@@ -161,7 +161,7 @@ jobs:
161161 cd meteor/bundle/programs/server
162162 meteor npm install
163163 - name : Set up Docker Buildx
164- uses : docker/setup-buildx-action@v3
164+ uses : docker/setup-buildx-action@v4
165165
166166 # Check how the image should be built and pushed
167167 - name : Determine if images should be published to DockerHub
@@ -196,7 +196,7 @@ jobs:
196196 # No-push build if no destination
197197 - name : Build without push
198198 if : steps.check-build-and-push.outputs.enable != 'true'
199- uses : docker/build-push-action@v6
199+ uses : docker/build-push-action@v7
200200 with :
201201 context : .
202202 file : ./meteor/Dockerfile.circle
@@ -207,7 +207,7 @@ jobs:
207207 - name : Get the Docker tag for GHCR
208208 id : ghcr-tag
209209 if : steps.check-build-and-push.outputs.enable == 'true'
210- uses : docker/metadata-action@v5
210+ uses : docker/metadata-action@v6
211211 with :
212212 images : |
213213 ghcr.io/${{ github.repository }}-server-core
@@ -218,14 +218,14 @@ jobs:
218218 type=raw,value=latest,enable={{is_default_branch}}
219219 - name : Login to GitHub Container Registry
220220 if : steps.check-build-and-push.outputs.enable == 'true' && steps.check-ghcr.outputs.enable == 'true'
221- uses : docker/login-action@v3
221+ uses : docker/login-action@v4
222222 with :
223223 registry : ghcr.io
224224 username : ${{ github.repository_owner }}
225225 password : ${{ secrets.GITHUB_TOKEN }}
226226 - name : Build and push to GHCR
227227 if : steps.check-build-and-push.outputs.enable == 'true' && steps.check-ghcr.outputs.enable == 'true' && steps.ghcr-tag.outputs.tags != 0
228- uses : docker/build-push-action@v6
228+ uses : docker/build-push-action@v7
229229 with :
230230 context : .
231231 file : ./meteor/Dockerfile.circle
@@ -239,7 +239,7 @@ jobs:
239239 - name : Get the Docker tag for DockerHub
240240 id : dockerhub-tag
241241 if : steps.check-build-and-push.outputs.enable == 'true'
242- uses : docker/metadata-action@v5
242+ uses : docker/metadata-action@v6
243243 with :
244244 images : |
245245 ${{ secrets.DOCKERHUB_IMAGE_PREFIX }}server-core
@@ -250,13 +250,13 @@ jobs:
250250 type=raw,value=latest,enable={{is_default_branch}}
251251 - name : Login to DockerHub
252252 if : steps.check-build-and-push.outputs.enable == 'true' && steps.dockerhub.outputs.dockerhub-publish == '1'
253- uses : docker/login-action@v3
253+ uses : docker/login-action@v4
254254 with :
255255 username : ${{ secrets.DOCKERHUB_USERNAME }}
256256 password : ${{ secrets.DOCKERHUB_TOKEN }}
257257 - name : Build and push to DockerHub
258258 if : steps.check-build-and-push.outputs.enable == 'true' && steps.dockerhub.outputs.dockerhub-publish == '1'
259- uses : docker/build-push-action@v6
259+ uses : docker/build-push-action@v7
260260 with :
261261 context : .
262262 file : ./meteor/Dockerfile.circle
@@ -265,35 +265,6 @@ jobs:
265265 labels : ${{ steps.dockerhub-tag.outputs.labels }}
266266 tags : ${{ steps.dockerhub-tag.outputs.tags }}
267267
268- # Trivy scanning
269- - name : Get image for Trivy scanning
270- id : trivy-image
271- if : steps.check-build-and-push.outputs.enable == 'true' && steps.check-ghcr.outputs.enable == 'true' && steps.ghcr-tag.outputs.tags != 0
272- run : |
273- image=$(echo ${{ steps.ghcr-tag.outputs.tags }} | head -n 1)
274- echo "image=$image" >> $GITHUB_OUTPUT
275- - name : Trivy scanning
276- if : steps.check-build-and-push.outputs.enable == 'true' && steps.check-ghcr.outputs.enable == 'true' && steps.ghcr-tag.outputs.tags != 0
277- uses : aquasecurity/trivy-action@0.34.1
278- env :
279- TRIVY_DB_REPOSITORY : public.ecr.aws/aquasecurity/trivy-db
280- with :
281- image-ref : " ${{ steps.trivy-image.outputs.image }}"
282- format : " table"
283- output : trivy-scan-result.txt
284- ignore-unfixed : true
285- severity : " CRITICAL,HIGH"
286- - name : Post all Trivy scan results to Github Summary as a table
287- if : steps.check-build-and-push.outputs.enable == 'true' && steps.check-ghcr.outputs.enable == 'true' && steps.ghcr-tag.outputs.tags != 0
288- env :
289- CODE_BLOCK : " ```"
290- run : |
291- echo "# Trivy scan results ~ core" >> $GITHUB_STEP_SUMMARY
292-
293- echo $CODE_BLOCK >> $GITHUB_STEP_SUMMARY
294- cat trivy-scan-result.txt >> $GITHUB_STEP_SUMMARY
295- echo $CODE_BLOCK >> $GITHUB_STEP_SUMMARY
296-
297268 build-gateways :
298269 # TODO - should this be dependant on tests or something passing if we are on a tag?
299270 name : Build gateways
@@ -334,7 +305,7 @@ jobs:
334305 yarn run pinst --disable
335306 yarn workspaces focus ${{ matrix.gateway-name }} --production
336307 - name : Set up Docker Buildx
337- uses : docker/setup-buildx-action@v3
308+ uses : docker/setup-buildx-action@v4
338309
339310 # Check how the image should be built and pushed
340311 - name : Determine if images should be published to DockerHub
@@ -369,7 +340,7 @@ jobs:
369340 # No-push build if no destination
370341 - name : Build without push
371342 if : steps.check-build-and-push.outputs.enable != 'true'
372- uses : docker/build-push-action@v6
343+ uses : docker/build-push-action@v7
373344 with :
374345 context : ./packages
375346 file : ./packages/${{ matrix.gateway-name }}/Dockerfile.circle
@@ -380,7 +351,7 @@ jobs:
380351 - name : Get the Docker tag for GHCR
381352 id : ghcr-tag
382353 if : steps.check-build-and-push.outputs.enable == 'true'
383- uses : docker/metadata-action@v5
354+ uses : docker/metadata-action@v6
384355 with :
385356 images : |
386357 ghcr.io/${{ github.repository }}-${{ matrix.gateway-name }}
@@ -391,14 +362,14 @@ jobs:
391362 type=raw,value=latest,enable={{is_default_branch}}
392363 - name : Login to GitHub Container Registry
393364 if : steps.check-build-and-push.outputs.enable == 'true' && steps.check-ghcr.outputs.enable == 'true'
394- uses : docker/login-action@v3
365+ uses : docker/login-action@v4
395366 with :
396367 registry : ghcr.io
397368 username : ${{ github.repository_owner }}
398369 password : ${{ secrets.GITHUB_TOKEN }}
399370 - name : Build and push to GHCR
400371 if : steps.check-build-and-push.outputs.enable == 'true' && steps.check-ghcr.outputs.enable == 'true' && steps.ghcr-tag.outputs.tags != 0
401- uses : docker/build-push-action@v6
372+ uses : docker/build-push-action@v7
402373 with :
403374 context : ./packages
404375 file : ./packages/${{ matrix.gateway-name }}/Dockerfile.circle
@@ -411,7 +382,7 @@ jobs:
411382 - name : Get the Docker tag for DockerHub
412383 id : dockerhub-tag
413384 if : steps.check-build-and-push.outputs.enable == 'true'
414- uses : docker/metadata-action@v5
385+ uses : docker/metadata-action@v6
415386 with :
416387 images : |
417388 ${{ secrets.DOCKERHUB_IMAGE_PREFIX }}${{ matrix.gateway-name }}
@@ -422,13 +393,13 @@ jobs:
422393 type=raw,value=latest,enable={{is_default_branch}}
423394 - name : Login to DockerHub
424395 if : steps.check-build-and-push.outputs.enable == 'true' && steps.dockerhub.outputs.dockerhub-publish == '1'
425- uses : docker/login-action@v3
396+ uses : docker/login-action@v4
426397 with :
427398 username : ${{ secrets.DOCKERHUB_USERNAME }}
428399 password : ${{ secrets.DOCKERHUB_TOKEN }}
429400 - name : Build and push to DockerHub
430401 if : steps.check-build-and-push.outputs.enable == 'true' && steps.dockerhub.outputs.dockerhub-publish == '1'
431- uses : docker/build-push-action@v6
402+ uses : docker/build-push-action@v7
432403 with :
433404 context : ./packages
434405 file : ./packages/${{ matrix.gateway-name }}/Dockerfile.circle
@@ -437,35 +408,6 @@ jobs:
437408 labels : ${{ steps.dockerhub-tag.outputs.labels }}
438409 tags : " ${{ steps.dockerhub-tag.outputs.tags }}"
439410
440- # Trivy scanning
441- - name : Get image for Trivy scanning
442- id : trivy-image
443- if : steps.check-build-and-push.outputs.enable == 'true' && steps.check-ghcr.outputs.enable == 'true' && steps.ghcr-tag.outputs.tags != 0
444- run : |
445- image=$(echo ${{ steps.ghcr-tag.outputs.tags }} | head -n 1)
446- echo "image=$image" >> $GITHUB_OUTPUT
447- - name : Trivy scanning
448- if : steps.check-build-and-push.outputs.enable == 'true' && steps.check-ghcr.outputs.enable == 'true' && steps.ghcr-tag.outputs.tags != 0
449- uses : aquasecurity/trivy-action@0.34.1
450- env :
451- TRIVY_DB_REPOSITORY : public.ecr.aws/aquasecurity/trivy-db
452- with :
453- image-ref : " ${{ steps.trivy-image.outputs.image }}"
454- format : " table"
455- output : ${{ matrix.gateway-name }}-trivy-scan-result.txt
456- ignore-unfixed : true
457- severity : " CRITICAL,HIGH"
458- - name : Post all Trivy scan results to Github Summary as a table
459- if : steps.check-build-and-push.outputs.enable == 'true' && steps.check-ghcr.outputs.enable == 'true' && steps.ghcr-tag.outputs.tags != 0
460- env :
461- CODE_BLOCK : " ```"
462- run : |
463- echo "# Trivy scan results ~ ${{ matrix.gateway-name }}" >> $GITHUB_STEP_SUMMARY
464-
465- echo $CODE_BLOCK >> $GITHUB_STEP_SUMMARY
466- cat ${{ matrix.gateway-name }}-trivy-scan-result.txt >> $GITHUB_STEP_SUMMARY
467- echo $CODE_BLOCK >> $GITHUB_STEP_SUMMARY
468-
469411 lint-packages :
470412 name : Lint Packages
471413 runs-on : ubuntu-latest
0 commit comments