41 lines
1.1 KiB
YAML
41 lines
1.1 KiB
YAML
name: ci
|
|
on: [push]
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: environment
|
|
run: |
|
|
echo "arch: $(uname -m)"
|
|
|
|
- name: run tests
|
|
run: |
|
|
python3 -c "assert 2 + 2 == 4; print('test passed')"
|
|
|
|
- name: build image
|
|
run: |
|
|
cat > Dockerfile <<'DOCKER'
|
|
FROM alpine:latest
|
|
RUN echo "built on $(uname -m)" > /where
|
|
CMD cat /where
|
|
DOCKER
|
|
docker build -t ci-demo:${GITHUB_SHA::7} .
|
|
|
|
- name: scan image for vulnerabilities
|
|
run: |
|
|
# trivy is on the host; the runner shares the host docker socket,
|
|
# so it can see the image we just built
|
|
docker run --rm \
|
|
-v /var/run/docker.sock:/var/run/docker.sock \
|
|
aquasec/trivy:latest image \
|
|
--quiet --scanners vuln --severity HIGH,CRITICAL \
|
|
--exit-code 1 \
|
|
ci-demo:${GITHUB_SHA::7}
|
|
echo "no HIGH or CRITICAL vulnerabilities - image approved"
|
|
|
|
- name: run it
|
|
run: docker run --rm ci-demo:${GITHUB_SHA::7}
|