[Snyk] Security upgrade ejs from 3.1.9 to 3.1.10 #12
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # DSpace Docker image build for hub.docker.com | |
| name: Docker images | |
| # Run this Build for all pushes to 'main' or maintenance branches, or tagged releases. | |
| # Also run for PRs to ensure PR doesn't break Docker build process | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - 'dspace-**' | |
| tags: | |
| - 'dspace-**' | |
| pull_request: | |
| permissions: | |
| contents: read # to fetch code (actions/checkout) | |
| env: | |
| # Define tags to use for Docker images based on Git tags/branches (for docker/metadata-action) | |
| # For a new commit on default branch (main), use the literal tag 'latest' on Docker image. | |
| # For a new commit on other branches, use the branch name as the tag for Docker image. | |
| # For a new tag, copy that tag name as the tag for Docker image. | |
| IMAGE_TAGS: | | |
| type=raw,value=latest,enable=${{ endsWith(github.ref, github.event.repository.default_branch) }} | |
| type=ref,event=branch,enable=${{ !endsWith(github.ref, github.event.repository.default_branch) }} | |
| type=ref,event=tag | |
| # Define default tag "flavor" for docker/metadata-action per | |
| # https://github.com/docker/metadata-action#flavor-input | |
| # We manage the 'latest' tag ourselves to the 'main' branch (see settings above) | |
| TAGS_FLAVOR: | | |
| latest=false | |
| # Architectures / Platforms for which we will build Docker images | |
| # If this is a PR, we ONLY build for AMD64. For PRs we only do a sanity check test to ensure Docker builds work. | |
| # If this is NOT a PR (e.g. a tag or merge commit), also build for ARM64. | |
| PLATFORMS: linux/amd64${{ github.event_name != 'pull_request' && ', linux/arm64' || '' }} | |
| jobs: | |
| ############################################### | |
| # Build/Push the 'dspace/dspace-angular' image | |
| ############################################### | |
| dspace-angular: | |
| # Ensure this job never runs on forked repos. It's only executed for 'dspace/dspace-angular' | |
| if: github.repository == 'dspace/dspace-angular' | |
| runs-on: ubuntu-latest | |
| steps: | |
| # https://github.com/actions/checkout | |
| - name: Checkout codebase | |
| uses: actions/checkout@v3 | |
| # https://github.com/docker/setup-buildx-action | |
| - name: Setup Docker Buildx | |
| uses: docker/setup-buildx-action@v2 | |
| # https://github.com/docker/setup-qemu-action | |
| - name: Set up QEMU emulation to build for multiple architectures | |
| uses: docker/setup-qemu-action@v2 | |
| # https://github.com/docker/login-action | |
| - name: Login to DockerHub | |
| # Only login if not a PR, as PRs only trigger a Docker build and not a push | |
| if: github.event_name != 'pull_request' | |
| uses: docker/login-action@v2 | |
| with: | |
| username: ${{ secrets.DOCKER_USERNAME }} | |
| password: ${{ secrets.DOCKER_ACCESS_TOKEN }} | |
| # https://github.com/docker/metadata-action | |
| # Get Metadata for docker_build step below | |
| - name: Sync metadata (tags, labels) from GitHub to Docker for 'dspace-angular' image | |
| id: meta_build | |
| uses: docker/metadata-action@v4 | |
| with: | |
| images: dspace/dspace-angular | |
| tags: ${{ env.IMAGE_TAGS }} | |
| flavor: ${{ env.TAGS_FLAVOR }} | |
| # https://github.com/docker/build-push-action | |
| - name: Build and push 'dspace-angular' image | |
| id: docker_build | |
| uses: docker/build-push-action@v4 | |
| with: | |
| context: . | |
| file: ./Dockerfile | |
| platforms: ${{ env.PLATFORMS }} | |
| # For pull requests, we run the Docker build (to ensure no PR changes break the build), | |
| # but we ONLY do an image push to DockerHub if it's NOT a PR | |
| push: ${{ github.event_name != 'pull_request' }} | |
| # Use tags / labels provided by 'docker/metadata-action' above | |
| tags: ${{ steps.meta_build.outputs.tags }} | |
| labels: ${{ steps.meta_build.outputs.labels }} | |
| ############################################################# | |
| # Build/Push the 'dspace/dspace-angular' image ('-dist' tag) | |
| ############################################################# | |
| dspace-angular-dist: | |
| # Ensure this job never runs on forked repos. It's only executed for 'dspace/dspace-angular' | |
| if: github.repository == 'dspace/dspace-angular' | |
| runs-on: ubuntu-latest | |
| steps: | |
| # https://github.com/actions/checkout | |
| - name: Checkout codebase | |
| uses: actions/checkout@v3 | |
| # https://github.com/docker/setup-buildx-action | |
| - name: Setup Docker Buildx | |
| uses: docker/setup-buildx-action@v2 | |
| # https://github.com/docker/setup-qemu-action | |
| - name: Set up QEMU emulation to build for multiple architectures | |
| uses: docker/setup-qemu-action@v2 | |
| # https://github.com/docker/login-action | |
| - name: Login to DockerHub | |
| # Only login if not a PR, as PRs only trigger a Docker build and not a push | |
| if: github.event_name != 'pull_request' | |
| uses: docker/login-action@v2 | |
| with: | |
| username: ${{ secrets.DOCKER_USERNAME }} | |
| password: ${{ secrets.DOCKER_ACCESS_TOKEN }} | |
| # https://github.com/docker/metadata-action | |
| # Get Metadata for docker_build_dist step below | |
| - name: Sync metadata (tags, labels) from GitHub to Docker for 'dspace-angular-dist' image | |
| id: meta_build_dist | |
| uses: docker/metadata-action@v4 | |
| with: | |
| images: dspace/dspace-angular | |
| tags: ${{ env.IMAGE_TAGS }} | |
| # As this is a "dist" image, its tags are all suffixed with "-dist". Otherwise, it uses the same | |
| # tagging logic as the primary 'dspace/dspace-angular' image above. | |
| flavor: ${{ env.TAGS_FLAVOR }} | |
| suffix=-dist | |
| - name: Build and push 'dspace-angular-dist' image | |
| id: docker_build_dist | |
| uses: docker/build-push-action@v4 | |
| with: | |
| context: . | |
| file: ./Dockerfile.dist | |
| platforms: ${{ env.PLATFORMS }} | |
| # For pull requests, we run the Docker build (to ensure no PR changes break the build), | |
| # but we ONLY do an image push to DockerHub if it's NOT a PR | |
| push: ${{ github.event_name != 'pull_request' }} | |
| # Use tags / labels provided by 'docker/metadata-action' above | |
| tags: ${{ steps.meta_build_dist.outputs.tags }} | |
| labels: ${{ steps.meta_build_dist.outputs.labels }} |