Upload depscan Package and Container image #1349
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Upload depscan Package and Container image | |
| on: | |
| schedule: | |
| - cron: "0 4 * * *" | |
| push: | |
| paths-ignore: | |
| - '**/README.md' | |
| - 'dockertests.yml' | |
| - 'pythonapp.yml' | |
| - 'gobintests.yml' | |
| branches: | |
| - master | |
| - release/* | |
| tags: | |
| - 'v*' # Push events to matching v*, i.e. v1.0, v20.15.10 | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} | |
| cancel-in-progress: false | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository }} | |
| jobs: | |
| deploy: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| packages: write | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v5 | |
| with: | |
| python-version: '3.12' | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '23.x' | |
| - name: Set up JDK | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: 'temurin' | |
| java-version: '21' | |
| - uses: oras-project/setup-oras@v1 | |
| - name: Trim CI agent | |
| run: | | |
| chmod +x contrib/free_disk_space.sh | |
| ./contrib/free_disk_space.sh | |
| - name: Build | |
| run: | | |
| uv build --all-packages | |
| ls -lh dist | |
| - name: Publish package distributions to PyPI | |
| if: startsWith(github.ref, 'refs/tags/') | |
| run: | | |
| uv publish --trusted-publishing always | |
| - name: Setup nydus | |
| run: | | |
| curl -LO https://github.com/dragonflyoss/nydus/releases/download/v2.3.1/nydus-static-v2.3.1-linux-amd64.tgz | |
| tar -xvf nydus-static-v2.3.1-linux-amd64.tgz | |
| chmod +x nydus-static/* | |
| mv nydus-static/* /usr/local/bin/ | |
| rm -rf nydus-static-v2.3.1-linux-amd64.tgz nydus-static | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v3 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Log in to the Container registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata (tags, labels) for Docker | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: | | |
| ghcr.io/${{ github.repository }} | |
| ghcr.io/owasp-dep-scan/depscan | |
| - name: Build and push Docker images | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: . | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha,scope=depscan | |
| cache-to: type=gha,mode=max,scope=depscan | |
| - name: Generate SBOM with cdxgen | |
| run: | | |
| npm install -g @cyclonedx/cdxgen | |
| cdxgen -t python -o bom.json . --profile research | |
| cdxgen -t docker -o depscan-oci-image.cdx.json ghcr.io/owasp-dep-scan/depscan:latest | |
| - name: Attach sbom to the image | |
| if: startsWith(github.ref, 'refs/tags/') | |
| continue-on-error: true | |
| run: | | |
| oras attach --artifact-type sbom/cyclonedx ghcr.io/owasp-dep-scan/depscan:latest ./depscan-oci-image.cdx.json:application/json | |
| oras discover --format tree ghcr.io/owasp-dep-scan/depscan:latest | |
| - name: Create Release | |
| id: create_release | |
| if: startsWith(github.ref, 'refs/tags/') | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| files: | | |
| bom.json | |
| depscan-oci-image.cdx.json | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: nydusify | |
| run: | | |
| nydusify convert --oci --oci-ref --source ghcr.io/owasp-dep-scan/depscan:master --target ghcr.io/owasp-dep-scan/depscan:master-nydus --prefetch-dir /opt/dep-scan | |
| nydusify check --target ghcr.io/owasp-dep-scan/depscan:master-nydus | |
| nydusify convert --oci --oci-ref --source ghcr.io/owasp-dep-scan/dep-scan:master --target ghcr.io/owasp-dep-scan/dep-scan:master-nydus --prefetch-dir /opt/dep-scan | |
| if: github.ref == 'refs/heads/master' | |
| continue-on-error: true |