introduce ci #18
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Lint,Test,Security Checks | |
| on: | |
| pull_request: | |
| branches: | |
| - dev | |
| - qa | |
| - pre-prod | |
| - main | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| packages: write | |
| jobs: | |
| static-checks: | |
| strategy: | |
| matrix: | |
| include: | |
| - workdir: ./backend | |
| name: backend | |
| dockerfile: ./backend/Dockerfile | |
| image: ghcr.io/${{ github.repository }}-backend:${{ github.sha }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v3 | |
| - name: Lint Dockerfile | |
| id: hadolint | |
| uses: hadolint/[email protected] | |
| with: | |
| failure-threshold: error | |
| format: json | |
| dockerfile: ${{ matrix.dockerfile }} | |
| # output-file: hadolint_output.json | |
| - name: Save Hadolint output | |
| id: save_hadolint_output | |
| if: always() | |
| run: cd ${{ matrix.workdir }} && echo "$HADOLINT_RESULTS" | jq '.' > hadolint_output.json | |
| - name: Print Dockerfile lint output | |
| run: | | |
| cd ${{ matrix.workdir }} | |
| echo "-----HADOLINT RESULT-----" | |
| echo "Outcome: ${{ steps.hadolint.outcome }}" | |
| echo "-----DETAILS--------" | |
| cat hadolint_output.json | |
| echo "--------------------" | |
| - name: Code lint | |
| id: code_lint | |
| run: | | |
| cd ${{ matrix.workdir }} | |
| npm i | |
| set -o pipefail | |
| # npm run lint 2>&1 | tee code_lint_output.txt | |
| echo "no lint for now, skip" | tee code_lint_output.txt | |
| - name: Unit tests | |
| id: unit_tests | |
| run: | | |
| cd ${{ matrix.workdir }} | |
| npm i | |
| set -o pipefail | |
| # npm run test 2>&1 | tee unit_test_output.txt | |
| echo "no tests for now, skip" | tee unit_test_output.txt | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v2 | |
| - name: Cache Docker layers | |
| uses: actions/cache@v3 | |
| with: | |
| path: /tmp/.buildx-cache | |
| key: ${{ runner.os }}-buildx-${{ github.sha }} | |
| restore-keys: | | |
| ${{ runner.os }}-buildx- | |
| - id: image_lowercase | |
| uses: ASzc/change-string-case-action@v6 | |
| with: | |
| string: ${{ matrix.image }} | |
| - name: Build Docker image | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: ${{ matrix.workdir }} | |
| file: ${{ matrix.dockerfile }} | |
| tags: ${{ steps.image_lowercase.outputs.lowercase }} | |
| load: true | |
| cache-from: type=local,src=/tmp/.buildx-cache | |
| cache-to: type=local,dest=/tmp/.buildx-cache | |
| - name: Save Docker image | |
| run: docker save ${{ steps.image_lowercase.outputs.lowercase }} -o my-image.tar | |
| - name: Login to GHCR | |
| uses: docker/login-action@v2 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Scan Docker image with Dockle | |
| id: dockle | |
| run: | | |
| wget https://github.com/goodwithtech/dockle/releases/download/v0.2.4/dockle_0.2.4_Linux-64bit.tar.gz | |
| tar zxvf dockle_0.2.4_Linux-64bit.tar.gz | |
| sudo mv dockle /usr/local/bin | |
| dockle --exit-level fatal --format json --output ${{ matrix.workdir }}/dockle_scan_output.json --input my-image.tar | |
| echo "outcome=success" >> $GITHUB_OUTPUT | |
| # - name: Scan Docker image with Dockle | |
| # id: dockle | |
| # uses: goodwithtech/dockle-action@main | |
| # with: | |
| # input: ${{ steps.image_lowercase.outputs.lowercase }} | |
| # format: 'json' | |
| # exit-level: 'fatal' | |
| # ignore: 'CIS-DI-0010' | |
| # output: ${{ matrix.workdir }}/dockle_scan_output.json | |
| - name: Create PR comment | |
| if: always() | |
| uses: actions/github-script@v6 | |
| env: | |
| HADOLINT_RESULT: ${{ steps.hadolint.outcome }} | |
| CODE_LINT_RESULT: ${{ steps.code_lint.outcome }} | |
| UNIT_TEST_RESULT: ${{ steps.unit_tests.outcome }} | |
| DOCKLE_RESULT: ${{ steps.dockle.outcome }} | |
| with: | |
| script: | | |
| const fs = require('fs'); | |
| const hadolintResult = fs.existsSync('${{ matrix.workdir }}/hadolint_output.json') ? fs.readFileSync('${{ matrix.workdir }}/hadolint_output.json', 'utf8') : 'No output'; | |
| const codeLintResult = fs.existsSync('${{ matrix.workdir }}/code_lint_output.txt') ? fs.readFileSync('${{ matrix.workdir }}/code_lint_output.txt', 'utf8') : 'No output'; | |
| const unitTestResult = fs.existsSync('${{ matrix.workdir }}/unit_test_output.txt') ? fs.readFileSync('${{ matrix.workdir }}/unit_test_output.txt', 'utf8') : 'No output'; | |
| const dockleScanResult = fs.existsSync('${{ matrix.workdir }}/dockle_scan_output.json') ? fs.readFileSync('${{ matrix.workdir }}/dockle_scan_output.json', 'utf8') : 'No output'; | |
| let commentBody = ''; | |
| if (process.env.HADOLINT_RESULT !== 'success') { | |
| commentBody = ` | |
| :x: Dockerfile Lint (Hadolint) failed | |
| \`\`\`json | |
| ${hadolintResult} | |
| \`\`\` | |
| `; | |
| } else if (process.env.CODE_LINT_RESULT !== 'success') { | |
| commentBody = ` | |
| :x: Code Lint failed | |
| \`\`\` | |
| ${codeLintResult} | |
| \`\`\` | |
| `; | |
| } else if (process.env.UNIT_TEST_RESULT !== 'success') { | |
| commentBody = ` | |
| :x: Unit Tests failed | |
| \`\`\` | |
| ${unitTestResult} | |
| \`\`\` | |
| `; | |
| } else if (process.env.DOCKLE_RESULT !== 'success') { | |
| commentBody = ` | |
| :x: Docker Image Scan (Dockle) failed | |
| \`\`\`json | |
| ${dockleScanResult} | |
| \`\`\` | |
| `; | |
| } else { | |
| commentBody = ':white_check_mark: All checks succeeded'; | |
| } | |
| const { owner, repo } = context.repo; | |
| const issue_number = context.issue.number; | |
| await github.rest.issues.createComment({ | |
| owner, | |
| repo, | |
| issue_number, | |
| body: commentBody | |
| }); |