CD Build Canary Distroless Unbound Docker Image #142
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CD Build Canary Distroless Unbound Docker Image | |
| on: | |
| schedule: | |
| - cron: '0 19 * * mon-fri' | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| env: | |
| DOCKERHUB_SLUG: "madnuttah/unbound" | |
| steps: | |
| - name: Checkout source | |
| uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - name: Is update available | |
| id: IS_UPDATE_AVAILABLE | |
| run: | | |
| UNBOUND_GIT_SHA="$(git ls-remote https://github.com/NLnetLabs/unbound.git | head -1 | cut -f 1)" | |
| UNBOUND_SHA="$(cat unbound_git_sha)" | |
| if [[ "$UNBOUND_SHA" = "$UNBOUND_GIT_SHA" ]]; then | |
| echo "No update found" | |
| exit 1 | |
| else | |
| echo "Update found" | |
| echo UNBOUND_GIT_SHA="$UNBOUND_GIT_SHA" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Import GPG key | |
| id: IMPORT_GPG | |
| uses: crazy-max/ghaction-import-gpg@v6 | |
| with: | |
| gpg_private_key: ${{ secrets.BOT_GPG_PRIVATE_KEY }} | |
| passphrase: ${{ secrets.BOT_GPG_PASSPHRASE }} | |
| git_user_signingkey: true | |
| git_commit_gpgsign: true | |
| git_push_gpgsign: false | |
| trust_level: 5 | |
| - name: Push unbound_git_sha to repository | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }} | |
| GIT_AUTHOR_NAME: ${{ steps.IMPORT_GPG.outputs.name }} | |
| GIT_AUTHOR_EMAIL: ${{ steps.IMPORT_GPG.outputs.email }} | |
| GIT_COMMITTER_NAME: ${{ steps.IMPORT_GPG.outputs.name }} | |
| GIT_COMMITTER_EMAIL: ${{ steps.IMPORT_GPG.outputs.email }} | |
| run: | | |
| git remote set-url origin https://x-access-token:${{ secrets.BOT_GITHUB_TOKEN }}@github.com/${{ github.repository }} | |
| echo ${{ steps.IS_UPDATE_AVAILABLE.outputs.UNBOUND_GIT_SHA }} > unbound_git_sha | |
| git add unbound_git_sha | |
| git commit unbound_git_sha -m "Updated unbound_git_sha" | |
| git push origin main | |
| - name: Set buildvars | |
| id: SET_BUILDVARS | |
| run: | | |
| echo IMAGE_BUILD_DATE=$(date -u) >> $GITHUB_OUTPUT | |
| echo UNBOUND_VERSION="$(curl -s https://raw.githubusercontent.com/NLnetLabs/unbound/master/configure | awk -F= '/^version=/ { print $2 }')" >> $GITHUB_OUTPUT | |
| echo OPENSSL_BUILDENV_VERSION="$(curl -s https://api.github.com/repos/madnuttah/openssl-buildenv/releases | jq '.[0] | .name' -r)" >> $GITHUB_OUTPUT | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v3 | |
| - name: Set up Docker Buildx | |
| id: buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Login to Dockerhub | |
| if: github.event_name != 'pull_request' | |
| uses: docker/login-action@v3 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - name: Build and push | |
| uses: docker/build-push-action@v6 | |
| with: | |
| platforms: linux/386,linux/arm/v6,linux/arm/v7,linux/arm64,linux/amd64 | |
| builder: ${{ steps.buildx.outputs.name }} | |
| build-args: | | |
| IMAGE_BUILD_DATE=${{ steps.SET_BUILDVARS.outputs.IMAGE_BUILD_DATE }} | |
| UNBOUND_VERSION=${{ steps.SET_BUILDVARS.outputs.UNBOUND_VERSION }} | |
| OPENSSL_BUILDENV_VERSION=${{ steps.SET_BUILDVARS.outputs.OPENSSL_BUILDENV_VERSION }} | |
| file: ./unbound/canary.Dockerfile | |
| sbom: ${{ github.event_name != 'pull_request' }} | |
| provenance: ${{ github.event_name != 'pull_request' }} | |
| push: ${{ github.event_name != 'pull_request' }} | |
| tags: | | |
| ${{ env.DOCKERHUB_SLUG }}:canary | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@master | |
| if: ${{ github.event_name != 'pull_request' }} | |
| with: | |
| image-ref: ${{ env.DOCKERHUB_SLUG }}:canary | |
| exit-code: '1' | |
| ignore-unfixed: false | |
| scan-type: image | |
| vuln-type: 'os,library' | |
| severity: 'CRITICAL,HIGH' | |
| format: 'table' | |
| - name: Docker Scout CVEs | |
| uses: docker/scout-action@v1 | |
| if: ${{ github.event_name != 'pull_request' }} | |
| with: | |
| command: cves | |
| image: ${{ env.DOCKERHUB_SLUG }}:canary | |
| only-fixed: true | |
| only-severities: critical,high | |
| write-comment: true | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| exit-code: false | |