simulator/.github/workflows/release.yaml at main · controlplaneio/simulator · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
name: release-binary-docker-images

on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+"
      - "v2.0.0-alpha1"

permissions:
  contents: write

jobs:
  build-push-docker-images:
    runs-on: ubuntu-latest
    steps:
      - name: Cache container layers
        uses: actions/cache@v3
        with:
          path: /tmp/.buildx-cache
          key: ${{ runner.os }}${{ matrix.containers.suffix }}-buildx-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}${{ matrix.containers.suffix }}-buildx-

      - name: Checkout source code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and tag dev image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile.dev
          tags: |
            controlplane/simulator:dev
          load: true
          push: false

      - name: Run Trivy vulnerability scanner on the dev image
        uses: aquasecurity/trivy-action@0.16.0
        with:
          image-ref: 'controlplane/simulator:dev'
          format: 'table'
          exit-code: '1'
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'
          trivyignores: './.trivy-config/.trivyignore'

      - name: Build and tag simulator image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile
          tags: controlplane/simulator:${{ github.ref_name }}
          load: true
          push: false

      - name: Run Trivy vulnerability scanner on simulator image
        uses: aquasecurity/trivy-action@0.16.0
        with:
          image-ref: controlplane/simulator:${{ github.ref_name }}
          format: 'table'
          exit-code: '1'
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'
          trivyignores: './.trivy-config/.trivyignore'

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          platforms: linux/amd64,linux/arm64

      - name: Build and push dev image ## should use cache image from the previous step
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile.dev
          tags: 'controlplane/simulator:dev'
          load: false ## push and load cannot be set at the same time
          push: true

      - name: pull dev image
        run: |
          docker images ls
          docker pull controlplane/simulator:dev
          docker images ls

      - name: Build and push simulator image ## should use cache image from the previous step
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile
          tags: |
            controlplane/simulator:${{ github.ref_name }}
            controlplane/simulator:latest
          load: false
          push: true

  goreleaser:
    runs-on: ubuntu-latest
    name: goreleaser
    needs: build-push-docker-images
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Go
        uses: actions/setup-go@v4
        with:
          go-version-file: go.mod

      - run: go version

      - uses: anchore/sbom-action/download-syft@v0
      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v5
        with:
          distribution: goreleaser
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}