name: Build on: workflow_dispatch: push: branches: - main # Ignore Markdown files paths-ignore: - '**.md' schedule: # Build the image regularly (each Saturday) - cron: '0 22 * * 6' env: REGISTRY: ghcr.io IMAGE_NAME: tommytran732/synapse jobs: build: name: Build & push new image runs-on: "ubuntu-latest" permissions: contents: read packages: write id-token: write steps: - name: Checkout code uses: actions/checkout@v2 - name: Extract version for tags run: | echo "FULL_VERSION=$(grep -oP '(?<=SYNAPSE_VERSION=).*' Dockerfile | head -c6)" >> $GITHUB_ENV echo "MAJOR_VERSION=$(grep -oP '(?<=SYNAPSE_VERSION=).*' Dockerfile | head -c4)" >> $GITHUB_ENV - name: Install cosign if: github.event_name != 'pull_request' uses: sigstore/cosign-installer@main - name: Set up Docker Buildx uses: docker/setup-buildx-action@v2 - name: Login to registry if: github.event_name != 'pull_request' uses: docker/login-action@v2 with: registry: ${{ env.REGISTRY }} username: ${{ github.repository_owner }} password: ${{ secrets.GITHUB_TOKEN }} - name: Set Docker metadata id: meta uses: docker/metadata-action@v4 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} tags: | latest ${{ env.FULL_VERSION }} ${{ env.MAJOR_VERSION }} - name: Build and push Docker image id: build-and-push uses: docker/build-push-action@v3 with: context: . push: ${{ github.event_name != 'pull_request' }} tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} - name: Sign the published Docker image if: ${{ github.event_name != 'pull_request' }} run: cosign sign ${TAGS} -y env: COSIGN_EXPERIMENTAL: "true" TAGS: ${{ steps.meta.outputs.tags }} scan: name: Scan current image & report results needs: build runs-on: "ubuntu-latest" steps: - name: Run Trivy vulnerability scanner uses: aquasecurity/trivy-action@master with: image-ref: 'ghcr.io/tommytran732/synapse' format: 'template' template: '@/contrib/sarif.tpl' output: 'trivy-results.sarif' severity: 'CRITICAL,HIGH' vuln-type: "os" - name: Upload Trivy scan results to GitHub Security tab uses: github/codeql-action/upload-sarif@v2 with: sarif_file: 'trivy-results.sarif'