Skip to content

Commit c54f32c

Browse files
paologallinaharburpaologallinaharbur
authored
feat(ci/cd): image (#27)
* feat(ci/cd): image
1 parent f6ec247 commit c54f32c

File tree

9 files changed

+258
-2
lines changed

9 files changed

+258
-2
lines changed

‎.github/workflows/component_image.yml

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
name: 📞 Build container images
2+
3+
permissions:
4+
contents: read
5+
6+
on:
7+
workflow_call:
8+
inputs:
9+
image-tag:
10+
description: 'Image tag'
11+
type: string
12+
required: true
13+
push:
14+
description: 'Push image'
15+
type: boolean
16+
required: true
17+
18+
jobs:
19+
build-image:
20+
runs-on: ubuntu-latest
21+
name: Build/Push images
22+
env:
23+
DOCKER_IMAGE_NAME_AUTH: newrelic/newrelic-auth-cli
24+
DOCKER_PLATFORMS: "linux/amd64,linux/arm64"
25+
steps:
26+
- uses: actions/checkout@v4
27+
with:
28+
fetch-depth: 0
29+
30+
- name: Obtain Rust version from project
31+
run: |
32+
RUST_VERSION=$(grep "rust-version" Cargo.toml | cut -d "=" -f2 | tr -d "[:space:]")
33+
echo "RUST_VERSION=${RUST_VERSION}" >> $GITHUB_ENV
34+
35+
- name: Install Rust ${{ env.RUST_VERSION }}
36+
uses: dtolnay/rust-toolchain@master
37+
with:
38+
toolchain: ${{ env.RUST_VERSION }}
39+
40+
- name: Build newrelic auth cli
41+
run: |
42+
which cross || cargo install cross
43+
export RUSTFLAGS="-C target-feature=+crt-static"
44+
cross build --target "aarch64-unknown-linux-musl" --profile release
45+
cross build --target "x86_64-unknown-linux-musl" --profile release
46+
cp ./target/aarch64-unknown-linux-musl/release/newrelic-auth-cli ./target/newrelic-auth-cli-arm64
47+
cp ./target/x86_64-unknown-linux-musl/release/newrelic-auth-cli ./target/newrelic-auth-cli-amd64
48+
49+
- uses: docker/setup-qemu-action@v3
50+
51+
- uses: docker/setup-buildx-action@v3
52+
53+
- uses: docker/login-action@v3
54+
with:
55+
username: ${{ secrets.OHAI_DOCKER_HUB_ID }}
56+
password: ${{ secrets.OHAI_DOCKER_HUB_PASSWORD }}
57+
58+
- name: Build and push images
59+
if: ${{ inputs.push }}
60+
run: |
61+
docker buildx build \
62+
--push \
63+
--platform=$DOCKER_PLATFORMS \
64+
-t $DOCKER_IMAGE_NAME_AUTH:${{ inputs.image-tag }} \
65+
--attest type=provenance,mode=max \
66+
--attest type=sbom \
67+
.
68+
69+
- name: Build images
70+
if: ${{ ! inputs.push }}
71+
run: |
72+
docker buildx build \
73+
--platform=$DOCKER_PLATFORMS \
74+
-t $DOCKER_IMAGE_NAME_AUTH:${{ inputs.image-tag }} \
75+
--attest type=provenance,mode=max \
76+
--attest type=sbom \
77+
.

‎.github/workflows/component_image_security.yml

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
name: 📞 Security image scan
2+
permissions:
3+
contents: read
4+
on:
5+
workflow_call:
6+
inputs:
7+
image-tag:
8+
description: 'Image tag'
9+
type: string
10+
required: true
11+
12+
env:
13+
DOCKER_IMAGE_NAME_AUTH: newrelic/newrelic-auth-cli
14+
SEVERITY: 'CRITICAL,HIGH'
15+
16+
jobs:
17+
scan:
18+
name: Scan image
19+
# Runs only when the trigger is different from a scheduled one, like pull request or push.
20+
if: ${{ ! github.event.schedule }}
21+
runs-on: ubuntu-latest
22+
steps:
23+
- name: Run Trivy in table mode
24+
# Table output is only useful when running on a pull request or push.
25+
uses: aquasecurity/[email protected]
26+
with:
27+
image-ref: ${{ env.DOCKER_IMAGE_NAME_AUTH }}:${{ inputs.image-tag }}
28+
format: table
29+
exit-code: 1
30+
ignore-unfixed: true
31+
severity: ${{ env.SEVERITY }}
32+
env:
33+
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db
34+
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db
35+
36+
scan-scheduled:
37+
name: Scan image
38+
if: ${{ github.event.schedule }}
39+
runs-on: ubuntu-latest
40+
steps:
41+
- name: Run Trivy in report mode
42+
uses: aquasecurity/[email protected]
43+
with:
44+
image-ref: ${{ env.DOCKER_IMAGE_NAME_AUTH }}:${{ inputs.image-tag }}
45+
format: 'template'
46+
template: '@/contrib/sarif.tpl'
47+
output: 'trivy-results.sarif'
48+
ignore-unfixed: false # Get full report when running nightly.
49+
severity: ${{ env.SEVERITY }}
50+
env:
51+
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db
52+
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db
53+
54+
# TODO Upload Trivy scan results to GitHub Security tab when the repo gets public state.
55+
# more info about current limitation https://docs.github.com/en/code-security/code-scanning/troubleshooting-code-scanning/advanced-security-must-be-enabled

‎.github/workflows/component_security.yml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: 📞 Rust Audit
2+
3+
on:
4+
workflow_call:
5+
6+
permissions:
7+
contents: read
8+
9+
jobs:
10+
audit:
11+
name: Rust audit scanner
12+
runs-on: ubuntu-latest
13+
steps:
14+
- name: Checkout
15+
uses: actions/checkout@v4
16+
with:
17+
fetch-depth: 0
18+
19+
- name: Install cargo-audit
20+
run: cargo install cargo-audit
21+
22+
- name: Run cargo audit
23+
run: cargo audit

‎.github/workflows/nightly.yml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
name: Nightly release
2+
permissions:
3+
contents: read
4+
on:
5+
workflow_dispatch:
6+
schedule:
7+
- cron: "0 4 * * 1-5"
8+
9+
jobs:
10+
build-image:
11+
name: Build and Push nightly image
12+
uses: ./.github/workflows/component_image.yml
13+
with:
14+
image-tag: nightly
15+
push: true
16+
secrets: inherit
17+
18+
security-image:
19+
name: Security scan
20+
needs: [ build-image ]
21+
uses: ./.github/workflows/component_image_security.yml
22+
with:
23+
image-tag: nightly
24+
secrets: inherit

‎.github/workflows/on_prerelease.yml

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,22 @@ name: on_prerelease
77
permissions:
88
contents: write
99
jobs:
10+
build-image:
11+
name: Build and Push container image
12+
uses: ./.github/workflows/component_image.yml
13+
with:
14+
image-tag: ${{ github.event.release.tag_name }}-rc
15+
push: true
16+
secrets: inherit
17+
18+
security-scan:
19+
name: Security scan
20+
needs: [ build-image ]
21+
uses: ./.github/workflows/component_image_security.yml
22+
with:
23+
image-tag: ${{ github.event.release.tag_name }}-rc
24+
secrets: inherit
25+
1026
build-binaries:
1127
runs-on: ubuntu-latest
1228
name: Build/Push binaries
@@ -34,8 +50,8 @@ jobs:
3450
cross build --target "aarch64-unknown-linux-musl" --profile release
3551
cross build --target "x86_64-unknown-linux-musl" --profile release
3652
37-
cp ./target/aarch64-unknown-linux-musl/release/newrelic-auth-cli ./newrelic-auth-cli-arm64
38-
cp ./target/x86_64-unknown-linux-musl/release/newrelic-auth-cli ./newrelic-auth-cli-amd64
53+
cp ./target/aarch64-unknown-linux-musl/release/newrelic-auth-cli ./target/newrelic-auth-cli-arm64
54+
cp ./target/x86_64-unknown-linux-musl/release/newrelic-auth-cli ./target/newrelic-auth-cli-amd64
3955
4056
gh release upload ${{ github.event.release.tag_name }} newrelic-auth-cli-arm64
4157
gh release upload ${{ github.event.release.tag_name }} newrelic-auth-cli-amd64

‎.github/workflows/on_release.yml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
on:
2+
release:
3+
types:
4+
- released
5+
tags:
6+
- '*'
7+
8+
name: Release
9+
permissions:
10+
contents: read
11+
jobs:
12+
push-container-tags:
13+
runs-on: ubuntu-latest
14+
name: Push container release tags
15+
env:
16+
DOCKER_IMAGE_NAME_AUTH: newrelic/newrelic-auth-cli
17+
steps:
18+
- uses: docker/setup-qemu-action@v3
19+
20+
- uses: docker/setup-buildx-action@v3
21+
22+
- uses: docker/login-action@v3
23+
with:
24+
username: ${{ secrets.OHAI_DOCKER_HUB_ID }}
25+
password: ${{ secrets.OHAI_DOCKER_HUB_PASSWORD }}
26+
27+
- name: Push release tags
28+
run: |
29+
docker buildx imagetools create \
30+
-t $DOCKER_IMAGE_NAME_AUTH:${{ github.event.release.tag_name }} \
31+
-t $DOCKER_IMAGE_NAME_AUTH:latest \
32+
$DOCKER_IMAGE_NAME_AUTH:${{ github.event.release.tag_name }}-rc

‎.github/workflows/security.yml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
name: . 🕵🏼 Security scanner
2+
permissions:
3+
contents: read
4+
on:
5+
pull_request:
6+
merge_group:
7+
workflow_dispatch:
8+
9+
jobs:
10+
security:
11+
uses: ./.github/workflows/component_security.yml

‎Dockerfile

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
FROM debian:trixie-slim
2+
3+
ARG TARGETARCH
4+
5+
RUN apt-get update && \
6+
apt-get upgrade -y && \
7+
apt-get clean && \
8+
apt-get install -y curl
9+
10+
RUN curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/${TARGETARCH}/kubectl"
11+
12+
COPY --chmod=755 target/newrelic-auth-cli-${TARGETARCH} /bin/newrelic-auth-cli
13+
14+
USER nobody
15+
16+
ENTRYPOINT ["/bin/newrelic-auth-cli"]

‎src/bin/main_cli.rs

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
use std::process::{exit, ExitCode};
22

33
fn main() -> ExitCode {
4+
println!("I am the auth CLI");
5+
46
exit(0)
57
}

0 commit comments

Comments
 (0)