Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix github token missing error #15

Merged
merged 8 commits into from
Oct 29, 2024
Merged

Fix github token missing error #15

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
f8d543f
Fix github token missing error
sarg3nt Oct 29, 2024
6d09497
Fix trivy missing repo in tag during image build.
sarg3nt Oct 29, 2024
8cbf71c
Remove buildx from trivy, see if that fixes it
sarg3nt Oct 29, 2024
8c0b942
Add git checkout back in as trivy needs it to push results.
sarg3nt Oct 29, 2024
d102ec6
Switch to env vars for registry and image in trivy
sarg3nt Oct 29, 2024
c1214de
Try to move permissions to the steps level as desired by security scan
sarg3nt Oct 29, 2024
2d41ce7
Fix permissions
sarg3nt Oct 29, 2024
99df13a
Add email to SECURITY.md as requested by scanner
sarg3nt Oct 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion .github/workflows/patch-upgrades-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,12 @@ on:
schedule:
- cron: '0 0 * * 0' # Runs weekly
workflow_dispatch: # Allows manual triggering
pull_request:
branches:
- main

jobs:
build-and-release:
release:
runs-on: ubuntu-latest
permissions:
contents: write
Expand All @@ -18,3 +21,5 @@ jobs:
# and https://github.com/semantic-release/semantic-release/blob/master/docs/usage/configuration.md#branches
- name: Release
uses: huggingface/semver-release-action@latest
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
8 changes: 2 additions & 6 deletions .github/workflows/trivy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,9 +30,6 @@ jobs:
name: Build
runs-on: "ubuntu-20.04"
steps:
# - name: Authenticate to GitHub Container Registry
# run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin

- name: Log into registry
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
with:
Expand All @@ -51,14 +48,13 @@ jobs:
- name: Build and push Docker image
uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
with:
context: .
push: false
tags: ${{ github.sha }}
tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}

- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2
with:
image-ref: 'ghcr.io/sarg3nt/go-docker-container:${{ github.sha }}'
image-ref: '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}'
format: 'template'
template: '@/contrib/sarif.tpl'
output: 'trivy-results.sarif'
Expand Down