Skip to content

Bump anchore/scan-action from 5.2.1 to 5.3.0 #265

Bump anchore/scan-action from 5.2.1 to 5.3.0

Bump anchore/scan-action from 5.2.1 to 5.3.0 #265

Workflow file for this run

name: Docker CI Release
on:
pull_request:
branches: main
push:
branches: main
tags:
- v*
jobs:
build:
runs-on: ubuntu-latest
steps:
-
name: "Git: Checkout"
uses: actions/checkout@v4
-
name: "Docker: Setup QEMU"
id: qemu
uses: docker/setup-qemu-action@v3.2.0
-
name: "Docker: Setup Buildx"
id: buildx
uses: docker/setup-buildx-action@v3
-
name: "Docker: Available Platforms"
run: echo ${{ steps.buildx.outputs.platforms }}
-
name: "Env: Prepare"
id: prepare
run: |
PLATFORMS=linux/amd64,linux/386,linux/arm64,linux/arm/v7,linux/arm/v6,linux/ppc64le
REPONAME=$(basename $GITHUB_REPOSITORY)
DOCKER_IMAGE=padhihomelab/${REPONAME#docker_}
VERSION=testing
if [[ $GITHUB_REF == refs/tags/* ]]; then
VERSION=${GITHUB_REF#refs/tags/v}
VERSION=${VERSION#_}
fi
TAGS="${DOCKER_IMAGE}:${VERSION}"
if [[ $VERSION =~ ^(((([0-9]{1,3}\.){,3}[0-9]{1,4})|(git\..*))_){,4}((([0-9]{1,3}\.){,3}[0-9]{1,4})|(git\..*))(-p[0-9]{1,2})?$ ]]; then
TAGS="$TAGS,${DOCKER_IMAGE}:latest"
fi
echo ::set-output name=args::VERSION=${VERSION} \
--build-arg BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ') \
--build-arg VCS_REF=${GITHUB_SHA::8}
echo ::set-output name=image::${DOCKER_IMAGE}
echo ::set-output name=platforms::${PLATFORMS}
echo ::set-output name=tags::${TAGS}
echo ::set-output name=version::${VERSION}
-
name: "Docker: Buildx Build"
uses: docker/build-push-action@v6.9.0
with:
platforms: ${{ steps.prepare.outputs.platforms }}
push: false
tags: ${{ steps.prepare.outputs.tags }}
build-args: ${{ steps.prepare.outputs.args }}
-
name: "Docker: Load Image"
uses: docker/build-push-action@v6.9.0
with:
load: true
push: false
tags: ${{ steps.prepare.outputs.tags }}
build-args: ${{ steps.prepare.outputs.args }}
-
name: "Anchore Scan: Run"
id: scan
uses: anchore/scan-action@v5.3.0
with:
image: "${{ steps.prepare.outputs.image }}:${{ steps.prepare.outputs.version }}"
acs-report-enable: true
fail-build: false
severity-cutoff: "critical"
-
name: "Anchore Scan: Report"
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: ${{ steps.scan.outputs.sarif }}
-
name: "Docker Hub: Login"
if: success() && github.event_name != 'pull_request'
uses: docker/login-action@v3.3.0
with:
username: ${{ secrets.DOCKER_HUB_USERNAME }}
password: ${{ secrets.DOCKER_HUB_PASSWORD }}
-
name: "Docker: Buildx Push"
if: success() && github.event_name != 'pull_request'
uses: docker/build-push-action@v6.9.0
with:
platforms: ${{ steps.prepare.outputs.platforms }}
push: true
tags: ${{ steps.prepare.outputs.tags }}
build-args: ${{ steps.prepare.outputs.args }}
-
name: "Docker Hub: Update description"
if: success() && github.event_name != 'pull_request'
uses: peter-evans/dockerhub-description@v4.0.0
env:
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }}
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
DOCKERHUB_REPOSITORY: ${{ steps.prepare.outputs.image }}
-
name: "Clean up"
if: always()
run: |
rm -f ${HOME}/.docker/config.json