mirror of
https://github.com/RayLabsHQ/gitea-mirror.git
synced 2026-10-03 05:51:52 +02:00
ARUNAVO RAYandGitHub
f581292912
The Scout action rejects a digest reference with "missing or wrong image input", which failed the v3.36.2 tag build after the push and skipped the Helm chart publish. Scan the tag the run pushed: the release tag on a tag build, edge on a main or scheduled build.
457 lines
18 KiB
YAML
457 lines
18 KiB
YAML
name: Docker Build, Push & Security Scan
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
tags: ['v*']
|
|
paths:
|
|
- 'Dockerfile'
|
|
- '.dockerignore'
|
|
- 'package.json'
|
|
- 'bun.lock*'
|
|
- '.github/workflows/docker-build.yml'
|
|
- 'docker-entrypoint.sh'
|
|
- 'drizzle/**'
|
|
- 'scripts/**'
|
|
- 'src/**'
|
|
pull_request:
|
|
paths:
|
|
- 'Dockerfile'
|
|
- '.dockerignore'
|
|
- 'package.json'
|
|
- 'bun.lock*'
|
|
- '.github/workflows/docker-build.yml'
|
|
- 'docker-entrypoint.sh'
|
|
- 'drizzle/**'
|
|
- 'scripts/**'
|
|
- 'src/**'
|
|
schedule:
|
|
- cron: '0 0 * * 0' # Weekly security scan on Sunday at midnight
|
|
|
|
# One build per ref at a time. A merge and the release bump that follows it
|
|
# land on main seconds apart and used to race each other for the latest tag
|
|
# (#425). Branch and PR builds cancel the older run; tag builds always finish.
|
|
concurrency:
|
|
group: docker-build-${{ github.ref }}
|
|
cancel-in-progress: ${{ !startsWith(github.ref, 'refs/tags/') }}
|
|
|
|
env:
|
|
REGISTRY: ghcr.io
|
|
IMAGE: ${{ github.repository }}
|
|
SHA: ${{ github.event.pull_request.head.sha || github.event.after }}
|
|
|
|
jobs:
|
|
docker:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 25
|
|
|
|
permissions:
|
|
contents: write
|
|
packages: write
|
|
security-events: write
|
|
pull-requests: write
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
with:
|
|
ref: ${{ env.SHA }}
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
|
|
with:
|
|
driver-opts: network=host
|
|
|
|
- name: Log into registry
|
|
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
|
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
|
|
with:
|
|
registry: ${{ env.REGISTRY }}
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
# Login to Docker Hub for Docker Scout (optional - provides better vulnerability data)
|
|
# Add DOCKERHUB_USERNAME and DOCKERHUB_TOKEN secrets to enable this.
|
|
# Skipped on fork PRs: GitHub never exposes repository secrets to them,
|
|
# so the login could only fail with "Username and password required".
|
|
- name: Log into Docker Hub
|
|
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
|
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
|
|
continue-on-error: true
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
|
|
# Extract version from tag if present
|
|
- name: Extract version from tag
|
|
id: tag_version
|
|
run: |
|
|
if [[ $GITHUB_REF == refs/tags/v* ]]; then
|
|
TAG_VERSION="${GITHUB_REF#refs/tags/}"
|
|
if [[ ! "$TAG_VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ ]]; then
|
|
echo "::error::Release tag '${TAG_VERSION}' is invalid. Expected semver tag format like v1.2.3 or v1.2.3-rc.1"
|
|
exit 1
|
|
fi
|
|
APP_VERSION="${TAG_VERSION#v}"
|
|
echo "VERSION=${TAG_VERSION}" >> $GITHUB_OUTPUT
|
|
echo "APP_VERSION=${APP_VERSION}" >> $GITHUB_OUTPUT
|
|
echo "Using version tag: ${TAG_VERSION}"
|
|
else
|
|
echo "VERSION=edge" >> $GITHUB_OUTPUT
|
|
echo "APP_VERSION=dev" >> $GITHUB_OUTPUT
|
|
echo "No version tag, using 'edge'"
|
|
fi
|
|
|
|
# Keep version files aligned automatically for tag-based releases
|
|
- name: Sync app version from release tag
|
|
if: startsWith(github.ref, 'refs/tags/v')
|
|
run: |
|
|
VERSION="${{ steps.tag_version.outputs.APP_VERSION }}"
|
|
echo "Syncing package.json version to ${VERSION}"
|
|
|
|
jq --arg version "${VERSION}" '.version = $version' package.json > package.json.tmp
|
|
mv package.json.tmp package.json
|
|
|
|
echo "Version sync diff (package.json):"
|
|
git --no-pager diff -- package.json
|
|
|
|
# Extract metadata for Docker
|
|
- name: Extract Docker metadata
|
|
id: meta
|
|
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
|
|
with:
|
|
images: ${{ env.REGISTRY }}/${{ env.IMAGE }}
|
|
labels: |
|
|
org.opencontainers.image.revision=${{ env.SHA }}
|
|
# latest follows the release tag, not main: a main build can carry
|
|
# an unreleased package.json and must never overwrite a release.
|
|
# Pre-release tags (v1.2.3-rc.1) keep latest on the last stable one.
|
|
tags: |
|
|
type=edge,branch=main
|
|
type=semver,pattern=v{{version}}
|
|
type=sha,prefix=,suffix=,format=short
|
|
type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-') }}
|
|
type=raw,value=${{ steps.tag_version.outputs.VERSION }},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
|
|
type=ref,event=pr,prefix=pr-
|
|
|
|
# Build and push Docker image
|
|
- name: Build and push Docker image
|
|
id: build-and-push
|
|
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
|
|
with:
|
|
context: .
|
|
platforms: linux/amd64,linux/arm64
|
|
push: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
cache-from: type=gha
|
|
# The runner stage installs Debian security updates; never serve it from cache.
|
|
no-cache-filters: runner
|
|
cache-to: type=gha,mode=max
|
|
provenance: false # Disable provenance to avoid unknown/unknown
|
|
sbom: false # Disable sbom to avoid unknown/unknown
|
|
|
|
# Load image locally for security scanning (PRs only)
|
|
- name: Load image for scanning
|
|
if: github.event_name == 'pull_request'
|
|
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
|
|
with:
|
|
context: .
|
|
platforms: linux/amd64
|
|
load: true
|
|
tags: gitea-mirror:scan
|
|
cache-from: type=gha
|
|
# The runner stage installs Debian security updates; never serve it from cache.
|
|
no-cache-filters: runner
|
|
provenance: false # Disable provenance to avoid unknown/unknown
|
|
sbom: false # Disable sbom to avoid unknown/unknown
|
|
|
|
# Wait for image to be available in registry
|
|
- name: Wait for image availability
|
|
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
|
|
run: |
|
|
echo "Waiting for image to be available in registry..."
|
|
sleep 5
|
|
|
|
# Add comment to PR with image details
|
|
- name: Comment PR with image tag
|
|
if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
|
|
uses: actions/github-script@v7
|
|
with:
|
|
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
script: |
|
|
const prNumber = context.payload.pull_request.number;
|
|
const imageTag = `pr-${prNumber}`;
|
|
const imagePath = `${{ env.REGISTRY }}/${{ env.IMAGE }}:${imageTag}`.toLowerCase();
|
|
|
|
const comment = `## 🐳 Docker Image Built Successfully
|
|
|
|
Your PR image is available for testing:
|
|
|
|
**Image Tag:** \`${imageTag}\`
|
|
**Full Image Path:** \`${imagePath}\`
|
|
|
|
### Pull and Test
|
|
\`\`\`bash
|
|
docker pull ${imagePath}
|
|
docker run -d \
|
|
-p 4321:4321 \
|
|
-e BETTER_AUTH_SECRET=your-secret-here \
|
|
-e BETTER_AUTH_URL=http://localhost:4321 \
|
|
--name gitea-mirror-test ${imagePath}
|
|
\`\`\`
|
|
|
|
### Docker Compose Testing
|
|
\`\`\`yaml
|
|
services:
|
|
gitea-mirror:
|
|
image: ${imagePath}
|
|
ports:
|
|
- "4321:4321"
|
|
environment:
|
|
- BETTER_AUTH_SECRET=your-secret-here
|
|
- BETTER_AUTH_URL=http://localhost:4321
|
|
- BETTER_AUTH_TRUSTED_ORIGINS=http://localhost:4321
|
|
\`\`\`
|
|
|
|
> 💡 **Note:** PR images are tagged as \`pr-<number>\` and built for both \`linux/amd64\` and \`linux/arm64\`.
|
|
> Production images (\`latest\`, version tags) use the same multi-platform set.
|
|
|
|
---
|
|
📦 View in [GitHub Packages](https://github.com/${{ github.repository }}/pkgs/container/gitea-mirror)`;
|
|
|
|
github.rest.issues.createComment({
|
|
issue_number: prNumber,
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
body: comment
|
|
});
|
|
|
|
# Docker Scout comprehensive security analysis
|
|
- name: Docker Scout - Vulnerability Analysis & Recommendations
|
|
uses: docker/scout-action@bacf462e8d090c09660de30a6ccc718035f961e3 # v1.20.4
|
|
if: github.event_name != 'pull_request'
|
|
with:
|
|
command: cves,recommendations
|
|
# Scan the image this run pushed: the release tag on a tag build,
|
|
# edge on a main or scheduled build. The action rejects digest
|
|
# references ("missing or wrong image input").
|
|
image: ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ steps.tag_version.outputs.VERSION }}
|
|
sarif-file: scout-results.sarif
|
|
summary: true
|
|
exit-code: false
|
|
only-severities: critical,high
|
|
# OpenVEX statements in .vex/ mark CVEs the image cannot reach as
|
|
# not affected (see .vex/README.md). Scout only accepts statements
|
|
# from authors listed here; the default is *@docker.com.
|
|
vex-location: .vex
|
|
vex-author: developer@arunavoray.dev
|
|
only-vex-affected: true
|
|
write-comment: true
|
|
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
# Docker Scout for Pull Requests (using local image).
|
|
# Same-repo PRs only: Scout needs the Docker Hub login above, and fork
|
|
# PRs never receive the secrets for it. They used to fail here with
|
|
# "user githubactions not entitled to use Docker Scout". Fork PRs get
|
|
# the credential-free Trivy scan further down instead.
|
|
- name: Docker Scout - Vulnerability Analysis (PR)
|
|
uses: docker/scout-action@bacf462e8d090c09660de30a6ccc718035f961e3 # v1.20.4
|
|
if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
|
|
with:
|
|
command: cves,recommendations
|
|
image: local://gitea-mirror:scan
|
|
sarif-file: scout-results.sarif
|
|
summary: true
|
|
exit-code: false
|
|
only-severities: critical,high
|
|
vex-location: .vex
|
|
vex-author: developer@arunavoray.dev
|
|
only-vex-affected: true
|
|
write-comment: true
|
|
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
# Compare to latest (same-repo PRs only, same reason as above)
|
|
- name: Docker Scout - Compare to Latest
|
|
uses: docker/scout-action@bacf462e8d090c09660de30a6ccc718035f961e3 # v1.20.4
|
|
if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
|
|
with:
|
|
command: compare
|
|
image: local://gitea-mirror:scan
|
|
to: ${{ env.REGISTRY }}/${{ env.IMAGE }}:latest
|
|
ignore-unchanged: true
|
|
only-severities: critical,high
|
|
write-comment: true
|
|
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
# Trivy runs on every PR, forks included. It needs no credentials, so it
|
|
# is the scan external contributors actually get. Results go to the job
|
|
# summary because GITHUB_TOKEN is read-only on fork PRs (no PR comments,
|
|
# no SARIF upload). Informational only, matching Scout's exit-code: false.
|
|
- name: Trivy - Vulnerability Analysis (PR)
|
|
if: github.event_name == 'pull_request'
|
|
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
|
|
with:
|
|
image-ref: gitea-mirror:scan
|
|
scanners: vuln
|
|
format: table
|
|
output: trivy-results.txt
|
|
severity: CRITICAL,HIGH
|
|
ignore-unfixed: true
|
|
exit-code: '0'
|
|
|
|
- name: Trivy - Write job summary
|
|
if: github.event_name == 'pull_request'
|
|
run: |
|
|
{
|
|
echo "## Trivy image scan (critical and high, fixable only)"
|
|
echo
|
|
echo "Image: \`gitea-mirror:scan\` built from this PR. Unfixed vulnerabilities are hidden."
|
|
echo
|
|
if [ -s trivy-results.txt ]; then
|
|
echo '```'
|
|
cat trivy-results.txt
|
|
echo '```'
|
|
else
|
|
echo "No critical or high vulnerabilities with an available fix."
|
|
fi
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
# GitHub rejects SARIF files where a single result carries more than
|
|
# 1000 relatedLocations, which Scout produces for widely-referenced OS
|
|
# packages — every upload had been silently failing on this since May
|
|
# ("rejecting SARIF, as there are more related locations per result than
|
|
# allowed"). Cap them so uploads flow and stale alerts can auto-close.
|
|
- name: Sanitize Scout SARIF (cap relatedLocations)
|
|
if: always()
|
|
continue-on-error: true
|
|
run: |
|
|
if [ -f scout-results.sarif ]; then
|
|
jq '(.runs[]?.results[]?) |= (if .relatedLocations then .relatedLocations |= .[:100] else . end)' \
|
|
scout-results.sarif > scout-results.sanitized.sarif
|
|
mv scout-results.sanitized.sarif scout-results.sarif
|
|
fi
|
|
|
|
# Upload security scan results to GitHub Security tab.
|
|
# Skipped when no Scout step ran (fork PRs), otherwise the upload
|
|
# errors with "Path does not exist: scout-results.sarif".
|
|
- name: Upload Docker Scout scan results to GitHub Security tab
|
|
uses: github/codeql-action/upload-sarif@v4
|
|
if: always() && hashFiles('scout-results.sarif') != ''
|
|
continue-on-error: true
|
|
with:
|
|
sarif_file: scout-results.sarif
|
|
|
|
sync-version-main:
|
|
name: Sync package.json and Chart.yaml versions back to main
|
|
if: startsWith(github.ref, 'refs/tags/v')
|
|
runs-on: ubuntu-latest
|
|
needs: docker
|
|
permissions:
|
|
contents: write
|
|
|
|
steps:
|
|
- name: Checkout default branch
|
|
uses: actions/checkout@v4
|
|
with:
|
|
ref: ${{ github.event.repository.default_branch }}
|
|
|
|
- name: Update package.json and Chart.yaml versions on main
|
|
env:
|
|
TAG_VERSION: ${{ github.ref_name }}
|
|
TARGET_BRANCH: ${{ github.event.repository.default_branch }}
|
|
run: |
|
|
if [[ ! "$TAG_VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ ]]; then
|
|
echo "::error::Release tag '${TAG_VERSION}' is invalid. Expected semver tag format like v1.2.3 or v1.2.3-rc.1"
|
|
exit 1
|
|
fi
|
|
|
|
APP_VERSION="${TAG_VERSION#v}"
|
|
echo "Syncing ${TARGET_BRANCH} package.json and Chart.yaml to ${APP_VERSION}"
|
|
|
|
jq --arg version "${APP_VERSION}" '.version = $version' package.json > package.json.tmp
|
|
mv package.json.tmp package.json
|
|
|
|
# The chart version tracks the app version so the default image tag
|
|
# always points at the release the chart was published with.
|
|
sed -i -E \
|
|
-e "s/^version: .*/version: ${APP_VERSION}/" \
|
|
-e "s/^appVersion: .*/appVersion: \"${APP_VERSION}\"/" \
|
|
helm/gitea-mirror/Chart.yaml
|
|
|
|
if git diff --quiet -- package.json helm/gitea-mirror/Chart.yaml; then
|
|
echo "Versions on ${TARGET_BRANCH} already at ${APP_VERSION}; nothing to commit."
|
|
exit 0
|
|
fi
|
|
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
|
git add package.json helm/gitea-mirror/Chart.yaml
|
|
git commit -m "chore: sync version to ${APP_VERSION}"
|
|
git push origin "HEAD:${TARGET_BRANCH}"
|
|
|
|
publish-helm-chart:
|
|
name: Publish Helm chart to ghcr.io
|
|
# Runs after the image for this tag is on the registry, so the chart never
|
|
# points at an image that does not exist yet. The chart version and
|
|
# appVersion both follow the release version.
|
|
if: startsWith(github.ref, 'refs/tags/v')
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
needs: docker
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
|
|
steps:
|
|
- name: Checkout tag
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Resolve version
|
|
id: version
|
|
env:
|
|
TAG_VERSION: ${{ github.ref_name }}
|
|
run: |
|
|
if [[ ! "$TAG_VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ ]]; then
|
|
echo "::error::Release tag '${TAG_VERSION}' is invalid. Expected semver tag format like v1.2.3 or v1.2.3-rc.1"
|
|
exit 1
|
|
fi
|
|
echo "version=${TAG_VERSION#v}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Setup Helm
|
|
uses: azure/setup-helm@v4
|
|
with:
|
|
version: v3.19.0
|
|
|
|
- name: Lint and package chart
|
|
env:
|
|
VERSION: ${{ steps.version.outputs.version }}
|
|
run: |
|
|
helm lint ./helm/gitea-mirror
|
|
helm package ./helm/gitea-mirror \
|
|
--version "$VERSION" \
|
|
--app-version "$VERSION" \
|
|
--destination dist
|
|
|
|
- name: Log into registry
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
ACTOR: ${{ github.actor }}
|
|
run: |
|
|
echo "$GITHUB_TOKEN" | helm registry login "$REGISTRY" --username "$ACTOR" --password-stdin
|
|
|
|
- name: Push chart
|
|
env:
|
|
VERSION: ${{ steps.version.outputs.version }}
|
|
OWNER: ${{ github.repository_owner }}
|
|
run: |
|
|
OWNER_LC="$(echo "$OWNER" | tr '[:upper:]' '[:lower:]')"
|
|
helm push "dist/gitea-mirror-${VERSION}.tgz" "oci://${REGISTRY}/${OWNER_LC}/charts"
|
|
{
|
|
echo "### Helm chart ${VERSION} published"
|
|
echo
|
|
echo '```bash'
|
|
echo "helm upgrade --install gitea-mirror oci://${REGISTRY}/${OWNER_LC}/charts/gitea-mirror --version ${VERSION}"
|
|
echo '```'
|
|
} >> "$GITHUB_STEP_SUMMARY"
|