[Snyk] Security upgrade zipp from 3.15.0 to 3.19.1 #1555
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Run jobs on anything pushed or tagged on the master branch | |
| # PyPi is not here, because we only want that on releases/tags | |
| name: MasterCI | |
| on: | |
| release: | |
| types: [published, prereleased, edited] | |
| push: | |
| branches: | |
| - master | |
| pull_request: | |
| jobs: | |
| push-images: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| packages: write | |
| env: | |
| IMAGE_DESCRIPTION: Building thousands of models with timeseries data to monitor systems | |
| IMAGE_LICENSE: AGPL-3.0 | |
| IMAGE_HOME_URL: https://github.com/equinor/gordo | |
| DOCKER_REGISTRY: ghcr.io | |
| if: ${{ github.event_name != 'pull_request' || (!github.event.pull_request.draft && !github.event.pull_request.head.repo.fork)}} | |
| steps: | |
| - uses: actions/checkout@v1 | |
| - name: Prepare variables | |
| id: prep | |
| run: | | |
| python3 scripts/github_docker.py -r equinor -i gordo-base | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v1 | |
| - name: Login to CR | |
| uses: docker/login-action@v1 | |
| if: ${{ steps.prep.outputs.login_cr }} | |
| with: | |
| registry: ${{ env.DOCKER_REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build base image | |
| uses: docker/build-push-action@v2 | |
| with: | |
| context: . | |
| file: ./Dockerfile | |
| tags: ${{ steps.prep.outputs.base_image }} | |
| load: true | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@0.20.0 | |
| with: | |
| image-ref: ${{ steps.prep.outputs.base_image }} | |
| format: 'table' | |
| exit-code: '10' | |
| ignore-unfixed: true | |
| hide-progress: true | |
| severity: 'HIGH,CRITICAL' | |
| timeout: 5m | |
| - name: Push gordo-base | |
| uses: docker/build-push-action@v2 | |
| if: ${{ steps.prep.outputs.push_image }} | |
| with: | |
| push: true | |
| context: . | |
| file: ./Dockerfile | |
| tags: ${{ steps.prep.outputs.tags_gordo_base }} | |
| labels: | | |
| org.opencontainers.image.title=Gordo | |
| org.opencontainers.image.description=${{ env.IMAGE_DESCRIPTION }} | |
| org.opencontainers.image.source=${{ env.IMAGE_HOME_URL }} | |
| org.opencontainers.image.version=${{ steps.prep.outputs.version }} | |
| org.opencontainers.image.created=${{ steps.prep.outputs.created }} | |
| org.opencontainers.image.revision=${{ github.sha }} | |
| org.opencontainers.image.licenses=${{ env.IMAGE_LICENSE }} |