stephen/apartment-dashboard
1
0
Fork 0
Code Issues Pull Requests Actions Releases Wiki Activity

Update .github/workflows/deploy.yml
All checks were successful
CI/CD Pipeline - Apartment Dashboard / Run Linter (push) Successful in 12s
Details
CI/CD Pipeline - Apartment Dashboard / Scan Dependencies (push) Successful in 12s
Details
CI/CD Pipeline - Apartment Dashboard / Build & Push Image (push) Successful in 32s
Details
CI/CD Pipeline - Apartment Dashboard / Deploy to Production (push) Successful in 14s
Details

Browse Source
This commit is contained in:
stephen
2026-02-08 19:54:43 -07:00
parent 3a6a735872
commit f0b1ea3e05
1 changed files with 45 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

90
.github/workflows/deploy.yml vendored
View File

@ -106,66 +106,66 @@ jobs:
# ============================================================
# Vulnerability Scanning with Trivy
# ============================================================
- name: Install Trivy
run: |
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.58.0
# - name: Install Trivy
# run: |
# curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.58.0
- name: Run Trivy vulnerability scanner
run: |
trivy image \
--exit-code 1 \
--ignore-unfixed \
--vuln-type os,library \
--severity CRITICAL,HIGH \
--format table \
${{ steps.set-tag.outputs.full_image }}
# - name: Run Trivy vulnerability scanner
# run: |
# trivy image \
# --exit-code 1 \
# --ignore-unfixed \
# --vuln-type os,library \
# --severity CRITICAL,HIGH \
# --format table \
# ${{ steps.set-tag.outputs.full_image }}
- name: Run Trivy and output SARIF
if: always()
run: |
trivy image \
--format sarif \
--output trivy-results.sarif \
${{ steps.set-tag.outputs.full_image }} || true
# - name: Run Trivy and output SARIF
# if: always()
# run: |
# trivy image \
# --format sarif \
# --output trivy-results.sarif \
# ${{ steps.set-tag.outputs.full_image }} || true
# ============================================================
# SBOM Generation with Syft
# ============================================================
- name: Generate SBOM with Syft
uses: anchore/sbom-action@v0
with:
image: ${{ steps.set-tag.outputs.full_image }}
format: spdx-json
output-file: sbom.spdx.json
# - name: Generate SBOM with Syft
# uses: anchore/sbom-action@v0
# with:
# image: ${{ steps.set-tag.outputs.full_image }}
# format: spdx-json
# output-file: sbom.spdx.json
# ============================================================
# Image Signing with Cosign
# ============================================================
- name: Install Cosign
uses: sigstore/cosign-installer@v3
# - name: Install Cosign
# uses: sigstore/cosign-installer@v3
- name: Sign image with Cosign
env:
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
run: |
cosign sign --key env://COSIGN_PRIVATE_KEY \
--yes \
${{ secrets.HARBOR_REGISTRY }}/${{ secrets.HARBOR_PROJECT }}/${{ env.IMAGE_NAME }}@${{ steps.build-push.outputs.digest }}
# - name: Sign image with Cosign
# env:
# COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
# COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
# run: |
# cosign sign --key env://COSIGN_PRIVATE_KEY \
# --yes \
# ${{ secrets.HARBOR_REGISTRY }}/${{ secrets.HARBOR_PROJECT }}/${{ env.IMAGE_NAME }}@${{ steps.build-push.outputs.digest }}
# ============================================================
# Attach SBOM to image in Harbor
# ============================================================
- name: Attach SBOM to image
env:
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
run: |
cosign attest --key env://COSIGN_PRIVATE_KEY \
--type spdxjson \
--predicate sbom.spdx.json \
--yes \
${{ secrets.HARBOR_REGISTRY }}/${{ secrets.HARBOR_PROJECT }}/${{ env.IMAGE_NAME }}@${{ steps.build-push.outputs.digest }}
# - name: Attach SBOM to image
# env:
# COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
# COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
# run: |
# cosign attest --key env://COSIGN_PRIVATE_KEY \
# --type spdxjson \
# --predicate sbom.spdx.json \
# --yes \
# ${{ secrets.HARBOR_REGISTRY }}/${{ secrets.HARBOR_PROJECT }}/${{ env.IMAGE_NAME }}@${{ steps.build-push.outputs.digest }}
# ============================================================
# Deploy Job - Pull image and restart on production server