-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
31101e7
commit 37a4d7b
Showing
2 changed files
with
218 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,175 @@ | ||
| name: Build docker image, run CodeQL and scan for vulnerabilities | ||
|
|
||
| on: | ||
| workflow_call: | ||
| inputs: | ||
| name: | ||
| description: 'Name of application. Do not include namespace.' | ||
| required: true | ||
| type: string | ||
| namespace: | ||
| description: 'Namespace or system of the application.' | ||
| required: true | ||
| type: string | ||
| environment: | ||
| description: 'Github Environment.' | ||
| required: true | ||
| type: string | ||
| dockerfile: | ||
| description: 'Path to Dockerfile.' | ||
| required: true | ||
| type: string | ||
| dockerBuildContext: | ||
| description: 'Docker build context. It is the working directory needed to build the dockerfile. Defaults to the directory with the Dockerfile.' | ||
| required: false | ||
| type: string | ||
| languages: | ||
| description: 'List of languages to run CodeQL on, As JSON array. Defaults to ["csharp"]. The supported languages are c-cpp, csharp, go, java-kotlin, javascript-typescript, python, ruby, swift.' | ||
| required: false | ||
| default: '["csharp"]' | ||
| type: string | ||
| severity: | ||
| description: 'Severity levels to scan for. See https://github.com/aquasecurity/trivy-action?tab=readme-ov-file#inputs for more information.' | ||
| required: false | ||
| default: 'CRITICAL,HIGH' | ||
| type: string | ||
| AZURE_CLIENT_ID: | ||
| description: 'ClientId of a service principal that can push to Container Registry.' | ||
| required: false | ||
| default: '' | ||
| type: string | ||
| AZURE_TENANT_ID: | ||
| description: 'TenantId of a service principal that can push to Azure Container Registry.' | ||
| required: false | ||
| default: '' | ||
| type: string | ||
| ACR_SUBSCRIPTION_ID: | ||
| description: 'Subscription ID of the Azure Container Registry to push to.' | ||
| required: false | ||
| default: '' | ||
| type: string | ||
| ACR_NAME: | ||
| description: 'Name of the Azure Container Registry to push to.' | ||
| required: false | ||
| default: containerregistryelvia | ||
| type: string | ||
|
|
||
| env: | ||
| image_tag: ${{ github.sha }}-${{ github.run_number }} | ||
| image_full_name: containerregistryelvia.azurecr.io/${{ inputs.namespace }}-${{ inputs.name }}:${{ github.sha }}-${{ github.run_number }} | ||
|
|
||
| jobs: | ||
| analyze: | ||
| name: CodeQL Analyze | ||
| runs-on: 'ubuntu-latest' | ||
| timeout-minutes: 15 | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| language: ${{ fromJSON(inputs.languages) }} | ||
| # CodeQL supports [ 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift' ] | ||
|
|
||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@v3 | ||
| with: | ||
| languages: ${{ matrix.language }} | ||
|
|
||
| - name: Autobuild | ||
| uses: github/codeql-action/autobuild@v3 | ||
|
|
||
| - name: Perform CodeQL Analysis | ||
| uses: github/codeql-action/analyze@v3 | ||
| with: | ||
| category: "/language:${{matrix.language}}" | ||
|
|
||
| build: | ||
| name: Build and Scan | ||
| runs-on: ubuntu-latest | ||
| environment: ${{ inputs.environment }} | ||
| steps: | ||
| - name: Parse input | ||
| run: | | ||
| if [ -z "${{ inputs.AZURE_CLIENT_ID}}" ] | ||
| then | ||
| echo "AZURE_CLIENT_ID=${{ vars.AZURE_CLIENT_ID}}" >> "$GITHUB_ENV" | ||
| else | ||
| echo "AZURE_CLIENT_ID=${{ inputs.AZURE_CLIENT_ID}}" >> "$GITHUB_ENV" | ||
| fi | ||
| if [ -z "${{ inputs.AZURE_TENANT_ID}}" ] | ||
| then | ||
| echo "AZURE_TENANT_ID=${{ vars.AZURE_TENANT_ID}}" >> "$GITHUB_ENV" | ||
| else | ||
| echo "AZURE_TENANT_ID=${{ inputs.AZURE_TENANT_ID}}" >> "$GITHUB_ENV" | ||
| fi | ||
| if [ -z "${{ inputs.ACR_SUBSCRIPTION_ID}}" ] | ||
| then | ||
| echo "ACR_SUBSCRIPTION_ID=${{ vars.ACR_SUBSCRIPTION_ID}}" >> "$GITHUB_ENV" | ||
| else | ||
| echo "ACR_SUBSCRIPTION_ID=${{ inputs.ACR_SUBSCRIPTION_ID}}" >> "$GITHUB_ENV" | ||
| fi | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Build image | ||
| run: | | ||
| if [ -z "${{ inputs.dockerBuildContext}}" ] | ||
| then | ||
| dir=`dirname ${{ inputs.dockerfile}}` # default to the directory of the Dockerfile | ||
| else | ||
| dir=${{ inputs.dockerBuildContext}} | ||
| fi | ||
| docker build --tag ${{ env.image_full_name}} -f ${{ inputs.dockerfile}} $dir | ||
| - name: Run Trivy vulnerability scanner | ||
| uses: aquasecurity/trivy-action@master | ||
| with: | ||
| image-ref: ${{ env.image_full_name}} | ||
| format: 'table' | ||
| exit-code: '1' | ||
| ignore-unfixed: true | ||
| severity: ${{ inputs.severity }} | ||
| github-pat: ${{ secrets.GITHUB_TOKEN }} | ||
| if: github.event_name == 'pull_request' | ||
|
|
||
| - name: Run Trivy vulnerability scanner | ||
| uses: aquasecurity/trivy-action@master | ||
| with: | ||
| image-ref: ${{ env.image_full_name}} | ||
| format: 'sarif' | ||
| template: '@/contrib/sarif.tpl' | ||
| output: trivy.sarif | ||
| severity: ${{ inputs.severity }} | ||
| github-pat: ${{ secrets.GITHUB_TOKEN }} | ||
| ignore-unfixed: true | ||
| if: github.event_name == 'push' | ||
|
|
||
| # GitHub Security tab does not support SARIF files with `git::` or `https:/` URL's: | ||
| # https://github.com/aquasecurity/trivy/issues/5003#issuecomment-1780415058 | ||
| - name: Fix Trivy output | ||
| run: sed -i 's#git::https:/##g' "trivy.sarif" | ||
| if: github.event_name == 'push' | ||
|
|
||
| - name: Upload Trivy scan results to GitHub Security tab | ||
| uses: github/codeql-action/upload-sarif@v2 | ||
| with: | ||
| sarif_file: trivy.sarif | ||
| category: 'Trivy' | ||
| if: github.event_name == 'push' | ||
|
|
||
| - name: Authenticate with Azure | ||
| uses: azure/login@v1 | ||
| with: | ||
| client-id: ${{ env.AZURE_CLIENT_ID }} | ||
| tenant-id: ${{ env.AZURE_TENANT_ID }} | ||
| subscription-id: ${{ env.ACR_SUBSCRIPTION_ID }} | ||
|
|
||
| - name: Login ACR | ||
| run: az acr login --name ${{ inputs.ACR_NAME }} | ||
|
|
||
| - name: Push image | ||
| run: docker push ${{ env.image_full_name}} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters