update installation #24
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Container Security Lab | |
| on: | |
| push: | |
| branches: | |
| - '*' | |
| pull_request: | |
| env: | |
| IMAGE_NAME: ${{ github.event.repository.name }} | |
| VERSION: 'latest' | |
| jobs: | |
| codeql: | |
| name: Run CodeQL SAST | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@v4 | |
| - name: Install Witness | |
| run: | | |
| bash <(curl -s https://raw.githubusercontent.com/in-toto/witness/main/install-witness.sh) | |
| - name: Run CodeQL Analysis and Record with Witness | |
| run: | | |
| witness run --name "codeql-sast" --step-name "Run CodeQL SAST" -- github/codeql-action/init@v3 --languages javascript-typescript | |
| - name: Perform CodeQL Analysis | |
| run: | | |
| witness run --name "codeql-analysis" --step-name "Analyze with CodeQL" -- github/codeql-action/analyze@v3 --category "/language:javascript-typescript" | |
| build-push: | |
| name: Build and Push Container Image | |
| runs-on: ubuntu-latest | |
| needs: codeql | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@v4 | |
| - name: Install Witness | |
| run: | | |
| bash <(curl -s https://raw.githubusercontent.com/in-toto/witness/main/install-witness.sh) | |
| - name: Set up Docker Buildx | |
| id: buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Login to Dockerhub | |
| uses: docker/login-action@v3 | |
| with: | |
| username: ${{ secrets.DOCKER_USERNAME }} | |
| password: ${{ secrets.DOCKER_PASSWORD }} | |
| - name: Build and Publish Container Image and Record with Witness | |
| run: | | |
| witness run --name "build-push" --step-name "Build and Push Image" -- docker/build-push-action@v3 --push true | |
| trivy: | |
| name: Run Trivy Scan | |
| runs-on: ubuntu-latest | |
| needs: build-push | |
| steps: | |
| - name: Install Witness | |
| run: | | |
| bash <(curl -s https://raw.githubusercontent.com/in-toto/witness/main/install-witness.sh) | |
| - name: Run Trivy Scan and Record with Witness | |
| run: | | |
| witness run --name "trivy-scan" --step-name "Run Trivy Scan" -- trivy image ${{ secrets.DOCKER_USERNAME }}/${{ env.IMAGE_NAME }}:${{ env.VERSION }} | |
| sign: | |
| name: Sign Container Image with Cosign | |
| runs-on: ubuntu-latest | |
| needs: trivy | |
| steps: | |
| - name: Install Witness | |
| run: | | |
| bash <(curl -s https://raw.githubusercontent.com/in-toto/witness/main/install-witness.sh) | |
| - name: Install Cosign | |
| uses: sigstore/[email protected] | |
| - name: Sign Container Image and Record with Witness | |
| run: | | |
| witness run --name "cosign-sign" --step-name "Sign Image with Cosign" -- cosign sign --key-env COSIGN_KEY ${{ secrets.DOCKER_USERNAME }}/${{ env.IMAGE_NAME }}:${{ env.VERSION }} | |
| validate-container: | |
| name: Validate Container Image | |
| runs-on: ubuntu-latest | |
| needs: sign | |
| steps: | |
| - name: Install Witness | |
| run: | | |
| bash <(curl -s https://raw.githubusercontent.com/in-toto/witness/main/install-witness.sh) | |
| - name: Install Cosign | |
| uses: sigstore/[email protected] | |
| - name: Verify Cosign Signature and Record with Witness | |
| run: | | |
| witness run --name "verify-signature" --step-name "Verify Signature" -- cosign verify --key cosign.key ${{ secrets.DOCKER_USERNAME }}/${{ env.IMAGE_NAME }}:${{ env.VERSION }} | |
| - name: Generate SBOM with Anchore and Record with Witness | |
| uses: anchore/sbom-action@v0 | |
| with: | |
| image: ${{ secrets.DOCKER_USERNAME }}/${{ env.IMAGE_NAME }}:${{ env.VERSION }} | |
| format: cyclonedx | |
| upload-artifact-retention: 30 |