1+ name : Conatiner Build and Release
2+
3+ on :
4+ workflow_call :
5+ inputs :
6+ version :
7+ description : " Semantic version of the image"
8+ type : string
9+ required : true
10+
11+ container-file :
12+ description : " Path to the Dockerfile"
13+ type : string
14+ default : " Dockerfile"
15+
16+ signing :
17+ description : " Sign the image"
18+ type : string
19+ default : " true"
20+
21+ publish :
22+ description : " Publish the image to the registry"
23+ type : string
24+ default : " true"
25+
26+ sbom :
27+ description : " Generate and upload SBOM"
28+ type : string
29+ default : " true"
30+
31+ scanning :
32+ description : " Scan the image"
33+ type : string
34+ default : " true"
35+
36+ scanning-block :
37+ description : " Block the build if vulnerabilities are found"
38+ type : string
39+ default : " false"
40+
41+ tags :
42+ description : " Comma-separated list of tags"
43+ type : string
44+ default : " latest"
45+
46+ env :
47+ REGISTRY : ghcr.io
48+ IMAGE_NAME : ${{ github.repository }}
49+
50+ jobs :
51+ build-publish-image :
52+ runs-on : ubuntu-latest
53+
54+ outputs :
55+ digest : ${{ steps.build.outputs.digest }}
56+
57+ permissions :
58+ # to upload SBOM
59+ id-token : write
60+ contents : write
61+ # to upload Docker image
62+ packages : write
63+
64+ steps :
65+ - name : Checkout repository
66+ uses : actions/checkout@v4
67+
68+ - name : Set up Docker Buildx
69+ uses : docker/setup-buildx-action@v3
70+
71+ - name : Log in to the Container registry
72+ uses : docker/login-action@v3.1.0
73+ with :
74+ registry : ${{ env.REGISTRY }}
75+ username : ${{ github.actor }}
76+ password : ${{ secrets.GITHUB_TOKEN }}
77+
78+ - name : Extract metadata (tags, labels) for Docker
79+ id : meta
80+ uses : docker/metadata-action@v5.5.1
81+ with :
82+ images : ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
83+ tags : |
84+ # latest / main
85+ type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') }}
86+ # SemVer
87+ type=semver,pattern={{version}},value=${{ inputs.version }}
88+ # SemVer, major only
89+ type=semver,pattern=v{{major}},value=${{ inputs.version }}
90+
91+ name : Build Docker image
92+ uses : docker/build-push-action@v5.3.0
93+ id : build
94+ with :
95+ file : " ${{ inputs.docker-file }}"
96+ context : .
97+ push : ${{ inputs.publish }}
98+ tags : ${{ steps.meta.outputs.tags }}
99+ labels : ${{ steps.meta.outputs.labels }}
100+ # SBOM Settings
101+ sbom : true
102+
103+ # Upload Software Bill of Materials (SBOM) to GitHub
104+ - name : Upload SBOM
105+ uses : advanced-security/spdx-dependency-submission-action@v0.0.1
106+ if : ${{ inputs.sbom == 'true' }}
107+ with :
108+ filePath : ' .'
109+ filePattern : ' *.spdx.json'
110+
111+ scanning :
112+ runs-on : ubuntu-latest
113+ needs : build-publish-image
114+ # Scan the image only if it is being published
115+ if : ${{ inputs.scanning == 'true' && inputs.publish == 'true' }}
116+
117+ permissions :
118+ contents : read
119+ # read the image from GitHub Container Registry
120+ packages : read
121+ # to scan the Docker image
122+ security-events : write
123+
124+ steps :
125+ - name : Checkout
126+ uses : actions/checkout@v3
127+
128+ - name : Log in to the Container registry
129+ uses : docker/login-action@v3.1.0
130+ with :
131+ registry : ${{ env.REGISTRY }}
132+ username : ${{ github.actor }}
133+ password : ${{ secrets.GITHUB_TOKEN }}
134+
135+ # Scan the image for vulnerabilities
136+ - name : Run the Anchore Grype scan action
137+ uses : anchore/scan-action@3343887d815d7b07465f6fdcd395bd66508d486a
138+ id : scan
139+ with :
140+ image : " ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ inputs.version }}@${{ needs.build-publish-image.outputs.digest }}"
141+ only-fixed : true
142+ fail-build : ${{ inputs.scanning-block }}
143+
144+ - name : Upload vulnerability report
145+ uses : github/codeql-action/upload-sarif@v3
146+ with :
147+ sarif_file : ${{ steps.scan.outputs.sarif }}
148+
149+ signing :
150+ runs-on : ubuntu-latest
151+ needs : build-publish-image
152+ # Sign the image only if it is being published
153+ if : ${{ inputs.signing == 'true' && inputs.publish == 'true' }}
154+
155+ permissions :
156+ # read the image from GitHub Container Registry
157+ packages : read
158+
159+ steps :
160+ - uses : sigstore/cosign-installer@v3.3.0
161+ with :
162+ cosign-release : ' v2.2.2'
163+
164+ - name : Log in to the Container registry
165+ uses : docker/login-action@v3.1.0
166+ with :
167+ registry : ${{ env.REGISTRY }}
168+ username : ${{ github.actor }}
169+ password : ${{ secrets.GITHUB_TOKEN }}
170+
171+ - name : Sign the published container
172+ # This step uses the identity token to provision an ephemeral certificate against the sigstore community Fulcio instance.
173+ run : |
174+ cosign sign --yes \
175+ ${{ env.IMAGE_NAME }}@${{ steps.build-and-push.outputs.digest }}
176+
0 commit comments