ad74
* Run the image vulnerability scan on a weekly schedule The Trivy scan added in #29 only ran against changed code (PRs and pushes), so a CVE disclosed against an otherwise unchanged base image would go unnoticed until the next actual change. Add a weekly cron trigger, matching Dependabot's cadence in .github/dependabot.yml. The push job's existing `if: github.event_name == 'push'` guard means a schedule-triggered run builds and scans but never publishes. * Add workflow_dispatch so the scan can be run on demand Copilot review on PR #30 suggested this: waiting for the Monday cron to validate a fix is unnecessary friction. workflow_dispatch has no inputs, so it just re-runs the same build/test/scan on demand; the push job's event_name guard still keeps it from publishing. --------- Co-authored-by: Maxim Shulga <maxim.shulga@alludo.com>
114 lines
2.9 KiB
YAML
114 lines
2.9 KiB
YAML
name: Docker
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- master
|
|
tags:
|
|
- '*'
|
|
|
|
pull_request:
|
|
|
|
# Catch newly disclosed CVEs against unchanged code; matches Dependabot's
|
|
# weekly cadence in .github/dependabot.yml.
|
|
schedule:
|
|
- cron: '0 6 * * 1'
|
|
|
|
# Run the scan on demand instead of waiting for the next cron tick.
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
IMAGE: snegov/seafile-client
|
|
|
|
jobs:
|
|
# Application failures must be distinguishable from packaging failures, so
|
|
# the unit tests do not depend on the image build.
|
|
unit-test:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- uses: actions/setup-python@v7
|
|
with:
|
|
python-version: '3.11'
|
|
cache: pip
|
|
|
|
- name: Install dependencies
|
|
run: pip install -r requirements-dev.txt
|
|
|
|
- name: Run unit tests
|
|
run: pytest -q
|
|
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- name: Validate compose example
|
|
run: docker compose --file compose.example.yaml config --quiet
|
|
|
|
- name: Build image
|
|
uses: docker/build-push-action@v7
|
|
with:
|
|
context: .
|
|
push: false
|
|
load: true
|
|
tags: ${{ env.IMAGE }}:ci
|
|
|
|
# Exercises the real seaf-cli and seaf-daemon in the built image, which
|
|
# the unit tests cannot do. The runner is x86_64, matching the AppImage.
|
|
- name: Container smoke test
|
|
run: tests/smoke.sh ${{ env.IMAGE }}:ci
|
|
|
|
# ignore-unfixed: the debian:bookworm-slim base carries CVEs with no
|
|
# upstream fix yet; failing on those would block every build on
|
|
# findings nothing in this repo can act on. A fixable HIGH/CRITICAL
|
|
# finding still fails the build.
|
|
- name: Scan image for vulnerabilities
|
|
uses: aquasecurity/trivy-action@v0.36.0
|
|
with:
|
|
image-ref: ${{ env.IMAGE }}:ci
|
|
severity: HIGH,CRITICAL
|
|
ignore-unfixed: true
|
|
exit-code: '1'
|
|
|
|
push:
|
|
needs: [unit-test, test]
|
|
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
# Every tag of a release must resolve to one manifest digest, so the
|
|
# image is built once and all tags are attached to that single build.
|
|
- name: Collect tags and labels
|
|
id: meta
|
|
uses: docker/metadata-action@v6
|
|
with:
|
|
images: ${{ env.IMAGE }}
|
|
tags: |
|
|
type=ref,event=tag
|
|
flavor: |
|
|
latest=true
|
|
|
|
- name: Log in to Docker Hub
|
|
uses: docker/login-action@v4
|
|
with:
|
|
username: ${{ secrets.DOCKER_USERNAME }}
|
|
password: ${{ secrets.DOCKER_TOKEN }}
|
|
|
|
- name: Build and push
|
|
uses: docker/build-push-action@v7
|
|
with:
|
|
context: .
|
|
push: true
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|