Skip to content

Bump actions/checkout from 4.1.2 to 4.1.3 #140

Bump actions/checkout from 4.1.2 to 4.1.3

Bump actions/checkout from 4.1.2 to 4.1.3 #140

Workflow file for this run

name: CI
on:
push:
branches:
- main
tags:
- "v[0-9]+.[0-9]+.[0-9]+*"
pull_request:
branches:
- main
env:
platforms: linux/amd64,linux/arm64
jobs:
build:
runs-on: ubuntu-latest
steps:
- name: Checkout Repository
uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
- name: Get Alpine version
id: alpine
run: echo "version=$(grep -m1 'FROM alpine' <Dockerfile | awk -F'[:]' '{print $2}')" >> $GITHUB_OUTPUT
- name: Docker Buildx
uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb # v3.3.0
- name: Setup QEMU
uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
with:
platforms: arm64
if: github.event_name != 'pull_request'
- name: Login to GitHub Container Registry
uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
password: ${{ secrets.GITHUB_TOKEN }}
if: ${{ github.event_name != 'pull_request' }}
- name: Docker meta
id: meta
uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
with:
images: |
name=ghcr.io/nginxinc/alpine-fips
tags: |
type=edge
type=ref,event=pr
type=semver,pattern={{version}}
type=semver,pattern={{major}}.{{minor}}
type=semver,pattern={{version}},suffix=-alpine${{ steps.alpine.outputs.version }}
env:
DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
- name: Build Docker image
uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
id: build-push
with:
file: Dockerfile
context: "."
cache-from: type=gha,scope=alpine
cache-to: type=gha,scope=alpine,mode=max
tags: ${{ steps.meta.outputs.tags }}
load: ${{ github.event_name == 'pull_request' }}
push: ${{ github.event_name != 'pull_request' }}
platforms: ${{ github.event_name != 'pull_request' && env.platforms || '' }}
annotations: ${{ github.event_name != 'pull_request' && steps.meta.outputs.annotations || '' }}
pull: true
sbom: ${{ github.event_name != 'pull_request' }}
provenance: ${{ github.event_name != 'pull_request' }}
- name: Run Grype vulnerability scanner
uses: anchore/scan-action@3343887d815d7b07465f6fdcd395bd66508d486a # v3.6.4
continue-on-error: true
id: scan
with:
image: ghcr.io/nginxinc/alpine-fips:${{ steps.meta.outputs.version }}
only-fixed: true
add-cpes-if-none: true
- name: Upload Anchore scan SARIF report
uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
with:
sarif_file: ${{ steps.scan.outputs.sarif }}
- name: Create/Update Draft
uses: lucacome/draft-release@e076259ceb036bc5f2c2a76559784c12cf8d2e74 # v1.0.4
with:
minor-label: "enhancement"
major-label: "change"
publish: ${{ startsWith(github.ref, 'refs/tags/') }}
collapse-after: 20
if: ${{ github.event_name != 'pull_request' }}