fix: use alt mirrors for trivy db #388
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| on: | |
| push: | |
| branches: [master] | |
| release: | |
| types: [created] | |
| pull_request: | |
| branches: [master] | |
| permissions: read-all | |
| jobs: | |
| build: | |
| uses: ./.github/workflows/standard-build.yaml | |
| permissions: | |
| contents: write | |
| id-token: write | |
| packages: write | |
| pull-requests: write | |
| actions: read | |
| security-events: write | |
| with: | |
| # can't use the default "ghcr.io/${{ github.repository }}" since | |
| # "ghcr.io/miracum/.github:pr-1": invalid reference format" | |
| image: ghcr.io/miracum/github-reusable-workflow | |
| enable-build-test-layer: true | |
| enable-upload-test-image: true | |
| platforms: linux/amd64,linux/arm64 | |
| secrets: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| build-without-test-image: | |
| uses: ./.github/workflows/standard-build.yaml | |
| permissions: | |
| contents: write | |
| id-token: write | |
| packages: write | |
| pull-requests: write | |
| actions: read | |
| security-events: write | |
| with: | |
| image: ghcr.io/miracum/github-reusable-workflow-without-test-image | |
| enable-build-test-layer: false | |
| enable-upload-test-image: false | |
| secrets: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| build-with-fixed-image-tags: | |
| uses: ./.github/workflows/standard-build.yaml | |
| permissions: | |
| contents: write | |
| id-token: write | |
| packages: write | |
| pull-requests: write | |
| actions: read | |
| security-events: write | |
| with: | |
| image: ghcr.io/miracum/github-reusable-workflow-with-fixed-image-tags | |
| enable-build-test-layer: true | |
| enable-upload-test-image: true | |
| image-tags: | | |
| type=semver,pattern={{raw}},value=v1.2.3-beta.123 | |
| secrets: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| lint: | |
| uses: ./.github/workflows/standard-lint.yaml | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| issues: write | |
| security-events: write | |
| actions: read | |
| with: | |
| codeql-languages: '["python"]' | |
| enable-codeql: true | |
| secrets: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| test: | |
| runs-on: ubuntu-24.04 | |
| needs: | |
| - build | |
| steps: | |
| # <https://docs.docker.com/storage/containerd/> | |
| # via <https://github.com/docker/setup-buildx-action/issues/257> | |
| - name: Set up containerd image store | |
| shell: bash | |
| run: | | |
| [ -f /etc/docker/daemon.json ] || echo "{}" | sudo tee /etc/docker/daemon.json | |
| jq '. | .+{"features": {"containerd-snapshotter": true}}' /etc/docker/daemon.json > /tmp/docker-daemon-with-containerd.json | |
| sudo mv /tmp/docker-daemon-with-containerd.json /etc/docker/daemon.json | |
| cat /etc/docker/daemon.json | |
| sudo systemctl restart docker | |
| docker info -f '{{ .DriverStatus }}' | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@8026d2bc3645ea78b0d2544766a1225eb5691f89 # v3.7.0 | |
| - name: Download build image | |
| uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8 | |
| if: ${{ github.event_name == 'pull_request' }} | |
| with: | |
| name: ${{ needs.build.outputs.image-slug }} | |
| path: /tmp | |
| - name: Download test image | |
| uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8 | |
| if: ${{ github.event_name == 'pull_request' }} | |
| with: | |
| name: ${{ needs.build.outputs.image-slug }}-test | |
| path: /tmp | |
| - name: ls | |
| run: | | |
| ls -lsa /tmp | |
| - name: load image | |
| if: ${{ github.event_name == 'pull_request' }} | |
| run: | | |
| docker load --input /tmp/image.tar | |
| docker load --input /tmp/image-test.tar | |
| - name: list images | |
| run: | | |
| docker image ls | |
| release: | |
| uses: ./.github/workflows/standard-release.yaml | |
| needs: | |
| - build | |
| - test | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| issues: write | |
| secrets: | |
| semantic-release-token: ${{ secrets.GITHUB_TOKEN }} |