fix(deps): remediate docs vulnerabilities #706
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build & Push Docker Images | |
| on: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_PREFIX: ghcr.io/openmapx | |
| # Least-privilege default; each job opts into the extra scopes it needs | |
| # (the build job adds packages: write + security-events: write). | |
| permissions: | |
| contents: read | |
| jobs: | |
| changes: | |
| name: Detect changed apps | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| outputs: | |
| apps: ${{ steps.set.outputs.apps }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - id: filter | |
| if: github.event_name != 'workflow_dispatch' | |
| uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4 | |
| with: | |
| filters: | | |
| api: | |
| - '.github/workflows/docker.yml' | |
| - 'apps/api/**' | |
| - 'packages/**' | |
| - 'integrations/**' | |
| - 'pnpm-lock.yaml' | |
| - 'pnpm-workspace.yaml' | |
| - 'package.json' | |
| - 'apps/api/Dockerfile' | |
| web: | |
| - '.github/workflows/docker.yml' | |
| - 'apps/web/**' | |
| - 'packages/**' | |
| - 'integrations/**' | |
| - 'pnpm-lock.yaml' | |
| - 'pnpm-workspace.yaml' | |
| - 'package.json' | |
| - 'apps/web/Dockerfile' | |
| data-manager: | |
| - '.github/workflows/docker.yml' | |
| - 'services/data-manager/**' | |
| - 'packages/**' | |
| - 'integrations/**' | |
| - 'pnpm-lock.yaml' | |
| - 'pnpm-workspace.yaml' | |
| - 'package.json' | |
| transitous-tools: | |
| - '.github/workflows/docker.yml' | |
| - 'services/motis/tools/transitous/**' | |
| docs: | |
| - '.github/workflows/docker.yml' | |
| - 'docs/**' | |
| - id: set | |
| env: | |
| DISPATCH: ${{ github.event_name == 'workflow_dispatch' }} | |
| FILTER_CHANGES: ${{ steps.filter.outputs.changes }} | |
| run: | | |
| if [ "$DISPATCH" = "true" ]; then | |
| echo 'apps=["api","web","data-manager","transitous-tools","docs"]' >> "$GITHUB_OUTPUT" | |
| else | |
| echo "apps=${FILTER_CHANGES}" >> "$GITHUB_OUTPUT" | |
| fi | |
| build: | |
| name: Build ${{ matrix.app }} | |
| needs: changes | |
| if: needs.changes.outputs.apps != '[]' && needs.changes.outputs.apps != '' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| security-events: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| app: ${{ fromJSON(needs.changes.outputs.apps) }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Resolve build context | |
| id: ctx | |
| env: | |
| APP: ${{ matrix.app }} | |
| run: | | |
| case "$APP" in | |
| api) | |
| echo "context=." >> "$GITHUB_OUTPUT" | |
| echo "dockerfile=apps/api/Dockerfile" >> "$GITHUB_OUTPUT" | |
| ;; | |
| web) | |
| echo "context=." >> "$GITHUB_OUTPUT" | |
| echo "dockerfile=apps/web/Dockerfile" >> "$GITHUB_OUTPUT" | |
| ;; | |
| data-manager) | |
| echo "context=." >> "$GITHUB_OUTPUT" | |
| echo "dockerfile=services/data-manager/Dockerfile" >> "$GITHUB_OUTPUT" | |
| ;; | |
| transitous-tools) | |
| echo "context=services/motis/tools/transitous" >> "$GITHUB_OUTPUT" | |
| echo "dockerfile=services/motis/tools/transitous/Dockerfile" >> "$GITHUB_OUTPUT" | |
| ;; | |
| docs) | |
| echo "context=docs" >> "$GITHUB_OUTPUT" | |
| echo "dockerfile=docs/Dockerfile" >> "$GITHUB_OUTPUT" | |
| ;; | |
| *) | |
| echo "Unknown app: $APP" >&2 | |
| exit 1 | |
| ;; | |
| esac | |
| # Buildx startup pulls its BuildKit image from Docker Hub. A transient | |
| # registry timeout should not sink one matrix leg while the others pass. | |
| - name: Set up Docker Buildx | |
| id: buildx | |
| continue-on-error: true | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 | |
| - name: Retry Docker Buildx setup | |
| if: steps.buildx.outcome == 'failure' | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 | |
| - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6 | |
| id: meta | |
| with: | |
| images: ${{ env.IMAGE_PREFIX }}/${{ matrix.app }} | |
| tags: | | |
| type=sha,prefix= | |
| type=raw,value=latest | |
| - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 | |
| id: build | |
| with: | |
| context: ${{ steps.ctx.outputs.context }} | |
| file: ${{ steps.ctx.outputs.dockerfile }} | |
| platforms: linux/amd64 | |
| # Stamp the web service worker with the commit SHA so each deploy | |
| # produces a fresh sw.js and the PWA's update prompt fires. Ignored by | |
| # the other images (their Dockerfiles declare no such ARG). | |
| build-args: ${{ matrix.app == 'web' && format('SW_BUILD_ID={0}', github.sha) || '' }} | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha,scope=${{ matrix.app }} | |
| cache-to: type=gha,mode=max,scope=${{ matrix.app }} | |
| provenance: mode=max | |
| sbom: true | |
| # Trivy scan + SARIF upload require Code Scanning, which needs | |
| # GitHub Advanced Security on private repos. To enable: make the | |
| # repo public OR set repo variable ENABLE_CODE_SCANNING=true | |
| # under Settings → Secrets and variables → Actions → Variables. | |
| - name: Scan image with Trivy | |
| if: vars.ENABLE_CODE_SCANNING == 'true' | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| image-ref: ${{ env.IMAGE_PREFIX }}/${{ matrix.app }}@${{ steps.build.outputs.digest }} | |
| format: sarif | |
| output: trivy-${{ matrix.app }}.sarif | |
| severity: CRITICAL,HIGH | |
| ignore-unfixed: true | |
| exit-code: "0" | |
| - name: Upload Trivy results | |
| if: always() && vars.ENABLE_CODE_SCANNING == 'true' | |
| uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4 | |
| with: | |
| sarif_file: trivy-${{ matrix.app }}.sarif | |
| category: trivy-${{ matrix.app }} |