-
Notifications
You must be signed in to change notification settings - Fork 472
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'master' into update_debian
- Loading branch information
Showing
31 changed files
with
387 additions
and
197 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,87 @@ | ||
| name: Docker images for integration tests | ||
|
|
||
| on: | ||
| # push: | ||
| # branches: | ||
| # - master | ||
| workflow_dispatch: | ||
|
|
||
| env: | ||
| PLATFORMS: "linux/amd64" | ||
|
|
||
| jobs: | ||
| list-dockerfiles: | ||
| name: Create list of existing dockerfiles | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
| - name: Get file list | ||
| id: set-matrix | ||
| run: | | ||
| # lists all Dockerfile_* and ignore (grep) files with extension (e.g. *.md5) | ||
| # tranforms the file list in JSON array (StackOverflow#10234327) | ||
| # converts the list into objects of dockerfile and image name | ||
| ls integration-tests/Dockerfile_* | | ||
| grep -Ev "\..{0,3}$" | | ||
| jq -R -s 'split("\n")[:-1]' | | ||
| jq '. | map({dockerfile: ., image: sub(".*_"; "")})' > filelist.json | ||
| echo "matrix=$(jq -c . filelist.json)" >> "$GITHUB_OUTPUT" | ||
| outputs: | ||
| matrix: ${{ steps.set-matrix.outputs.matrix }} | ||
|
|
||
| docker: | ||
| needs: [list-dockerfiles] | ||
| name: Build and push Docker image | ||
| runs-on: ubuntu-latest | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| include: ${{ fromJson(needs.list-dockerfiles.outputs.matrix) }} | ||
| permissions: | ||
| packages: write | ||
| contents: read | ||
|
|
||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| - name: Set up QEMU | ||
| uses: docker/setup-qemu-action@v3 | ||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
|
|
||
| - name: Login to GHCR | ||
| uses: docker/login-action@v3 | ||
| with: | ||
| registry: ghcr.io | ||
| username: ${{ github.repository_owner }} | ||
| password: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - name: MD5 of Dockerfile | ||
| id: md5_result | ||
| run: | | ||
| echo "md5=$(md5sum "${{ matrix.dockerfile }}" | awk '{ print $1 }')" >> $GITHUB_OUTPUT | ||
| - name: Extract metadata (tags, labels) for Docker | ||
| id: meta | ||
| uses: docker/metadata-action@v5 | ||
| with: | ||
| images: | | ||
| ghcr.io/${{ github.repository_owner }}/${{ matrix.image }} | ||
| labels: | | ||
| rocks.goss.dockerfile-md5=${{ steps.md5_result.outputs.md5 }} | ||
| - name: Build and push tag | ||
| uses: docker/build-push-action@v6 | ||
| with: | ||
| context: . | ||
| file: ${{ matrix.dockerfile }} | ||
| push: true | ||
| tags: | | ||
| ghcr.io/${{ github.repository_owner }}/${{ matrix.image }}:latest | ||
| labels: ${{ steps.meta.outputs.labels }} | ||
| platforms: ${{ env.PLATFORMS }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,51 @@ | ||
| name: "Build release artifacts" | ||
| on: | ||
| push: | ||
| tags: | ||
| - "v*" | ||
| workflow_dispatch: | ||
|
|
||
| permissions: | ||
| contents: write | ||
|
|
||
| jobs: | ||
| build: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
| - uses: actions/setup-go@v5 | ||
| with: | ||
| go-version-file: go.mod | ||
|
|
||
| - name: Get version from tag | ||
| if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/') | ||
| run: echo "TRAVIS_TAG=${{ github.ref_name }}" >> $GITHUB_ENV | ||
|
|
||
| - run: make release | ||
| - run: make dgoss-sha256 dcgoss-sha256 kgoss-sha256 | ||
|
|
||
| - name: "Upload binary as artifact" | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| retention-days: 5 | ||
| if-no-files-found: error | ||
| name: build | ||
| path: | | ||
| release/* | ||
| extras/*/*goss | ||
| extras/*/*goss.sha256 | ||
| attach-assets: | ||
| if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/') | ||
| needs: ["build"] | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Fetch all binaries | ||
| uses: actions/download-artifact@v4 | ||
| - name: Attach to release | ||
| uses: softprops/action-gh-release@v2 | ||
| with: | ||
| files: build/** | ||
| fail_on_unmatched_files: true |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| name: Trivy Code Scanning | ||
|
|
||
| on: | ||
| schedule: | ||
| - cron: "0 3 * * 5" | ||
| workflow_dispatch: | ||
|
|
||
| jobs: | ||
| trivy-scan: | ||
| name: Trivy scan | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| packages: read | ||
| security-events: write | ||
|
|
||
| steps: | ||
| - name: Run Trivy vulnerability scanner | ||
| uses: aquasecurity/trivy-action@0.24.0 | ||
| with: | ||
| image-ref: ghcr.io/${{ github.repository_owner }}/goss:latest | ||
| format: "sarif" | ||
| output: "trivy-results.sarif" | ||
|
|
||
| - name: Upload Trivy scan results to GitHub Security tab | ||
| uses: github/codeql-action/upload-sarif@v3 | ||
| with: | ||
| sarif_file: "trivy-results.sarif" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,19 +1,19 @@ | ||
| ARG GO_VERSION=1.21 | ||
|
|
||
| FROM docker.io/golang:${GO_VERSION}-alpine AS base | ||
|
|
||
| ARG GOSS_VERSION=v0.0.0 | ||
| WORKDIR /build | ||
|
|
||
| RUN --mount=target=. \ | ||
| CGO_ENABLED=0 go build \ | ||
| -ldflags "-X github.com/goss-org/goss/util.Version=${GOSS_VERSION} -s -w" \ | ||
| -o "/release/goss" \ | ||
| ./cmd/goss | ||
|
|
||
| FROM alpine:3.19 | ||
|
|
||
| COPY --from=base /release/* /usr/bin/ | ||
|
|
||
| RUN mkdir /goss | ||
| VOLUME /goss | ||
| ARG GO_VERSION=1.22 | ||
|
|
||
| FROM docker.io/golang:${GO_VERSION}-alpine AS base | ||
|
|
||
| ARG GOSS_VERSION=v0.0.0 | ||
| WORKDIR /build | ||
|
|
||
| RUN --mount=target=. \ | ||
| CGO_ENABLED=0 go build \ | ||
| -ldflags "-X github.com/goss-org/goss/util.Version=${GOSS_VERSION} -s -w" \ | ||
| -o "/release/goss" \ | ||
| ./cmd/goss | ||
|
|
||
| FROM alpine:3.19 | ||
|
|
||
| COPY --from=base /release/* /usr/bin/ | ||
|
|
||
| RUN mkdir /goss | ||
| VOLUME /goss |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.