|  | 
|  | 1 | +name: Continuous Integration | 
|  | 2 | + | 
|  | 3 | +on: | 
|  | 4 | +  push: | 
|  | 5 | +    branches: | 
|  | 6 | +      - 'main' | 
|  | 7 | +    paths-ignore: | 
|  | 8 | +      - 'docs/**' | 
|  | 9 | +      - 'examples/**' | 
|  | 10 | +      - '**.md' | 
|  | 11 | +    tags: | 
|  | 12 | +      - 'v[0-9]+.[0-9]+.[0-9]+' | 
|  | 13 | +  pull_request: | 
|  | 14 | +    branches: | 
|  | 15 | +      - main | 
|  | 16 | +    types: | 
|  | 17 | +      - opened | 
|  | 18 | +      - reopened | 
|  | 19 | +      - synchronize | 
|  | 20 | +    paths-ignore: | 
|  | 21 | +      - 'docs/**' | 
|  | 22 | +      - 'examples/**' | 
|  | 23 | +      - '**.md' | 
|  | 24 | + | 
|  | 25 | +concurrency: | 
|  | 26 | +  group: ${{ github.ref_name }}-ci | 
|  | 27 | +  cancel-in-progress: true | 
|  | 28 | + | 
|  | 29 | +jobs: | 
|  | 30 | + | 
|  | 31 | +  vars: | 
|  | 32 | +    name: Get variables | 
|  | 33 | +    runs-on: ubuntu-20.04 | 
|  | 34 | +    outputs: | 
|  | 35 | +      sha_short: ${{ steps.vars.outputs.sha }} | 
|  | 36 | +      repo_name: ${{ steps.vars.outputs.repo }} | 
|  | 37 | +    steps: | 
|  | 38 | +      - name: Checkout Repository | 
|  | 39 | +        uses: actions/checkout@v2 | 
|  | 40 | +      - name: Output Variables | 
|  | 41 | +        id: vars | 
|  | 42 | +        run: | | 
|  | 43 | +          echo "::set-output name=sha::$(echo ${GITHUB_SHA} | cut -c1-7)" | 
|  | 44 | +          echo "::set-output name=repo::$(echo ${GITHUB_REPOSITORY} | cut -d '/' -f 2)" | 
|  | 45 | +
 | 
|  | 46 | +  build: | 
|  | 47 | +    name: Build Image | 
|  | 48 | +    runs-on: ubuntu-20.04 | 
|  | 49 | +    needs: vars | 
|  | 50 | +    steps: | 
|  | 51 | +      - name: Checkout Repository | 
|  | 52 | +        uses: actions/checkout@v2 | 
|  | 53 | +        with: | 
|  | 54 | +          fetch-depth: 0 | 
|  | 55 | +      - name: RedHat Registry Login | 
|  | 56 | +        uses: docker/login-action@v1 | 
|  | 57 | +        with: | 
|  | 58 | +          registry: registry.redhat.io | 
|  | 59 | +          username: ${{ secrets.RH_DOCKER_USERNAME }} | 
|  | 60 | +          password: ${{ secrets.RH_DOCKER_PASSWORD }} | 
|  | 61 | +      - name: Docker Buildx | 
|  | 62 | +        uses: docker/setup-buildx-action@v1 | 
|  | 63 | +      - name: Docker meta | 
|  | 64 | +        id: meta | 
|  | 65 | +        uses: docker/metadata-action@v3 | 
|  | 66 | +        with: | 
|  | 67 | +          images: | | 
|  | 68 | +            nginx/nginx-ingress-operator | 
|  | 69 | +          tags: | | 
|  | 70 | +            type=edge | 
|  | 71 | +            type=ref,event=pr | 
|  | 72 | +            type=semver,pattern={{version}} | 
|  | 73 | +          labels: | | 
|  | 74 | +            org.opencontainers.image.documentation=https://docs.nginx.com/nginx-ingress-controller | 
|  | 75 | +            org.opencontainers.image.vendor=NGINX Inc <[email protected]> | 
|  | 76 | +      - name: Output Variables | 
|  | 77 | +        id: var | 
|  | 78 | +        run: | | 
|  | 79 | +
 | 
|  | 80 | +          version=${{ steps.meta.outputs.version }} | 
|  | 81 | +          operator_version=v$version | 
|  | 82 | +          # TODO: Uncomment below once tags have been created | 
|  | 83 | +          # if ${{ startsWith(github.ref, 'refs/tags/') }}; then | 
|  | 84 | +          #     operator_version=v$version | 
|  | 85 | +          # else | 
|  | 86 | +          #     tag=$(git describe --tags --abbrev=0) | 
|  | 87 | +          #     operator_version=$tag-$version-${{ needs.vars.outputs.sha_short }} | 
|  | 88 | +          # fi | 
|  | 89 | +          echo "::set-output name=version::$operator_version" | 
|  | 90 | +      - name: Build Image | 
|  | 91 | +        uses: docker/build-push-action@v2 | 
|  | 92 | +        with: | 
|  | 93 | +          context: '.' | 
|  | 94 | +          cache-from: type=gha | 
|  | 95 | +          cache-to: type=gha,mode=max | 
|  | 96 | +          tags: ${{ steps.meta.outputs.tags }} | 
|  | 97 | +          labels: ${{ steps.meta.outputs.labels }} | 
|  | 98 | +          load: true | 
|  | 99 | +          # TODO: Uncomment the following line when we are ready to push (multi-arch doesn't work woth "load") | 
|  | 100 | +          # platforms: "linux/amd64,linux/arm64,linux/ppc64le, linux/s390x" | 
|  | 101 | +          pull: true | 
|  | 102 | +          build-args: | | 
|  | 103 | +            VERSION=${{ steps.var.outputs.version }} | 
|  | 104 | +      - name: Run Trivy vulnerability scanner | 
|  | 105 | +        uses: aquasecurity/[email protected] | 
|  | 106 | +        continue-on-error: true | 
|  | 107 | +        with: | 
|  | 108 | +          image-ref: nginx/nginx-ingress-operator:${{ steps.meta.outputs.version }} | 
|  | 109 | +          format: 'template' | 
|  | 110 | +          template: '@/contrib/sarif.tpl' | 
|  | 111 | +          output: 'trivy-results.sarif' | 
|  | 112 | +          ignore-unfixed: 'true' | 
|  | 113 | +      - name: Upload Trivy scan results to GitHub Security tab | 
|  | 114 | +        uses: github/codeql-action/upload-sarif@v1 | 
|  | 115 | +        continue-on-error: true | 
|  | 116 | +        with: | 
|  | 117 | +          sarif_file: 'trivy-results.sarif' | 
|  | 118 | +      - name: Upload Scan Results | 
|  | 119 | +        uses: actions/upload-artifact@v2 | 
|  | 120 | +        continue-on-error: true | 
|  | 121 | +        with: | 
|  | 122 | +          name: 'trivy-results.sarif' | 
|  | 123 | +          path: 'trivy-results.sarif' | 
|  | 124 | +        if: always() | 
|  | 125 | + | 
|  | 126 | + | 
|  | 127 | +  notify: | 
|  | 128 | +    name: Notify | 
|  | 129 | +    runs-on: ubuntu-20.04 | 
|  | 130 | +    needs: [vars, build] | 
|  | 131 | +    if: always() && github.ref == 'refs/heads/main' | 
|  | 132 | +    steps: | 
|  | 133 | +      - name: Workflow Status | 
|  | 134 | +        id: check | 
|  | 135 | +        uses: martialonline/workflow-status@v2 | 
|  | 136 | +      - name: Send Notification | 
|  | 137 | +        uses: 8398a7/action-slack@v3 | 
|  | 138 | +        if: steps.check.outputs.status == 'failure' | 
|  | 139 | +        with: | 
|  | 140 | +          status: custom | 
|  | 141 | +          custom_payload: | | 
|  | 142 | +            { | 
|  | 143 | +              username: 'Github', | 
|  | 144 | +              icon_emoji: ':octocat:', | 
|  | 145 | +              mention: 'channel', | 
|  | 146 | +              attachments: [{ | 
|  | 147 | +                title: '${{ needs.vars.outputs.repo_name }} ${{ github.workflow }} pipeline has failed', | 
|  | 148 | +                color: '${{ steps.check.outputs.status }}' == 'failure' ? 'danger' : 'warning', | 
|  | 149 | +                fields: [{ | 
|  | 150 | +                  title: 'Commit Hash', | 
|  | 151 | +                  value: '${{ needs.vars.outputs.sha_short }}', | 
|  | 152 | +                  short: true | 
|  | 153 | +                }, | 
|  | 154 | +                { | 
|  | 155 | +                  title: 'Author', | 
|  | 156 | +                  value: '${{ github.actor }}', | 
|  | 157 | +                  short: true | 
|  | 158 | +                }, | 
|  | 159 | +                { | 
|  | 160 | +                  title: 'Commit Message', | 
|  | 161 | +                  value: `${{ github.event.head_commit.message }}`, | 
|  | 162 | +                  short: false | 
|  | 163 | +                }, | 
|  | 164 | +                { | 
|  | 165 | +                  title: 'Pipeline URL', | 
|  | 166 | +                  value: 'https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}', | 
|  | 167 | +                  short: false | 
|  | 168 | +                }] | 
|  | 169 | +              }] | 
|  | 170 | +            } | 
|  | 171 | +        env: | 
|  | 172 | +          GITHUB_TOKEN: ${{ github.token }} | 
|  | 173 | +          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }} | 
0 commit comments