-
Notifications
You must be signed in to change notification settings - Fork 209
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Fix comment and vulneravility images
- Loading branch information
Showing
1 changed file
with
45 additions
and
49 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -32,58 +32,54 @@ concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | ||
| cancel-in-progress: true | ||
| jobs: | ||
| #imageEKS: | ||
| # name: build-docker-image-EKS | ||
| # if: github.event.action != 'closed' | ||
| # runs-on: ${{ vars.RUNNER }} | ||
| # steps: | ||
| # - name: Set image name | ||
| # run: | | ||
| # RESOLVED_IMAGE_TAG=${{ env.IMAGE_TAG }} | ||
| # echo "IMAGE=${{ secrets.REGISTRY_HOST }}/processmaker/enterprise:$RESOLVED_IMAGE_TAG" >> $GITHUB_ENV | ||
| # - name: Clone repo K8S | ||
| # run: | | ||
| # # TODO: Change branch when pm4 k8s distribution is released | ||
| # echo "IMAGE: ${{ env.IMAGE }}" | ||
| # git clone --depth 1 -b "$K8S_BRANCH" "https://[email protected]/ProcessMaker/pm4-k8s-distribution.git" pm4-k8s-distribution | ||
| # - name: Generate image EKS | ||
| # run: | | ||
| # cd pm4-k8s-distribution/images | ||
| # branch=$CI_PACKAGE_BRANCH tag=${{env.IMAGE_TAG}} bash build.k8s-cicd.sh | ||
| # IMAGE1=$(echo "$CI_PROJECT-$CI_PACKAGE_BRANCH" | sed "s;/;-;g") | ||
| # echo "VERSION=${{ env.IMAGE_TAG }}" >> $GITHUB_ENV | ||
| # echo "IMAGE1=$IMAGE1" >> $GITHUB_ENV | ||
| # - name: List Images | ||
| # run: | | ||
| # docker images | ||
| # echo "VERSION: $VESION" | ||
| # echo "IMAGE1: $IMAGE1" | ||
| # - name: Run Trivy vulnerability scanner | ||
| # uses: aquasecurity/trivy-action@master | ||
| # with: | ||
| # image-ref: processmaker/enterprise:${{ env.VERSION }} | ||
| # format: 'table' | ||
| # exit-code: '0' | ||
| # ignore-unfixed: false | ||
| # vuln-type: 'os,library' | ||
| # scanners: 'vuln,secret' | ||
| # severity: 'MEDIUM,HIGH,CRITICAL' | ||
| # env: | ||
| # TRIVY_TIMEOUT: 30m | ||
| # - name: Login to Harbor | ||
| # uses: docker/login-action@v2 | ||
| # with: | ||
| # registry: ${{ secrets.REGISTRY_HOST }} | ||
| # username: ${{ secrets.REGISTRY_USERNAME }} | ||
| # password: ${{ secrets.REGISTRY_PASSWORD }} | ||
| # - name: Push Enterprise Image to Harbor | ||
| # run: | | ||
| # docker tag processmaker/enterprise:${{env.IMAGE_TAG}} ${{ secrets.REGISTRY_HOST }}/processmaker/enterprise:${{env.IMAGE_TAG}} | ||
| # docker push ${{ secrets.REGISTRY_HOST }}/processmaker/enterprise:${{env.IMAGE_TAG}} | ||
| imageEKS: | ||
| name: build-docker-image-EKS | ||
| if: github.event.action != 'closed' | ||
| runs-on: ${{ vars.RUNNER }} | ||
| steps: | ||
| - name: Set image name | ||
| run: | | ||
| RESOLVED_IMAGE_TAG=${{ env.IMAGE_TAG }} | ||
| echo "IMAGE=${{ secrets.REGISTRY_HOST }}/processmaker/enterprise:$RESOLVED_IMAGE_TAG" >> $GITHUB_ENV | ||
| - name: Clone repo K8S | ||
| run: | | ||
| # TODO: Change branch when pm4 k8s distribution is released | ||
| echo "IMAGE: ${{ env.IMAGE }}" | ||
| git clone --depth 1 -b "$K8S_BRANCH" "https://[email protected]/ProcessMaker/pm4-k8s-distribution.git" pm4-k8s-distribution | ||
| - name: Generate image EKS | ||
| run: | | ||
| cd pm4-k8s-distribution/images | ||
| branch=$CI_PACKAGE_BRANCH tag=${{env.IMAGE_TAG}} bash build.k8s-cicd.sh | ||
| echo "VERSION=${{ env.IMAGE_TAG }}" >> $GITHUB_ENV | ||
| - name: List Images | ||
| run: | | ||
| docker images | ||
| - name: Run Trivy vulnerability scanner | ||
| uses: aquasecurity/trivy-action@master | ||
| with: | ||
| image-ref: processmaker/enterprise:${{ env.VERSION }} | ||
| format: 'table' | ||
| exit-code: '0' | ||
| ignore-unfixed: false | ||
| vuln-type: 'os,library' | ||
| scanners: 'vuln,secret' | ||
| severity: 'MEDIUM,HIGH,CRITICAL' | ||
| env: | ||
| TRIVY_TIMEOUT: 30m | ||
| - name: Login to Harbor | ||
| uses: docker/login-action@v2 | ||
| with: | ||
| registry: ${{ secrets.REGISTRY_HOST }} | ||
| username: ${{ secrets.REGISTRY_USERNAME }} | ||
| password: ${{ secrets.REGISTRY_PASSWORD }} | ||
| - name: Push Enterprise Image to Harbor | ||
| run: | | ||
| docker tag processmaker/enterprise:${{env.IMAGE_TAG}} ${{ secrets.REGISTRY_HOST }}/processmaker/enterprise:${{env.IMAGE_TAG}} | ||
| docker push ${{ secrets.REGISTRY_HOST }}/processmaker/enterprise:${{env.IMAGE_TAG}} | ||
| deployEKS: | ||
| name: build-deploy-EKS | ||
| if: contains(github.event.pull_request.body, 'ci:deploy') | ||
| #needs: imageEKS | ||
| needs: imageEKS | ||
| runs-on: self-hosted | ||
| steps: | ||
| - name: Clone private repository | ||
|
|
||