Skip to content

Commit 473c44a

Browse files
gotsysdbagotsysdba
authored
Add workflow (#794)
1 parent fb2b2b7 commit 473c44a

File tree

3 files changed

+154
-0
lines changed

3 files changed

+154
-0
lines changed

‎.github/actions/action.yml

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
name: 'Process Image'
2+
description: 'Dockerfile, Build, Push Images'
3+
inputs:
4+
src_image:
5+
description: Source Image
6+
required: true
7+
dst_image:
8+
description: Destination Image
9+
required: true
10+
description:
11+
description: Description of Image
12+
required: true
13+
push:
14+
description: Boolean to push image (true) or just build (false)
15+
required: true
16+
runs:
17+
using: "composite"
18+
steps:
19+
- name: Set date and latest Tag
20+
shell: bash
21+
run: |
22+
full_dst_image=${{ inputs.dst_image }}
23+
now=$(date +'%Y.%m.%d')
24+
echo "date=$now" >> $GITHUB_ENV
25+
echo "date_dst_tag=$full_dst_image-${now//./}" >> $GITHUB_ENV
26+
echo "latest_dst_tag=${full_dst_image%:*}:latest" >> $GITHUB_ENV
27+
28+
- name: Write Dockerfile
29+
shell: bash
30+
run: |
31+
cat <<- EOF > ${{ runner.temp }}/Dockerfile
32+
FROM ${{ inputs.src_image }}
33+
LABEL org.opencontainers.image.source="https://github.com/${{ github.repository }}"
34+
LABEL org.opencontainers.image.description="${{ inputs.description }}"
35+
LABEL org.opencontainers.image.name="${{ inputs.dst_image }}"
36+
LABEL org.opencontainers.image.version="${{ env.date }}"
37+
RUN (microdnf update --refresh --nodocs --best || microdnf update --refresh --nodocs --nobest) && microdnf clean all
38+
#RUN echo "Testing Update Functionality" > /image_digest
39+
RUN rpm -qa | sort | sha256sum | awk '{print $1}' > /image_digest
40+
EOF
41+
42+
- name: Build Image
43+
uses: docker/build-push-action@v5
44+
if: ${{ inputs.push == 'false' }}
45+
with:
46+
context: "${{ runner.temp }}"
47+
push: false
48+
tags: ${{ env.latest_dst_tag }}
49+
50+
- name: Build and Push Image
51+
uses: docker/build-push-action@v5
52+
if: ${{ inputs.push == 'true' }}
53+
with:
54+
context: "${{ runner.temp }}"
55+
push: true
56+
tags: ${{ env.latest_dst_tag }},${{ env.date_dst_tag }}

‎.github/workflows/README.md

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# Workflows
2+
3+
## obaas-base-image
4+
5+
This workflow takes the GraalVM image from Oracle Container Registry, scans for vulnerabilities, applies the latest OS patches, and stages the new image in ghcr.io for use with the OBaaS Platform.
6+
7+
### Workflow
8+
9+
1. Download the latest, patched GraalVM OBaaS image from the ghcr.io
10+
a. If no image exists in ghcr.io, download the latest GraalVM image from Oracle Container Registry and stage in ghcr.io
11+
2. Run Trivy Vulnerability scanner against the ghcr.io image
12+
a. If Trivy does not find any vulnerabilities, **end workflow**
13+
b. If Trivy reports vulnerabilities, attempt to apply OS patches
14+
3. Compare exiting ghcr.io image with attempt of patched image
15+
a. If existing image is same as patched image (no OS updates), **end workflow**
16+
4. Push newly patched image as latest

‎.github/workflows/obaas-base-image.yml

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
name: "Build OBaaS Base Image"
2+
on:
3+
schedule:
4+
- cron: "0 0 * * *"
5+
workflow_dispatch:
6+
env:
7+
src_tag: 17-muslib-ol8
8+
dst_img: graalvm-native-image-obaas
9+
description: "Oracle GraalVM for JDK 17 and OBaaS."
10+
jobs:
11+
obaas-image:
12+
runs-on: ubuntu-latest
13+
permissions:
14+
packages: write
15+
contents: read
16+
steps:
17+
- uses: actions/checkout@v4
18+
with:
19+
sparse-checkout: .github
20+
21+
- name: Login to GitHub Container Registry
22+
uses: docker/login-action@v3
23+
with:
24+
registry: ghcr.io
25+
username: ${{ github.actor }}
26+
password: ${{ secrets.GITHUB_TOKEN }}
27+
28+
- name: Get latest Image Software Digest
29+
run: |
30+
latest_digest=$(docker run --rm --entrypoint cat ghcr.io/${{ github.repository_owner }}/${{ env.dst_img }}:latest /image_digest)
31+
echo "Current Digest: $latest_digest"
32+
echo "latest_digest=$latest_digest" >> $GITHUB_ENV
33+
continue-on-error: true
34+
35+
- name: Create New Image
36+
if: env.latest_digest == ''
37+
uses: ./.github/actions/process-image
38+
with:
39+
src_image: container-registry.oracle.com/graalvm/native-image:${{ env.src_tag }}
40+
dst_image: ghcr.io/${{ github.repository_owner }}/${{ env.dst_img }}:${{ env.src_tag }}
41+
description: ${{ env.description }}
42+
push: true
43+
44+
- name: Run Trivy Vulnerability Scanner
45+
id: trivy_scan
46+
if: env.latest_digest != ''
47+
uses: aquasecurity/trivy-action@master
48+
with:
49+
image-ref: ghcr.io/${{ github.repository_owner }}/${{ env.dst_img }}:latest
50+
format: 'table'
51+
exit-code: '1'
52+
ignore-unfixed: true
53+
vuln-type: 'os,library'
54+
severity: 'CRITICAL,HIGH'
55+
continue-on-error: true
56+
57+
- name: Update Existing Image
58+
id: update_image
59+
if: env.latest_digest != '' && steps.trivy_scan.outcome == 'failure'
60+
uses: ./.github/actions/process-image
61+
with:
62+
src_image: ghcr.io/${{ github.repository_owner }}/${{ env.dst_img }}:latest
63+
dst_image: ghcr.io/${{ github.repository_owner }}/${{ env.dst_img }}:${{ env.src_tag }}
64+
description: ${{ env.description }}
65+
push: false
66+
67+
- name: Get newest Image Software Digest
68+
id: get_newest_digest
69+
if: steps.update_image.outcome != 'skipped'
70+
run: |
71+
newest_digest=$(docker run --rm --entrypoint cat ghcr.io/${{ github.repository_owner }}/${{ env.dst_img }}:latest /image_digest)
72+
echo "New Digest: $newest_digest"
73+
echo "newest_digest=$newest_digest" >> $GITHUB_ENV
74+
75+
- name: Push Updated Image
76+
if: steps.get_newest_digest.outcome != 'skipped' && env.latest_digest != env.newest_digest
77+
uses: ./.github/actions/process-image
78+
with:
79+
src_image: ghcr.io/${{ github.repository_owner }}/${{ env.dst_img }}:latest
80+
dst_image: ghcr.io/${{ github.repository_owner }}/${{ env.dst_img }}:${{ env.src_tag }}
81+
description: ${{ env.description }}
82+
push: true

0 commit comments

Comments
 (0)