moddns/.github/workflows/docker.yml at main · ivpn/moddns · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
name: Docker build

on:
  pull_request:
    branches: ["main", "develop", "release/*"]

permissions: read-all

jobs:
  docker:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false

      - name: Docker version
        run: docker --version

      - name: Build API image
        run: |
          IMAGE=dnsapi
          make build_api_image IMAGE=${IMAGE}
          echo "DNS_API_IMAGE=${IMAGE}" >> $GITHUB_ENV

      - name: Run Trivy vulnerability scanner - DNS API
        id: trivy_api
        continue-on-error: true
        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # v0.34.2
        with:
          image-ref: ${{ env.DNS_API_IMAGE }}
          trivy-config: ./.github/trivy.yaml

      - name: Build Proxy image
        run: |
          IMAGE=dnsproxy
          make build_proxy_image IMAGE=${IMAGE}
          echo "DNS_PROXY_IMAGE=${IMAGE}" >> $GITHUB_ENV

      - name: Run Trivy vulnerability scanner - DNS Proxy
        id: trivy_proxy
        continue-on-error: true
        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # v0.34.2
        with:
          image-ref: ${{ env.DNS_PROXY_IMAGE }}
          trivy-config: ./.github/trivy.yaml

      - name: Build Frontend image
        run: |
          IMAGE=dnswebapp
          make build_frontend_image IMAGE=${IMAGE}
          echo "DNS_FRONTEND_IMAGE=${IMAGE}" >> $GITHUB_ENV

      - name: Run Trivy vulnerability scanner - DNS Frontend
        id: trivy_frontend
        continue-on-error: true
        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # v0.34.2
        with:
          image-ref: ${{ env.DNS_FRONTEND_IMAGE }}
          trivy-config: ./.github/trivy.yaml

      - name: Build DNS blocklists image
        run: |
          IMAGE=dnsblocklists
          make build_blocklists_image IMAGE=${IMAGE}
          echo "DNS_BLOCKLISTS_IMAGE=${IMAGE}" >> $GITHUB_ENV

      - name: Run Trivy vulnerability scanner - DNS blocklists
        id: trivy_blocklists
        continue-on-error: true
        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # v0.34.2
        with:
          image-ref: ${{ env.DNS_BLOCKLISTS_IMAGE }}
          trivy-config: ./.github/trivy.yaml

      - name: Build DNS check image
        run: |
          IMAGE=dnscheck
          make build_dnscheck_image IMAGE=${IMAGE}
          echo "DNS_CHECK_IMAGE=${IMAGE}" >> $GITHUB_ENV

      - name: Run Trivy vulnerability scanner - DNS check
        id: trivy_dnscheck
        continue-on-error: true
        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # v0.34.2
        with:
          image-ref: ${{ env.DNS_CHECK_IMAGE }}
          trivy-config: ./.github/trivy.yaml

      - name: Trivy scan summary
        if: >-
          steps.trivy_api.outcome == 'failure' ||
          steps.trivy_proxy.outcome == 'failure' ||
          steps.trivy_frontend.outcome == 'failure' ||
          steps.trivy_blocklists.outcome == 'failure' ||
          steps.trivy_dnscheck.outcome == 'failure'
        run: |
          echo "## :warning: Trivy vulnerability scan findings" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "The following images have HIGH/CRITICAL vulnerabilities:" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          [ "${{ steps.trivy_api.outcome }}" = "failure" ] && echo "- **DNS API** (dnsapi)" >> $GITHUB_STEP_SUMMARY
          [ "${{ steps.trivy_proxy.outcome }}" = "failure" ] && echo "- **DNS Proxy** (dnsproxy)" >> $GITHUB_STEP_SUMMARY
          [ "${{ steps.trivy_frontend.outcome }}" = "failure" ] && echo "- **DNS Frontend** (dnswebapp)" >> $GITHUB_STEP_SUMMARY
          [ "${{ steps.trivy_blocklists.outcome }}" = "failure" ] && echo "- **DNS Blocklists** (dnsblocklists)" >> $GITHUB_STEP_SUMMARY
          [ "${{ steps.trivy_dnscheck.outcome }}" = "failure" ] && echo "- **DNS Check** (dnscheck)" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "Review the Trivy scan steps above for details. Consider creating a separate PR to upgrade affected dependencies." >> $GITHUB_STEP_SUMMARY