github-workflows/.github/workflows/test-k6-build-docker.yml at main · felleslosninger/github-workflows · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
# PS! This is a custom workflow not maintained by the Platform team. This will
# be removed in the future.

name: Build k6-docker

permissions: {}

on:
  workflow_call:
    inputs:
      image-name:
        description: Name of Docker image
        required: false
        type: string
      k6-folder:
        description: Folder with k6-tests
        default: "k6-load-tests"
        required: false
        type: string
      k6-libs-folder:
        description: Folder with k6-tests
        default: "libs"
        required: false
        type: string
      application-path:
        default: "./"
        required: false
        type: string
      trivy-library-disable-scan:
        description: Disable Trivy library scan
        type: boolean
        required: false
        default: false
      trivy-library-ignore-unfixed:
        description: Ignore unfixed vulnerabilities in Trivy library scan
        type: boolean
        required: false
        default: true
      trivy-library-severity:
        description: When to fail the scan with Trivy library vulnerabilities
        type: string
        required: false
        default: 'HIGH,CRITICAL'
      trivy-os-disable-scan:
        description: Disable Trivy OS scan
        type: boolean
        required: false
        default: false
      trivy-os-ignore-unfixed:
        description: Ignore unfixed vulnerabilities in Trivy OS scan
        type: boolean
        required: false
        default: true
      trivy-os-severity:
        description: When to fail the scan with Trivy OS vulnerabilities
        type: string
        required: false
        default: 'CRITICAL'
      trivy-os-exit-code:
        description: Exit code for OS vulns (1 = blocking for Dockerfiles)
        type: string
        required: false
        default: '1'
      trivy-version:
        description: Version of Trivy to use for scanning
        type: string
        required: false
        default: ''

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      DOCKLE_HOST: "unix:///var/run/docker.sock"
    steps:
      - name: Set image metadata
        id: image-metadata
        uses: felleslosninger/github-workflows/.github/actions/image-metadata@main
        with:
          image-name: ${{ inputs.image-name }}
          container-registry: "my-local-registry"

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.2

      - name: Copy k6-tests to docker temp
        run: |
          cp -R ${{ inputs.k6-folder }}/* docker/k6-tests/
          mkdir docker/${{ inputs.k6-libs-folder }}
          cp -R ${{ inputs.k6-libs-folder }}/* docker/${{ inputs.k6-libs-folder }}/

      - name: Build the tagged Docker image
        run: docker build --tag ${{ steps.image-metadata.outputs.image-name }}:${{ steps.image-metadata.outputs.image-tag }} docker/

      - name: Run Trivy vulnerability scanner
        uses: felleslosninger/github-workflows/.github/actions/trivy-scan@main
        with:
          image-ref: ${{ steps.image-metadata.outputs.image-name }}:${{ steps.image-metadata.outputs.image-tag }}
          application-path: ${{ inputs.application-path }}
          library-disable-scan: ${{ inputs.trivy-library-disable-scan }}
          library-ignore-unfixed: ${{ inputs.trivy-library-ignore-unfixed }}
          library-severity: ${{ inputs.trivy-library-severity }}
          os-disable-scan: ${{ inputs.trivy-os-disable-scan }}
          os-ignore-unfixed: ${{ inputs.trivy-os-ignore-unfixed }}
          os-severity: ${{ inputs.trivy-os-severity }}
          os-exit-code: ${{ inputs.trivy-os-exit-code }}
          trivy-version: ${{ inputs.trivy-version }}