-
Notifications
You must be signed in to change notification settings - Fork 0
50 lines (48 loc) · 1.46 KB
/
pull_request.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
name: Validate on Pull Request
on:
workflow_dispatch:
pull_request:
types: [ opened, reopened, synchronize ]
paths:
- "**/Dockerfile"
jobs:
security-checks:
runs-on: ubuntu-24.04
permissions:
contents: read
packages: write
id-token: write
strategy:
max-parallel: 5
matrix:
image-name:
- github-runner
- samba
- php-pdo
steps:
- name: Checkout Repo
uses: actions/checkout@v4
- name: Build Local Image
uses: drewbernetes/[email protected]
with:
image-repo: "drewviles"
repo-username: ${{ secrets.DOCKER_USER }}
repo-password: ${{ secrets.DOCKER_PASSWORD }}
image-name: ${{ matrix.image-name }}
image-tag: v0.0.0
check-severity: "high"
grypeignore-from-s3: true
s3-endpoint: "https://api.s3.hudson-viles.uk"
s3-access-key: ${{secrets.S3_ACCESS_KEY}}
s3-secret-key: ${{secrets.S3_SECRET_KEY}}
s3-bucket: "grypeignores"
s3-path: "docker-images.yaml"
add-latest-tag: true
publish-image: true
ignore-not-fixed: true
cosign-private-key: ${{secrets.COSIGN_KEY}}
cosign-password: ${{secrets.COSIGN_PASSWORD}}
cosign-tlog: true
dockerfile-path: ${{ matrix.image-name }}
enable-dependency-graph: true
github-token: ${{ secrets.GITHUB_TOKEN }}