Added a few more vulnerabilities to ignore during security scanning a… #43
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI/CD Pipeline | |
| on: | |
| push: | |
| branches: [ main ] | |
| jobs: | |
| build-and-deploy: | |
| runs-on: ubuntu-22.04 | |
| permissions: | |
| contents: write | |
| packages: write | |
| env: | |
| IMAGE_NAME: ghcr.io/janemils/devops-project-1 | |
| steps: | |
| # Checkout code. | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| # Secret detection (Day-07). | |
| - name: Run Gitleaks | |
| uses: gitleaks/gitleaks-action@v2 | |
| # Login to GHCR. | |
| - name: Login to GHCR | |
| run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin | |
| # Build Docker image. | |
| - name: Build image | |
| run: | | |
| docker build \ | |
| -t $IMAGE_NAME:${{ github.sha }} \ | |
| -f Day-02/Dockerfile \ | |
| . | |
| # Installing Grype for security scanning of image (Day-07). | |
| - name: Install Grype | |
| run: | | |
| curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh | |
| sudo mv ./bin/grype /usr/local/bin/ | |
| # Scan image for vulnerabilities (Day-07). | |
| - name: Scan Image | |
| run: | | |
| grype $IMAGE_NAME:${{ github.sha }} \ | |
| --config .grype.yaml \ | |
| --fail-on high | |
| # Push image. | |
| - name: Push image | |
| run: | | |
| docker push $IMAGE_NAME:${{ github.sha }} | |
| # Updating the image in the manifest. | |
| - name: Update manifest (robust) | |
| run: | | |
| sed -i '/image:/c\ image: '"$IMAGE_NAME:${{ github.sha }}" Day-03/deployment.yaml | |
| # For debugging purpose. | |
| - name: Show updated file | |
| run: | | |
| echo "===== UPDATED FILE =====" | |
| cat Day-03/deployment.yaml | |
| - name: Show git diff | |
| run: git diff | |
| # Commit to the repo for ArgoCD to pick up. | |
| - name: Commit and push changes | |
| run: | | |
| git config user.name "github-actions" | |
| git config user.email "actions@github.com" | |
| git add Day-03/deployment.yaml | |
| if git diff --cached --quiet; then | |
| echo "No changes to commit" | |
| else | |
| git commit -m "Update image to $IMAGE_NAME:${{ github.sha }} [skip ci]" | |
| git push origin main | |
| fi | |
| # Deleting the older images. At a time, only 3 images must exist in the registry. | |
| - name: Delete old images | |
| uses: actions/delete-package-versions@v5 | |
| with: | |
| package-name: devops-project-1 | |
| package-type: container | |
| min-versions-to-keep: 3 |