Docker Build and Publish #115

Workflow file for this run

.github/workflows/docker-build-and-publish.yml at 8d4b65e

	name: Docker Build and Publish

	on:
	workflow_dispatch:
	push:
	branches: ["main"]
	paths:
	- "images/**"
	schedule:
	- cron: "0 2 * * 0" # Weekly on Sundays at 02:00

	permissions:
	contents: read
	packages: write
	id-token: write

	env:
	IMAGE_TAG: 1.0.${{ github.run_number }}

	jobs:
	standard-alpine-amd64:
	name: Build standard-alpine-amd64
	runs-on: ubuntu-latest

	steps:
	- uses: actions/checkout@v3
	- name: Build the Docker image
	run: docker build . --file images/standard-alpine-amd64/Dockerfile --no-cache -t standard-alpine-amd64:${{ github.sha }}

	- name: Run Trivy vulnerability scanner
	uses: aquasecurity/trivy-action@master
	with:
	image-ref: "standard-alpine-amd64:${{ github.sha }}"
	format: "table"
	exit-code: "1"
	ignore-unfixed: true
	severity: "CRITICAL,HIGH"
	hide-progress: true
	vuln-type: "os"

	- uses: actions/checkout@v3
	- name: Docker Image Size
	run: docker inspect -f "{{ .Size }}" standard-alpine-amd64:${{ github.sha }} \| numfmt --to=si

	- name: Publish to Registry
	id: publish-standard-alpine-amd64
	uses: elgohr/Publish-Docker-Github-Action@v5
	with:
	name: SlalomBuild/pe-toolkit-standard-alpine-amd64
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}
	registry: ghcr.io
	buildoptions: "--compress --force-rm"
	dockerfile: images/standard-alpine-amd64/Dockerfile
	platforms: linux/amd64
	tags: "latest,${{ env.IMAGE_TAG }},amd64"

	standard-alpine-arm64:
	name: Build standard-alpine-arm64
	runs-on: ubuntu-latest

	steps:
	- uses: actions/checkout@v3
	- name: Build the Docker image
	run: \|
	docker buildx install
	docker buildx create --use
	docker build . --platform linux/arm64 --load --file images/standard-alpine-arm64/Dockerfile --no-cache -t standard-alpine-arm64:${{ github.sha }}

	- name: Run Trivy vulnerability scanner
	uses: aquasecurity/trivy-action@master
	with:
	image-ref: "standard-alpine-arm64:${{ github.sha }}"
	format: "table"
	exit-code: "1"
	ignore-unfixed: true
	severity: "CRITICAL,HIGH"
	hide-progress: true
	vuln-type: "os"

	- uses: actions/checkout@v3
	- name: Docker Image Size
	run: docker inspect -f "{{ .Size }}" standard-alpine-arm64:${{ github.sha }} \| numfmt --to=si

	- name: Publish to Registry
	id: publish-standard-alpine-arm64
	uses: elgohr/Publish-Docker-Github-Action@v5
	with:
	name: SlalomBuild/pe-toolkit-standard-alpine-arm64
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}
	registry: ghcr.io
	buildoptions: "--compress --force-rm"
	dockerfile: images/standard-alpine-arm64/Dockerfile
	platforms: linux/arm64
	tags: "latest,${{ env.IMAGE_TAG }},arm64"

	standard-ubuntu-arm64:
	name: Build standard-ubuntu-arm64
	runs-on: ubuntu-latest

	steps:
	- uses: actions/checkout@v3
	- name: Build the Docker image
	run: \|
	docker buildx install
	docker buildx create --use
	docker build . --platform linux/arm64 --load --file images/standard-ubuntu-arm64/Dockerfile --no-cache -t standard-ubuntu-arm64:${{ github.sha }}

	- name: Run Trivy vulnerability scanner
	uses: aquasecurity/trivy-action@master
	with:
	image-ref: "standard-ubuntu-arm64:${{ github.sha }}"
	format: "table"
	exit-code: "1"
	ignore-unfixed: true
	severity: "CRITICAL,HIGH"
	hide-progress: true
	vuln-type: "os"

	- uses: actions/checkout@v3
	- name: Docker Image Size
	run: docker inspect -f "{{ .Size }}" standard-ubuntu-arm64:${{ github.sha }} \| numfmt --to=si

	- name: Publish to Registry
	id: publish-standard-ubuntu-arm64
	uses: elgohr/Publish-Docker-Github-Action@v5
	with:
	name: SlalomBuild/pe-toolkit-standard-ubuntu-arm64
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}
	registry: ghcr.io
	buildoptions: "--compress --force-rm"
	dockerfile: images/standard-ubuntu-arm64/Dockerfile
	platforms: linux/arm64
	tags: "latest,${{ env.IMAGE_TAG }},arm64"

	standard-ubuntu-amd64:
	name: Build standard-ubuntu-amd64
	runs-on: ubuntu-latest

	steps:
	- uses: actions/checkout@v3
	- name: Build the Docker image
	run: docker build . --file images/standard-ubuntu-amd64/Dockerfile --no-cache -t standard-ubuntu-amd64:${{ github.sha }}

	- name: Run Trivy vulnerability scanner
	uses: aquasecurity/trivy-action@master
	with:
	image-ref: "standard-ubuntu-amd64:${{ github.sha }}"
	format: "table"
	exit-code: "1"
	ignore-unfixed: true
	severity: "CRITICAL,HIGH"
	hide-progress: true
	vuln-type: "os"

	- uses: actions/checkout@v3
	- name: Docker Image Size
	run: docker inspect -f "{{ .Size }}" standard-ubuntu-amd64:${{ github.sha }} \| numfmt --to=si

	- name: Publish to Registry
	id: publish-standard-ubuntu-amd64
	uses: elgohr/Publish-Docker-Github-Action@v5
	with:
	name: SlalomBuild/pe-toolkit-standard-ubuntu-amd64
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}
	registry: ghcr.io
	buildoptions: "--compress --force-rm"
	dockerfile: images/standard-ubuntu-amd64/Dockerfile
	platforms: linux/amd64
	tags: "latest,${{ env.IMAGE_TAG }},amd64"

	full-alpine-amd64:
	name: Build full-alpine-amd64
	runs-on: ubuntu-latest

	steps:
	- uses: actions/checkout@v3
	- name: Build the Docker image
	run: docker build . --file images/full-alpine-amd64/Dockerfile --no-cache -t full-alpine-amd64:${{ github.sha }}

	- name: Run Trivy vulnerability scanner
	uses: aquasecurity/trivy-action@master
	with:
	image-ref: "full-alpine-amd64:${{ github.sha }}"
	format: "table"
	exit-code: "1"
	ignore-unfixed: true
	severity: "CRITICAL,HIGH"
	hide-progress: true
	vuln-type: "os"

	- uses: actions/checkout@v3
	- name: Docker Image Size
	run: docker inspect -f "{{ .Size }}" full-alpine-amd64:${{ github.sha }} \| numfmt --to=si

	- name: Publish to Registry
	uses: elgohr/Publish-Docker-Github-Action@v5
	with:
	name: SlalomBuild/pe-toolkit-full-alpine-amd64
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}
	registry: ghcr.io
	buildoptions: "--compress --force-rm"
	dockerfile: images/full-alpine-amd64/Dockerfile
	platforms: linux/amd64
	tags: "latest,${{ env.IMAGE_TAG }},amd64"

	full-alpine-arm64:
	name: Build full-alpine-arm64
	runs-on: ubuntu-latest

	steps:
	- uses: actions/checkout@v3
	- name: Build the Docker image
	run: \|
	docker buildx install
	docker buildx create --use
	docker build . --platform linux/arm64 --load --file images/full-alpine-arm64/Dockerfile --no-cache -t full-alpine-arm64:${{ github.sha }}

	- name: Run Trivy vulnerability scanner
	uses: aquasecurity/trivy-action@master
	with:
	image-ref: "full-alpine-arm64:${{ github.sha }}"
	format: "table"
	exit-code: "1"
	ignore-unfixed: true
	severity: "CRITICAL,HIGH"
	hide-progress: true
	vuln-type: "os"

	- uses: actions/checkout@v3
	- name: Docker Image Size
	run: docker inspect -f "{{ .Size }}" full-alpine-arm64:${{ github.sha }} \| numfmt --to=si

	- name: Publish to Registry
	uses: elgohr/Publish-Docker-Github-Action@v5
	with:
	name: SlalomBuild/pe-toolkit-full-alpine-arm64
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}
	registry: ghcr.io
	buildoptions: "--compress --force-rm"
	dockerfile: images/full-alpine-arm64/Dockerfile
	platforms: linux/arm64
	tags: "latest,${{ env.IMAGE_TAG }},arm64"

	full-ubuntu-amd64:
	name: Build full-ubuntu-amd64
	runs-on: ubuntu-latest

	steps:
	- uses: actions/checkout@v3
	- name: Build the Docker image
	run: docker build . --file images/full-ubuntu-amd64/Dockerfile --no-cache -t full-ubuntu-amd64:${{ github.sha }}

	- name: Run Trivy vulnerability scanner
	uses: aquasecurity/trivy-action@master
	with:
	image-ref: "full-ubuntu-amd64:${{ github.sha }}"
	format: "table"
	exit-code: "1"
	ignore-unfixed: true
	severity: "CRITICAL,HIGH"
	hide-progress: true
	vuln-type: "os"

	- uses: actions/checkout@v3
	- name: Docker Image Size
	run: docker inspect -f "{{ .Size }}" full-ubuntu-amd64:${{ github.sha }} \| numfmt --to=si

	- name: Publish to Registry
	uses: elgohr/Publish-Docker-Github-Action@v5
	with:
	name: SlalomBuild/pe-toolkit-full-ubuntu-amd64
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}
	registry: ghcr.io
	buildoptions: "--compress --force-rm"
	dockerfile: images/full-ubuntu-amd64/Dockerfile
	platforms: linux/amd64
	tags: "latest,${{ env.IMAGE_TAG }},amd64"

	full-ubuntu-arm64:
	name: Build full-ubuntu-arm64
	runs-on: ubuntu-latest

	steps:
	- uses: actions/checkout@v3
	- name: Build the Docker image
	run: \|
	docker buildx install
	docker buildx create --use
	docker build . --platform linux/arm64 --load --file images/full-ubuntu-arm64/Dockerfile --no-cache -t full-ubuntu-arm64:${{ github.sha }}

	- name: Run Trivy vulnerability scanner
	uses: aquasecurity/trivy-action@master
	with:
	image-ref: "full-ubuntu-arm64:${{ github.sha }}"
	format: "table"
	exit-code: "1"
	ignore-unfixed: true
	severity: "CRITICAL,HIGH"
	hide-progress: true
	vuln-type: "os"

	- uses: actions/checkout@v3
	- name: Docker Image Size
	run: docker inspect -f "{{ .Size }}" full-ubuntu-arm64:${{ github.sha }} \| numfmt --to=si

	- name: Publish to Registry
	uses: elgohr/Publish-Docker-Github-Action@v5
	with:
	name: SlalomBuild/pe-toolkit-full-ubuntu-arm64
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}
	registry: ghcr.io
	buildoptions: "--compress --force-rm"
	dockerfile: images/full-ubuntu-arm64/Dockerfile
	platforms: linux/arm64
	tags: "latest,${{ env.IMAGE_TAG }},arm64"

	# _____ _
	# \|_ _\|__ ___\| \|_ ___
	# \| \|/ _ \/ __\| __/ __\|
	# \| \| __/\__ \ \|_\__ \
	# \|_\|\___\|\|___/\__\|___/

	test:
	name: Test ${{ matrix.type.name }}-${{ matrix.distro.id }}-${{ matrix.arch.id }}
	if: ${{ success() }}
	needs:
	[
	standard-alpine-amd64,
	standard-alpine-arm64,
	standard-ubuntu-amd64,
	standard-ubuntu-arm64,
	full-alpine-amd64,
	full-alpine-arm64,
	full-ubuntu-amd64,
	full-ubuntu-arm64,
	]
	runs-on: ubuntu-latest
	strategy:
	matrix:
	arch:
	- id: "amd64"
	- id: "arm64"
	distro:
	- id: "ubuntu"
	- id: "alpine"
	type:
	- name: "full"
	- name: "standard"

	steps:
	- name: Set up QEMU
	uses: docker/setup-qemu-action@v3
	with:
	platforms: "linux/${{ matrix.arch.id }}"

	- name: Run binaries in docker
	run: \|
	docker run \
	--rm \
	--platform linux/${{ matrix.arch.id }} \
	ghcr.io/slalombuild/pe-toolkit-${{ matrix.type.name }}-${{ matrix.distro.id }}-${{ matrix.arch.id }}:${{ env.IMAGE_TAG }} \
	/bin/sh -c 'figlet terraform && terraform version && figlet atmos && atmos version && figlet tflint && tflint --version && figlet tfsec && tfsec --version && figlet opa && opa version'

	# test-standard-alpine-amd64:
	# name: Test standard-alpine-amd64
	# runs-on: ubuntu-latest
	# container:
	# image: ghcr.io/slalombuild/pe-toolkit-standard-alpine-amd64:1.0.${{ github.run_number }}
	# credentials:
	# username: ${{ github.actor }}
	# password: ${{ secrets.GITHUB_TOKEN }}
	# needs: standard-alpine-amd64
	# if: ${{ success() }}
	# steps:
	# - name: Run each tool
	# run: \|
	# figlet terraform && terraform version
	# figlet atmos && atmos version
	# figlet tflint && tflint --version
	# figlet tfsec && tfsec --version
	# figlet opa && opa version

	# test-standard-alpine-arm64:
	# name: Test standard-alpine-arm64
	# runs-on: ubuntu-latest
	# container:
	# image: ghcr.io/slalombuild/pe-toolkit-standard-alpine-arm64:1.0.${{ github.run_number }}
	# credentials:
	# username: ${{ github.actor }}
	# password: ${{ secrets.GITHUB_TOKEN }}
	# needs: standard-alpine-arm64
	# if: ${{ success() }}
	# steps:
	# - name: Run each tool
	# run: \|
	# figlet terraform && terraform version
	# figlet atmos && atmos version
	# figlet tflint && tflint --version
	# figlet tfsec && tfsec --version
	# figlet opa && opa version

	# test-full-alpine-amd64:
	# name: Test full-alpine-amd64
	# runs-on: ubuntu-latest
	# container:
	# image: ghcr.io/slalombuild/pe-toolkit-full-alpine-amd64:1.0.${{ github.run_number }}
	# credentials:
	# username: ${{ github.actor }}
	# password: ${{ secrets.GITHUB_TOKEN }}
	# needs: full-alpine-amd64
	# if: ${{ success() }}
	# steps:
	# - name: Run each tool
	# run: \|
	# figlet terraform && terraform version
	# figlet atmos && atmos version
	# figlet tflint && tflint --version
	# figlet tfsec && tfsec --version
	# figlet opa && opa version

	# test-full-alpine-arm64:
	# name: Test full-alpine-arm64
	# runs-on: ubuntu-latest
	# container:
	# image: ghcr.io/slalombuild/pe-toolkit-full-alpine-arm64:1.0.${{ github.run_number }}
	# credentials:
	# username: ${{ github.actor }}
	# password: ${{ secrets.GITHUB_TOKEN }}
	# needs: full-alpine-arm64
	# if: ${{ success() }}
	# steps:
	# - name: Run each tool
	# run: \|
	# figlet terraform && terraform version
	# figlet atmos && atmos version
	# figlet tflint && tflint --version
	# figlet tfsec && tfsec --version
	# figlet opa && opa version

	# test-standard-ubuntu-amd64:
	# name: Test standard-ubuntu-amd64
	# runs-on: ubuntu-latest
	# container:
	# image: ghcr.io/slalombuild/pe-toolkit-standard-ubuntu-amd64:1.0.${{ github.run_number }}
	# credentials:
	# username: ${{ github.actor }}
	# password: ${{ secrets.GITHUB_TOKEN }}
	# needs: standard-ubuntu-amd64
	# if: ${{ success() }}
	# steps:
	# - name: Run each tool
	# run: \|
	# figlet terraform && terraform version
	# figlet atmos && atmos version
	# figlet tflint && tflint --version
	# figlet tfsec && tfsec --version
	# figlet opa && opa version

	# test-standard-ubuntu-arm64:
	# name: Test standard-ubuntu-arm64
	# runs-on: ubuntu-latest
	# container:
	# image: ghcr.io/slalombuild/pe-toolkit-standard-ubuntu-arm64:1.0.${{ github.run_number }}
	# credentials:
	# username: ${{ github.actor }}
	# password: ${{ secrets.GITHUB_TOKEN }}
	# needs: standard-ubuntu-arm64
	# if: ${{ success() }}
	# steps:
	# - name: Run each tool
	# run: \|
	# figlet terraform && terraform version
	# figlet atmos && atmos version
	# figlet tflint && tflint --version
	# figlet tfsec && tfsec --version
	# figlet opa && opa version

	# test-full-ubuntu-amd64:
	# name: Test full-ubuntu-amd64
	# runs-on: ubuntu-latest
	# container:
	# image: ghcr.io/slalombuild/pe-toolkit-full-ubuntu-amd64:1.0.${{ github.run_number }}
	# credentials:
	# username: ${{ github.actor }}
	# password: ${{ secrets.GITHUB_TOKEN }}
	# needs: full-ubuntu-amd64
	# if: ${{ success() }}
	# steps:
	# - name: Run each tool
	# run: \|
	# figlet terraform && terraform version
	# figlet atmos && atmos version
	# figlet tflint && tflint --version
	# figlet tfsec && tfsec --version
	# figlet opa && opa version

	# test-full-ubuntu-arm64:
	# name: Test full-ubuntu-arm64
	# runs-on: ubuntu-latest
	# container:
	# image: ghcr.io/slalombuild/pe-toolkit-full-ubuntu-arm64:1.0.${{ github.run_number }}
	# credentials:
	# username: ${{ github.actor }}
	# password: ${{ secrets.GITHUB_TOKEN }}
	# needs: full-ubuntu-arm64
	# if: ${{ success() }}
	# steps:
	# - name: Run each tool
	# run: \|
	# figlet terraform && terraform version
	# figlet atmos && atmos version
	# figlet tflint && tflint --version
	# figlet tfsec && tfsec --version
	# figlet opa && opa version

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Docker Build and Publish #115

Workflow file

Docker Build and Publish #115

Jobs

Run details

Workflow file for this run