Bump github/codeql-action from 4.35.1 to 4.36.0 #760
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: docker_images | |
| on: | |
| push: | |
| paths: | |
| - "notebooks/**" | |
| - "exporters/**" | |
| - ".github/workflows/codeql.yaml" | |
| - ".github/workflows/build_images.yaml" | |
| pull_request: | |
| paths: | |
| - "notebooks/**" | |
| - "exporters/**" | |
| - ".github/workflows/codeql.yaml" | |
| - ".github/workflows/build_images.yaml" | |
| schedule: [ { cron: "14 14 * * TUE" } ] # Every Tuesday at 14:14 | |
| jobs: | |
| setup: | |
| if: github.event_name != 'pull_request' || | |
| !contains('OWNER,MEMBER,COLLABORATOR', | |
| github.event.pull_request.author_association) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha || github.ref }} # fix SHA | |
| - name: List all images | |
| id: metadata | |
| run: | | |
| echo "images=$( | |
| find -name Dockerfile | sed -r 's#\./(.+)/Dockerfile#\1#g' | jq -Rsc 'split("\n")[:-1]' | |
| )" >> $GITHUB_OUTPUT | |
| echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT | |
| outputs: | |
| images: ${{ steps.metadata.outputs.images }} | |
| sha: ${{ steps.metadata.outputs.sha_short }} | |
| build: | |
| needs: setup | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| image: ${{ fromJson(needs.setup.outputs.images) }} | |
| steps: | |
| - name: Maximize build space # free up space for building images | |
| uses: easimon/maximize-build-space@fc881a613ad2a34aca9c9624518214ebc21dfc0c | |
| with: | |
| root-reserve-mb: 512 | |
| swap-size-mb: 1024 | |
| remove-dotnet: "true" | |
| remove-android: "true" | |
| remove-haskell: "true" | |
| remove-codeql: "true" | |
| build-mount-path: "/var/lib/docker/" | |
| - name: Restart docker # restart the docker service | |
| run: sudo service docker restart | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd | |
| - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd | |
| - name: Login to DockerHub # increase pull rate limit | |
| uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - name: Login to Harbor Staging | |
| if: ${{ github.ref != 'refs/heads/master' }} | |
| uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 | |
| with: | |
| registry: harbor.stfc.ac.uk | |
| username: ${{ secrets.STAGING_HARBOR_USERNAME }} | |
| password: ${{ secrets.STAGING_HARBOR_TOKEN }} | |
| - name: Login to Harbor | |
| if: ${{ github.ref == 'refs/heads/master' }} | |
| uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 | |
| with: | |
| registry: harbor.stfc.ac.uk | |
| username: ${{ secrets.HARBOR_USERNAME }} | |
| password: ${{ secrets.HARBOR_TOKEN }} | |
| - name: Build & push to staging | |
| if: ${{ github.ref != 'refs/heads/master' }} | |
| uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f | |
| with: | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| push: true | |
| context: "{{defaultContext}}:${{ matrix.image }}" | |
| tags: "harbor.stfc.ac.uk/stfc-cloud-staging/${{ matrix.image }}:${{ | |
| needs.setup.outputs.sha }}" | |
| - name: Inform of tagged name | |
| if: ${{ github.ref != 'refs/heads/master' }} | |
| run: echo "::notice title=published::harbor.stfc.ac.uk/stfc-cloud-staging/${{ | |
| matrix.image }}:${{ needs.setup.outputs.sha }}" | |
| - name: Get release tag for later | |
| id: release_tag | |
| run: echo "version=$(cat ${{ matrix.image }}/version.txt)" >> $GITHUB_OUTPUT | |
| - name: Check if release file has updated | |
| uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d | |
| id: release_updated | |
| with: | |
| filters: | | |
| version: | |
| - '${{ matrix.image }}/version.txt' | |
| - name: Build & push to prod | |
| if: ${{ github.ref == 'refs/heads/master' }} | |
| uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f | |
| with: | |
| push: true | |
| context: "{{defaultContext}}:${{ matrix.image }}" | |
| tags: "harbor.stfc.ac.uk/stfc-cloud/${{ matrix.image }}:v${{ | |
| steps.release_tag.outputs.version }}" | |
| finished: | |
| # convenient single job name to apply branch protection to | |
| needs: build | |
| runs-on: ubuntu-latest | |
| steps: [ { run: true } ] |