Update dependency boto3 to v1.43.53 #4018
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # GHCR: | |
| # GitHub Container Repository | |
| # Images from ghcr are used when deploying prod and dev. | |
| # | |
| # Trivy | |
| # Trivy is a comprehensive and versatile security scanner. Trivy has scanners that look for | |
| # security issues, and targets where it can find those issues. | |
| # | |
| # This action publishes a docker image and then runs the trivy security scan on that image. | |
| # Potential security issues will be uploaded to the security tab in the repository. | |
| # | |
| # https://github.com/aquasecurity/trivy | |
| # --------------------------------------- | |
| # Publish Docker Image to GHCR and run Trivy Security Scan | |
| name: Publish to GHCR (+ Trivy scan) | |
| on: | |
| push: | |
| branches: [dev, master] | |
| pull_request: | |
| workflow_dispatch: | |
| release: | |
| types: [published] | |
| jobs: | |
| build_tech_overview: | |
| name: Build technical overview | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out the repo | |
| uses: actions/checkout@v4 | |
| # We use the ubuntu runner + apt rather than the pandoc/latex Docker action. | |
| # The Docker-based approach requires tlmgr to install extra LaTeX packages at | |
| # runtime, which depends on a reachable CTAN mirror serving a compatible TeX | |
| # Live epoch. This breaks silently when the pinned image ages past the current | |
| # TL year (tlmgr switches to ftp://tug.org/historic/, unreachable from GH | |
| # runners) and also breaks when using :latest (mirror works but image changes | |
| # unpredictably). apt packages are stable, versioned with the Ubuntu LTS, and | |
| # require no runtime mirror access. | |
| - name: Install pandoc and LaTeX dependencies | |
| run: | | |
| sudo apt-get update -qq | |
| sudo apt-get install -y --no-install-recommends \ | |
| pandoc \ | |
| lmodern \ | |
| librsvg2-bin \ | |
| texlive-latex-extra \ | |
| texlive-fonts-extra \ | |
| texlive-fonts-recommended | |
| - name: Build tech overview PDF | |
| run: | | |
| pandoc --output=dds_web/static/dds-technical-overview.pdf docs/technical-overview.md | |
| - name: Upload technical overview PDF | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: technical-overview-pdf | |
| path: dds_web/static/dds-technical-overview.pdf | |
| build_troubleshooting: | |
| name: Build troubleshooting guide | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out the repo | |
| uses: actions/checkout@v4 | |
| # See the comment on the build_tech_overview job for why apt is used | |
| # rather than the pandoc/latex Docker action. | |
| - name: Install pandoc and LaTeX dependencies | |
| run: | | |
| sudo apt-get update -qq | |
| sudo apt-get install -y --no-install-recommends \ | |
| pandoc \ | |
| lmodern \ | |
| texlive-latex-extra \ | |
| texlive-fonts-extra \ | |
| texlive-fonts-recommended | |
| - name: Build troubleshooting guide | |
| run: | | |
| pandoc --output=dds_web/static/dds-troubleshooting.pdf docs/troubleshooting.md | |
| - name: Upload troubleshooting PDF | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: troubleshooting-pdf | |
| path: dds_web/static/dds-troubleshooting.pdf | |
| push_to_registry: | |
| needs: [build_tech_overview, build_troubleshooting] | |
| if: github.repository == 'ScilifelabDataCentre/dds_web' | |
| name: Push image | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| security-events: write | |
| concurrency: | |
| group: ${{ github.ref }}-docker-trivy | |
| cancel-in-progress: true | |
| steps: | |
| - name: Check out the repo | |
| uses: actions/checkout@v4 | |
| - name: Log in to Github Container Repository | |
| uses: docker/login-action@v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Download technical overview PDF | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: technical-overview-pdf | |
| path: dds_web/static | |
| - name: Download troubleshooting PDF | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: troubleshooting-pdf | |
| path: dds_web/static | |
| - name: Docker metadata | |
| id: meta | |
| uses: docker/metadata-action@v6 | |
| with: | |
| images: | | |
| ghcr.io/scilifelabdatacentre/dds-backend | |
| - name: Ensure lowercase name | |
| run: echo IMAGE_REPOSITORY=$(echo ${{ github.repository }} | tr '[:upper:]' '[:lower:]') >> $GITHUB_ENV | |
| - name: Build for scan | |
| uses: docker/build-push-action@v7 | |
| with: | |
| file: Dockerfiles/backend.Dockerfile | |
| context: . | |
| push: false | |
| tags: ghcr.io/${{ env.IMAGE_REPOSITORY }}:sha-${{ github.sha }} | |
| - name: Install Trivy | |
| uses: aquasecurity/setup-trivy@v0.2.6 | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@v0.35.0 | |
| env: | |
| TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db | |
| with: | |
| skip-setup-trivy: true | |
| image-ref: "ghcr.io/${{ env.IMAGE_REPOSITORY }}:sha-${{ github.sha }}" | |
| format: "sarif" | |
| output: "trivy-results.sarif" | |
| severity: "CRITICAL,HIGH" | |
| - name: Upload Trivy scan results to Github Security tab | |
| uses: github/codeql-action/upload-sarif@v4 | |
| with: | |
| sarif_file: "trivy-results.sarif" | |
| category: trivy-build | |
| - name: Publish image | |
| uses: docker/build-push-action@v7 | |
| with: | |
| file: Dockerfiles/backend.Dockerfile | |
| context: . | |
| push: true | |
| build-args: version=${{ github.ref_name }} | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} |