Skip to content

Commit c20a286

Browse files
Amndeep7Amndeep7
authored
first pass of using the new iron bank action (#4607)
* first pass of using the new iron bank action Signed-off-by: Amndeep Singh Mann <amann@mitre.org> * scoped permissions down Signed-off-by: Amndeep Singh Mann <amann@mitre.org> * temporarily removing build step since we've already done it Signed-off-by: Amndeep Singh Mann <amann@mitre.org> * there are a couple different yq's floating around, trying to figure out which one this one is Signed-off-by: Amndeep Singh Mann <amann@mitre.org> * add quotes around replacement values since apparently yq likes that better Signed-off-by: Amndeep Singh Mann <amann@mitre.org> * maybe the quotes need to be escaped? Signed-off-by: Amndeep Singh Mann <amann@mitre.org> * don't wanna annoy the iron bank folks so have to avoid them getting tagged when this is just a draft Signed-off-by: Amndeep Singh Mann <amann@mitre.org> * turns out that the quotes are required around the label otherwise it treats it as a nested thing instead of a single string and also fixed a copy paste error from heimdall Signed-off-by: Amndeep Singh Mann <amann@mitre.org> * have to escape those quotes too apparently Signed-off-by: Amndeep Singh Mann <amann@mitre.org> * another copy paste index difference typo Signed-off-by: Amndeep Singh Mann <amann@mitre.org> * removed changes made for testing Signed-off-by: Amndeep Singh Mann <amann@mitre.org> * here's hoping that the mainline works off rip Signed-off-by: Amndeep Singh Mann <amann@mitre.org> --------- Signed-off-by: Amndeep Singh Mann <amann@mitre.org>
1 parent aed10b3 commit c20a286

2 files changed

Lines changed: 58 additions & 14 deletions

File tree

‎.github/workflows/push-to-docker-main.yml‎

Lines changed: 26 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,15 @@ on:
44
push:
55
branches: [ main ]
66

7+
permissions:
8+
contents: read
9+
710
jobs:
811
docker:
9-
runs-on: ubuntu-22.04
12+
runs-on: ubuntu-24.04
1013
steps:
14+
- name: Checkout the SAF Repository
15+
uses: actions/checkout@v4
1116
- name: Set up QEMU
1217
uses: docker/setup-qemu-action@v3
1318
- name: Set up Docker Buildx
@@ -17,13 +22,30 @@ jobs:
1722
with:
1823
username: ${{ secrets.DOCKER_USERNAME }}
1924
password: ${{ secrets.DOCKER_TOKEN }}
20-
- name: Checkout the SAF Repository
21-
uses: actions/checkout@v4
22-
- name: Build and push
25+
- name: Build and push the container image to DockerHub
2326
id: docker_build
2427
uses: docker/build-push-action@v5
2528
with:
2629
context: .
2730
push: true
2831
platforms: "linux/amd64,linux/arm64"
2932
tags: mitre/saf:latest
33+
- name: Get Docker SHA since the Iron Bank release requires us to specify the exact resources we need them to pull into the environment
34+
shell: bash
35+
id: get-docker-sha
36+
run: |
37+
echo "DOCKER_SHA=$(docker pull mitre/saf:latest > /dev/null 2>&1 && docker inspect --format='{{index .RepoDigests 0}}' mitre/saf:latest | cut -d '@' -f 2)" >> $GITHUB_ENV
38+
- name: Upgrade Iron Bank
39+
uses: mitre/ironbank_release_action@main
40+
with:
41+
name: SAF-CLI
42+
version: ${{ github.sha }}
43+
ironbank_pat: ${{ secrets.SAF_IRONBANK_REPO1_PAT }}
44+
ironbank_username: ${{ secrets.SAF_IRONBANK_REPO1_USERNAME }}
45+
ironbank_project_id: 17078
46+
ironbank_project_clone_url: https://repo1.dso.mil/dsop/mitre/security-automation-framework/saf-mainline.git
47+
git_commit_author_name: "Automated SAF CLI Release"
48+
git_commit_author_email: "saf@mitre.org"
49+
update_commands: |
50+
yq e -i '.args.SAF_VERSION=\"${{ steps.format-tag.outputs.replaced }}\" | .tags[0]=\"${{ steps.format-tag.outputs.replaced }}\" | .labels.\"org.opencontainers.image.version\"=\"${{ steps.format-tag.outputs.replaced }}\" | .resources[0].tag=\"mitre/saf:${{ steps.format-tag.outputs.replaced }}\" | .resources[0].url=\"docker://docker.io/mitre/saf@${{ env.DOCKER_SHA }}\"' hardening_manifest.yaml
51+
sed -i s/SAF_VERSION=\.\*/SAF_VERSION=${{ steps.format-tag.outputs.replaced }}/ Dockerfile

‎.github/workflows/push-to-docker.yml‎

Lines changed: 32 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -6,37 +6,59 @@ on:
66
workflow_dispatch:
77
inputs:
88
version:
9-
description: 'Version'
9+
description: 'Version'
1010
required: true
1111

12+
permissions:
13+
contents: read
14+
1215
jobs:
1316
docker:
14-
runs-on: ubuntu-22.04
17+
runs-on: ubuntu-24.04
1518
steps:
16-
- name: Set up QEMU
17-
uses: docker/setup-qemu-action@v3
18-
- name: Set up Docker Buildx
19-
uses: docker/setup-buildx-action@v3
20-
- name: Run string replace
19+
- name: Run string replace to remove the v from the version number before using it in the docker tag
2120
uses: frabert/replace-string-action@v2
2221
id: format-tag
2322
with:
2423
pattern: 'v'
2524
string: "${{ github.event.release.tag_name || github.event.inputs.version }}"
2625
replace-with: ''
2726
flags: 'g'
27+
- name: Checkout the SAF Repository
28+
uses: actions/checkout@v4
29+
- name: Set up QEMU
30+
uses: docker/setup-qemu-action@v3
31+
- name: Set up Docker Buildx
32+
uses: docker/setup-buildx-action@v3
2833
- name: Login to DockerHub
2934
uses: docker/login-action@v3
3035
with:
3136
username: ${{ secrets.DOCKER_USERNAME }}
3237
password: ${{ secrets.DOCKER_TOKEN }}
33-
- name: Checkout the SAF Repository
34-
uses: actions/checkout@v4
35-
- name: Build and push
38+
- name: Build and push the container image to DockerHub
3639
id: docker_build
3740
uses: docker/build-push-action@v5
3841
with:
3942
context: .
4043
push: true
4144
platforms: "linux/amd64,linux/arm64"
4245
tags: mitre/saf:release-latest,mitre/saf:${{ steps.format-tag.outputs.replaced }},mitre/saf:v1
46+
- name: Get Docker SHA since the Iron Bank release requires us to specify the exact resources we need them to pull into the environment
47+
shell: bash
48+
id: get-docker-sha
49+
run: |
50+
echo "DOCKER_SHA=$(docker pull mitre/saf:${{ steps.format-tag.outputs.replaced }} > /dev/null 2>&1 && docker inspect --format='{{index .RepoDigests 0}}' mitre/saf:${{ steps.format-tag.outputs.replaced }} | cut -d '@' -f 2)" >> $GITHUB_ENV
51+
- name: Upgrade Iron Bank
52+
uses: mitre/ironbank_release_action@main
53+
with:
54+
name: SAF-CLI
55+
version: ${{ steps.format-tag.outputs.replaced }}
56+
ironbank_pat: ${{ secrets.SAF_IRONBANK_REPO1_PAT }}
57+
ironbank_username: ${{ secrets.SAF_IRONBANK_REPO1_USERNAME }}
58+
ironbank_project_id: 17072
59+
ironbank_project_clone_url: repo1.dso.mil/dsop/mitre/security-automation-framework/saf.git
60+
git_commit_author_name: "Automated SAF CLI Release"
61+
git_commit_author_email: "saf@mitre.org"
62+
update_commands: |
63+
yq e -i '.args.SAF_VERSION=\"${{ steps.format-tag.outputs.replaced }}\" | .tags[0]=\"${{ steps.format-tag.outputs.replaced }}\" | .labels.\"org.opencontainers.image.version\"=\"${{ steps.format-tag.outputs.replaced }}\" | .resources[0].tag=\"mitre/saf:${{ steps.format-tag.outputs.replaced }}\" | .resources[0].url=\"docker://docker.io/mitre/saf@${{ env.DOCKER_SHA }}\"' hardening_manifest.yaml
64+
sed -i s/SAF_VERSION=\.\*/SAF_VERSION=${{ steps.format-tag.outputs.replaced }}/ Dockerfile

0 commit comments

Comments
 (0)