pdfdebugger/.github/workflows/ci.yml at main · koenighotze/pdfdebugger · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
name: CI

on:
  push:
    branches: [ main ]
    tags: [ "*" ]
  pull_request:
    branches: [ main ]
  workflow_dispatch:

env:
  CONTAINER_REGISTRY: docker.io

jobs:
  security-scan:
    runs-on: ubuntu-24.04

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Run Trivy vulnerability scanner in repo mode
        uses: aquasecurity/trivy-action@0.34.0
        with:
          scan-type: "fs"
          ignore-unfixed: true
          format: "sarif"
          output: "trivy-results.sarif"
          severity: "CRITICAL,HIGH"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db
          TRIVY_JAVA_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-java-db,public.ecr.aws/aquasecurity/trivy-java-db

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v4
        if: always()
        with:
          sarif_file: "trivy-results.sarif"

  QA:
    runs-on: ubuntu-24.04

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Java
        uses: actions/setup-java@v5
        with:
          java-version: 17
          distribution: temurin
          cache: maven

      - name: Verify
        run: ./mvnw --no-transfer-progress verify

      - name: Upload coverage report
        if: github.event_name != 'pull_request'
        uses: codacy/codacy-coverage-reporter-action@v1
        with:
          project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
          coverage-reports: target/coverage-reports/jacoco-ut/jacoco.xml

  image-build:
    runs-on: ubuntu-24.04

    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-java@v5
        with:
          java-version: 17
          distribution: temurin
          cache: maven

      - name: Build image tar
        run: ./scripts/build-image-tar.sh
        env:
          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}

      - name: Run vulnerability scanner
        uses: aquasecurity/trivy-action@0.34.0
        with:
          input: "${{ env.image-tar }}"
          format: "table"
          exit-code: "1"
          ignore-unfixed: true
          vuln-type: "os,library"
          severity: "CRITICAL,HIGH"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db
          TRIVY_JAVA_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-java-db,public.ecr.aws/aquasecurity/trivy-java-db

      - name: Push image to registry
        if: github.event_name != 'pull_request'
        run: ./scripts/push-image.sh
        env:
          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
          IMAGE_TAR: "${{ env.image-tar }}"
          IMAGE_NAME: "${{ env.CONTAINER_REGISTRY}}/${{ github.repository }}"