Skip to content

Continuous Delivery #91

Continuous Delivery

Continuous Delivery #91

Workflow file for this run

name: Continuous Delivery
on:
push:
tags:
- v*
workflow_dispatch:
defaults:
run:
shell: 'bash -Eeuo pipefail -x {0}'
env:
IMAGE_STAGING: ghcr.io/cloudnative-pg/pgbouncer-testing
IMAGE_RELEASE: ghcr.io/cloudnative-pg/pgbouncer
permissions:
contents: write
packages: write
security-events: write
jobs:
build-and-publish:
runs-on: ubuntu-22.04
steps:
-
uses: actions/checkout@v4
with:
fetch-depth: 0
-
name: Detect platforms
run: |
platforms="linux/amd64,linux/arm64"
echo "PLATFORMS=${platforms}" >> $GITHUB_ENV
-
name: Set up QEMU
uses: docker/setup-qemu-action@v3
with:
platforms: ${{ env.PLATFORMS }}
-
name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
-
name: Log in to the GitHub Container registry
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
-
name: Set image repository
run: |
if [[ "${GITHUB_REF}" =~ refs/tags/v(.*) ]]; then
echo "IMAGES=${{ env.IMAGE_RELEASE }},${{ env.IMAGE_STAGING }}" >> $GITHUB_ENV
else
echo "IMAGES=${{ env.IMAGE_STAGING }}" >> $GITHUB_ENV
fi
-
name: Gather image info
run: |
pgbouncer_version=$(jq -r '.PGBOUNCER_VERSION' .versions.json)
release_version=$(jq -r '.IMAGE_RELEASE_VERSION' .versions.json)
debian_version=$(jq -r '.DEBIAN_VERSION' .versions.json)
echo "PGBOUNCER_VERSION=${pgbouncer_version}" >> $GITHUB_ENV
echo "RELEASE_VERSION=${release_version}" >> $GITHUB_ENV
echo "DEBIAN_VERSION=${debian_version}" >> $GITHUB_ENV
-
name: Docker meta
id: docker-meta
uses: docker/metadata-action@v5
with:
# list of Docker images to use as base name for tags
images: "${{ env.IMAGES }}"
# generate Docker tags based on the following events/attributes
tags: |
type=match,pattern=v(.*),group=1
type=match,pattern=v(.*)-\d+,group=1
type=ref,event=branch
labels: |
org.opencontainers.image.version=${{ env.PGBOUNCER_VERSION }}
org.opencontainers.image.revision=${{ env.RELEASE_VERSION }}
org.opencontainers.image.licenses=PostgreSQL
-
name: Build and load
uses: docker/build-push-action@v5
with:
context: .
push: false
load: true
tags: ${{ steps.docker-meta.outputs.tags }}
labels: ${{ steps.docker-meta.outputs.labels }}
-
name: Dockle scan
uses: erzz/dockle-action@v1
with:
image: "ghcr.io/${{ env.IMAGE_STAGING }}:${{ env.PGBOUNCER_VERSION }}"
exit-code: '1'
failure-threshold: WARN
accept-keywords: key
-
name: Run Snyk to check Docker image for vulnerabilities
uses: snyk/actions/docker@master
continue-on-error: true
env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
with:
image: "ghcr.io/${{ env.IMAGE_STAGING }}:${{ env.PGBOUNCER_VERSION }}"
args: --severity-threshold=high --file=${{ matrix.file }}
-
name: Upload result to GitHub Code Scanning
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: snyk.sarif
-
name: Build and push
uses: docker/build-push-action@v5
with:
platforms: ${{ env.PLATFORMS }}
context: .
push: true
tags: ${{ steps.docker-meta.outputs.tags }}
labels: ${{ steps.docker-meta.outputs.labels }}