Update NuGet Dependencies and Add JSON Schema Support for Draft 2020 & Draft-07 - DataEngine #416
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Docker | |
| # This workflow uses actions that are not certified by GitHub. | |
| # They are provided by a third-party and are governed by | |
| # separate terms of service, privacy policy, and support | |
| # documentation. | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: | |
| - 'develop' | |
| - 'release/**' | |
| - 'hotfix/**' | |
| # Publish semver tags as releases. | |
| tags: [ 'v**' ] | |
| pull_request: | |
| branches: | |
| - 'main' | |
| - 'develop' | |
| - 'release/**' | |
| - 'hotfix/**' | |
| permissions: | |
| contents: read | |
| env: | |
| # Use docker.io for Docker Hub if empty | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository_owner }}/dataengine | |
| DOCKERFILE_PATH: source/AAS.TwinEngine.DataEngine/Dockerfile | |
| BUILD_CONTEXT: source | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| # Set up BuildKit Docker container builder to be able to build | |
| # multi-platform images and export cache | |
| # https://github.com/docker/setup-buildx-action | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 | |
| # Login against a Docker registry except on PR | |
| # https://github.com/docker/login-action | |
| - name: Log into registry ${{ env.REGISTRY }} | |
| if: github.event_name != 'pull_request' | |
| uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| # Extract metadata (tags, labels) for Docker | |
| # https://github.com/docker/metadata-action | |
| - name: Extract Docker metadata | |
| id: meta | |
| uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| flavor: | | |
| latest=false | |
| tags: | | |
| type=semver,pattern={{raw}} | |
| # Priority is set to ensure the develop-{{sha}} tag is preferred over other tags for the develop branch | |
| type=raw,value=develop-{{sha}},enable=${{startsWith(github.ref,'refs/heads/develop')}},priority=201 | |
| type=raw,value=develop,enable=${{startsWith(github.ref,'refs/heads/develop')}} | |
| type=raw,value=rc-{{branch}}-{{sha}},enable=${{startsWith(github.ref,'refs/heads/release/')}} | |
| # The following tag is only applied to regular branches except 'develop' and 'release/*' (i.e., not for tags or PRs) | |
| type=raw,value={{branch}}-{{sha}},enable=${{startsWith(github.ref,'refs/heads/') && !startsWith(github.ref,'refs/heads/develop') && !startsWith(github.ref,'refs/heads/release/')}} | |
| type=ref,event=pr | |
| # Build and push Docker image with Buildx (don't push on PR) | |
| # https://github.com/docker/build-push-action | |
| - name: Build and push Docker image | |
| id: build-and-push | |
| uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0 | |
| with: | |
| sbom: true | |
| provenance: mode=max | |
| context: ${{ env.BUILD_CONTEXT }} | |
| file: ${{ env.DOCKERFILE_PATH }} | |
| push: ${{ github.event_name != 'pull_request' }} | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| # Extract the pure application SBOM from the artifact stage, we want to handle it separately from the container SBOM | |
| # This automaticaly re-uses the previously generated stage from cache, so we get the exact sbom from previous build step | |
| - name: Export Application SBOM from artifact stage | |
| if: ${{ github.event_name != 'pull_request' }} | |
| uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0 | |
| with: | |
| context: ${{ env.BUILD_CONTEXT }} | |
| file: ${{ env.DOCKERFILE_PATH }} | |
| target: app-sbom-artifact | |
| push: false | |
| outputs: type=local,dest=sbom-output | |
| # Extract the tag with the highest priority from the list for Trivy scanning | |
| - name: Get highest priority image tag | |
| if: ${{ github.event_name != 'pull_request' }} | |
| id: highest-priority-tag | |
| run: | | |
| # The first tag in the list is the one with the highest priority | |
| echo "value=$(echo '${{ steps.meta.outputs.tags }}' | head -n1)" >> $GITHUB_OUTPUT | |
| # Generate container SBOM. | |
| - name: Run Trivy in GitHub SBOM mode to generate CycloneDX SBOM for container | |
| if: ${{ github.event_name != 'pull_request' }} | |
| uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0 | |
| with: | |
| scan-type: 'image' | |
| format: 'cyclonedx' | |
| output: 'sbom-output/sbom_container.cyclonedx.json' | |
| image-ref: ${{ steps.highest-priority-tag.outputs.value }} | |
| skip-dirs: '/App' # Skip the /app directory as we handle the content of the application in a separate SBOM for easier vulnerability management and because trivy misses important fields | |
| - name: Upload trivy/container AND application SBOMs as a Github artifact | |
| if: ${{ github.event_name != 'pull_request' }} | |
| uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 | |
| with: | |
| name: sbom | |
| path: '${{ github.workspace }}/sbom-output/' |