build(deps): bump github.com/google/go-containerregistry from 0.19.2 to 0.20.0 #6827
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
name: build | |
on: | |
push: | |
branches: | |
- main | |
release: | |
types: [published] | |
pull_request: | |
env: | |
GO_VERSION: '1.22' | |
NIX_VERSION: '2.18.1' | |
BOM_VERSION: v0.5.1 | |
concurrency: | |
group: ${{ github.workflow }}-${{ github.ref }} | |
cancel-in-progress: true | |
permissions: {} | |
jobs: | |
macos: | |
runs-on: macos-12 | |
steps: | |
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
- uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1 | |
with: | |
go-version: ${{ env.GO_VERSION }} | |
- run: make test-unit | |
- run: make verify-go-lint | |
nix: | |
runs-on: ubuntu-22.04 | |
steps: | |
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
- uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27 | |
with: | |
install_url: https://releases.nixos.org/nix/nix-${{ env.NIX_VERSION }}/install | |
- uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15 | |
with: | |
name: security-profiles-operator | |
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}' | |
pushFilter: security-profiles-operator | |
- run: make nix | |
- uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4 | |
with: | |
name: build | |
path: build.tar.gz | |
nix-spoc: | |
if: github.ref == 'refs/heads/main' || contains(github.ref, 'refs/tags') | |
runs-on: ubuntu-22.04 | |
permissions: | |
contents: write # required for updating the release | |
id-token: write # required for sigstore signing | |
steps: | |
- uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0 | |
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
- uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27 | |
with: | |
install_url: https://releases.nixos.org/nix/nix-${{ env.NIX_VERSION }}/install | |
- uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15 | |
with: | |
name: security-profiles-operator | |
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}' | |
pushFilter: security-profiles-operator | |
- run: | | |
sudo curl -sSfL --retry 5 --retry-delay 3 -o /usr/bin/bom \ | |
https://github.com/kubernetes-sigs/bom/releases/download/${{ env.BOM_VERSION }}/bom-amd64-linux | |
sudo chmod +x /usr/bin/bom | |
- run: make nix-spoc | |
- uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4 | |
with: | |
name: spoc | |
path: | | |
build/* | |
- uses: softprops/action-gh-release@a74c6b72af54cfa997e81df42d94703d6313a2d0 # v2.0.6 | |
if: startsWith(github.ref, 'refs/tags/') | |
with: | |
files: | | |
build/* | |
bpf: | |
runs-on: ubuntu-22.04 | |
steps: | |
- uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1 | |
with: | |
go-version: ${{ env.GO_VERSION }} | |
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
- uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27 | |
with: | |
install_url: https://releases.nixos.org/nix/nix-${{ env.NIX_VERSION }}/install | |
- uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15 | |
with: | |
name: security-profiles-operator | |
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}' | |
pushFilter: security-profiles-operator | |
- run: make verify-bpf | |
build-image: | |
runs-on: ubuntu-22.04 | |
steps: | |
- name: Remove unnecessary files | |
run: | | |
sudo rm -rf /usr/share/dotnet | |
sudo rm -rf "$AGENT_TOOLSDIRECTORY" | |
sudo rm -rf /opt/ghc | |
sudo rm -rf /usr/local/share/boost | |
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
- name: Set up Docker Buildx | |
id: buildx | |
uses: docker/setup-buildx-action@4fd812986e6c8c2a69e18311145f9371337f27d4 # v3.0.0 | |
- name: Login to Quay | |
uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0 | |
with: | |
registry: quay.io/security-profiles-operator | |
username: security-profiles-operator+github | |
password: ${{ secrets.QUAY_TOKEN }} | |
if: github.ref == 'refs/heads/main' | |
- name: Image metadata | |
id: meta | |
uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1 | |
with: | |
images: | | |
quay.io/security-profiles-operator/build | |
tags: | | |
type=ref,event=branch | |
type=ref,event=pr | |
type=ref,event=tag | |
type=sha,format=long | |
- name: Build (and push if needed) | |
uses: docker/build-push-action@1a162644f9a7e87d8f4b053101d1d9a712edc18c # v6.3.0 | |
with: | |
context: . | |
file: Dockerfile.build-image | |
tags: ${{ steps.meta.outputs.tags }} | |
labels: ${{ steps.meta.outputs.labels }} | |
push: ${{ github.ref == 'refs/heads/main' }} | |
# Only load on PR builds | |
load: ${{ github.ref != 'refs/heads/main' }} | |
- name: Run container image vulnerability scanner | |
uses: aquasecurity/trivy-action@d710430a6722f083d3b36b8339ff66b32f22ee55 # 0.19.0 | |
with: | |
image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }} | |
format: 'table' | |
exit-code: '0' | |
ignore-unfixed: true | |
vuln-type: 'os,library' | |
severity: 'CRITICAL,HIGH' | |
timeout: 30m | |
operator-image: | |
runs-on: ubuntu-22.04 | |
steps: | |
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
- name: Set up Docker Buildx | |
id: buildx | |
uses: docker/setup-buildx-action@4fd812986e6c8c2a69e18311145f9371337f27d4 # v3.4.0 | |
- name: Login to Quay | |
uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0 | |
with: | |
registry: quay.io/security-profiles-operator | |
username: security-profiles-operator+github | |
password: ${{ secrets.QUAY_TOKEN }} | |
if: github.ref == 'refs/heads/main' | |
- name: Image metadata | |
id: meta | |
uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1 | |
with: | |
images: | | |
quay.io/security-profiles-operator/spo | |
tags: | | |
type=ref,event=branch | |
type=ref,event=pr | |
type=ref,event=tag | |
type=sha,format=long | |
- name: Build | |
uses: docker/build-push-action@1a162644f9a7e87d8f4b053101d1d9a712edc18c # v6.3.0 | |
with: | |
context: . | |
file: Dockerfile | |
tags: ${{ steps.meta.outputs.tags }} | |
labels: ${{ steps.meta.outputs.labels }} | |
load: true | |
- name: Run container image vulnerability scanner | |
uses: aquasecurity/trivy-action@d710430a6722f083d3b36b8339ff66b32f22ee55 # 0.19.0 | |
with: | |
image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }} | |
format: 'table' | |
exit-code: '1' | |
ignore-unfixed: true | |
vuln-type: 'os,library' | |
severity: 'CRITICAL,HIGH' | |
ubi-image: | |
runs-on: ubuntu-22.04 | |
steps: | |
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
- name: Set up Docker Buildx | |
id: buildx | |
uses: docker/setup-buildx-action@4fd812986e6c8c2a69e18311145f9371337f27d4 # v3.4.0 | |
- name: Login to Quay | |
uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0 | |
with: | |
registry: quay.io/security-profiles-operator | |
username: security-profiles-operator+github | |
password: ${{ secrets.QUAY_TOKEN }} | |
if: github.ref == 'refs/heads/main' | |
- name: Image metadata | |
id: meta | |
uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1 | |
with: | |
images: | | |
quay.io/security-profiles-operator/build | |
flavor: | | |
suffix=-ubi | |
tags: | | |
type=ref,event=branch | |
type=ref,event=pr | |
type=ref,event=tag | |
type=sha,format=long | |
# TODO(jaosorior): Push UBI image too | |
- name: Build | |
uses: docker/build-push-action@1a162644f9a7e87d8f4b053101d1d9a712edc18c # v6.3.0 | |
with: | |
context: . | |
file: Dockerfile.ubi | |
tags: ${{ steps.meta.outputs.tags }} | |
labels: ${{ steps.meta.outputs.labels }} | |
load: true | |
- name: Run container image vulnerability scanner | |
uses: aquasecurity/trivy-action@d710430a6722f083d3b36b8339ff66b32f22ee55 # 0.19.0 | |
with: | |
image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }} | |
format: 'table' | |
exit-code: '1' | |
ignore-unfixed: true | |
vuln-type: 'os,library' | |
severity: 'CRITICAL,HIGH' |