-
Notifications
You must be signed in to change notification settings - Fork 2
118 lines (115 loc) · 3.39 KB
/
zeek-build-push-latest-ghcr.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
---
name: zeek-build-push-latest-ghcr
on:
push:
branches:
- 'main'
paths:
- '**'
- '!**.md'
- '!zeek-docker.sh'
pull_request:
workflow_dispatch:
repository_dispatch:
schedule:
- cron: '0 12 * * 0'
env:
REGISTRY: ghcr.io
IMAGE_NAME: ghcr.io/${{ github.repository_owner }}/zeek
IMAGE_PLATFORM: linux/amd64
REPO_CONTEXT: .
REPO_CONTAINERFILE: ./Dockerfile.clang
BUILD_FROM_SOURCE: 1
BUILD_JOBS: 2
ZEEK_BRANCH: v6.2.1
SPICY_BRANCH:
ZEEK_DBG: 0
jobs:
buildpushscan:
runs-on: ubuntu-latest
permissions:
actions: write
packages: write
contents: read
security-events: write
steps:
-
name: Cancel previous run in progress
id: cancel-previous-runs
uses: styfle/[email protected]
with:
ignore_sha: true
all_but_latest: true
access_token: ${{ secrets.GITHUB_TOKEN }}
-
name: Checkout
id: repo-checkout
uses: actions/checkout@v3
-
name: Set up QEMU
id: setup-qemu
uses: docker/setup-qemu-action@v2
-
name: Log in to registry
id: registry-login
uses: docker/login-action@v2
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.repository_owner }}
password: ${{ secrets.GITHUB_TOKEN }}
-
name: Build base image
id: build-base-image
uses: docker/build-push-action@v3
with:
context: ${{ env.REPO_CONTEXT }}
file: ${{ env.REPO_CONTAINERFILE }}
push: true
target: base
tags: ${{ env.IMAGE_NAME }}:latest,${{ env.IMAGE_NAME }}:${{ env.ZEEK_BRANCH }}
build-args: |
BUILD_FROM_SOURCE=${{ env.BUILD_FROM_SOURCE }}
BUILD_JOBS=${{ env.BUILD_JOBS }}
GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
ZEEK_BRANCH=${{ env.ZEEK_BRANCH }}
ZEEK_DBG=${{ env.ZEEK_DBG }}
MAXMIND_GEOIP_DB_LICENSE_KEY=${{ secrets.MAXMIND_GEOIP_DB_LICENSE_KEY }}
platforms: ${{ env.IMAGE_PLATFORM }}
-
name: Build plus image
id: build-plus-image
uses: docker/build-push-action@v3
with:
context: ${{ env.REPO_CONTEXT }}
file: ${{ env.REPO_CONTAINERFILE }}
push: true
target: plus
tags: ${{ env.IMAGE_NAME }}:plus,${{ env.IMAGE_NAME }}:${{ env.ZEEK_BRANCH }}-plus
build-args: |
BUILD_FROM_SOURCE=${{ env.BUILD_FROM_SOURCE }}
BUILD_JOBS=${{ env.BUILD_JOBS }}
GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
ZEEK_BRANCH=${{ env.ZEEK_BRANCH }}
ZEEK_DBG=${{ env.ZEEK_DBG }}
platforms: ${{ env.IMAGE_PLATFORM }}
-
name: Run Trivy vulnerability scanner
id: trivy-scan
uses: aquasecurity/trivy-action@master
with:
scan-type: 'image'
scanners: 'vuln'
image-ref: ${{ env.IMAGE_NAME }}:latest
format: 'sarif'
output: 'trivy-results.sarif'
severity: 'HIGH,CRITICAL'
vuln-type: 'os,library'
hide-progress: true
ignore-unfixed: true
exit-code: '0'
-
name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v2
if: always()
with:
sarif_file: 'trivy-results.sarif'