Add SBOM scanning with Trivy (#93) #13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release | |
| on: | |
| push: | |
| branches: | |
| - main | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: release-${{ github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| test: | |
| uses: platform-mesh/.github/.github/workflows/job-node-test.yml@9ddacafbe3260312cb1cc3f9974ad2fece8effe0 | |
| secrets: inherit | |
| create-version: | |
| uses: platform-mesh/.github/.github/workflows/job-create-version.yml@9ddacafbe3260312cb1cc3f9974ad2fece8effe0 | |
| secrets: inherit | |
| permissions: | |
| contents: write | |
| docker-build-push: | |
| needs: [create-version, test] | |
| uses: platform-mesh/.github/.github/workflows/job-docker-build-push.yml@9ddacafbe3260312cb1cc3f9974ad2fece8effe0 | |
| secrets: inherit | |
| permissions: | |
| contents: write | |
| packages: write | |
| id-token: write | |
| with: | |
| imageTagName: ghcr.io/platform-mesh/iam-ui | |
| version: ${{ needs.create-version.outputs.version }} | |
| multiarch: true | |
| update-version: | |
| needs: [create-version, docker-build-push] | |
| uses: platform-mesh/.github/.github/workflows/job-chart-version-update.yml@9ddacafbe3260312cb1cc3f9974ad2fece8effe0 | |
| secrets: inherit | |
| with: | |
| appVersion: ${{ needs.create-version.outputs.version }} | |
| chart: iam-ui | |
| targetRepository: platform-mesh/helm-charts | |
| sbom: | |
| needs: [create-version, docker-build-push] | |
| uses: platform-mesh/.github/.github/workflows/job-sbom.yml@9ddacafbe3260312cb1cc3f9974ad2fece8effe0 | |
| permissions: | |
| contents: read | |
| packages: read | |
| with: | |
| imageReference: ghcr.io/platform-mesh/iam-ui:${{ needs.create-version.outputs.version }} | |
| image-ocm: | |
| needs: [create-version, docker-build-push, sbom] | |
| uses: platform-mesh/.github/.github/workflows/job-image-ocm.yml@9ddacafbe3260312cb1cc3f9974ad2fece8effe0 | |
| secrets: inherit | |
| permissions: | |
| contents: read | |
| packages: write | |
| with: | |
| imageReference: ghcr.io/platform-mesh/iam-ui:${{ needs.create-version.outputs.version }} | |
| appVersion: ${{ needs.create-version.outputs.version }} | |
| repoName: iam-ui | |
| commit: ${{ github.sha }} | |
| scan-sbom: | |
| needs: [create-version, docker-build-push, sbom, image-ocm] | |
| uses: platform-mesh/.github/.github/workflows/job-trivy-sbom.yml@05d96c3fb19e6283463369b857449f9440aba7dd # main | |
| permissions: | |
| contents: read | |
| packages: read | |
| security-events: write | |
| with: | |
| componentVersion: ${{ needs.create-version.outputs.version }} |