65 lines
2.4 KiB
YAML
65 lines
2.4 KiB
YAML
name: CI
|
|
|
|
on:
|
|
pull_request:
|
|
|
|
jobs:
|
|
test-setup-trivy:
|
|
strategy:
|
|
matrix:
|
|
arch: [amd64, arm64]
|
|
name: Test Setup Trivy ${{ matrix.arch }}
|
|
runs-on:
|
|
- ubuntu-latest
|
|
- linux_${{ matrix.arch }}
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
|
- name: Setup Trivy
|
|
uses: ./setup-trivy
|
|
- name: Run Trivy
|
|
run: trivy --version
|
|
|
|
test-setup-db:
|
|
name: Test Setup DB
|
|
runs-on:
|
|
- ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
|
- uses: ./setup-trivy
|
|
- name: Setup DB
|
|
id: setup-db
|
|
uses: ./setup-db
|
|
- name: Run Trivy
|
|
run: trivy fs --skip-db-update --cache-dir ${{ steps.setup-db.outputs.cache-dir }} .
|
|
|
|
test-get-images-from-files:
|
|
name: Test Get Images From Files
|
|
runs-on:
|
|
- ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
|
- name: Get Images From Files
|
|
id: giff
|
|
uses: ./get-images-from-files
|
|
with:
|
|
files: |
|
|
- get-images-from-files/test.Dockerfile
|
|
- get-images-from-files/test-deployment.yaml
|
|
- name: Check image formats extracted
|
|
run: |
|
|
images="${{ steps.giff.outputs.images }}"
|
|
echo "Extracted: $images"
|
|
# Dockerfile-only: registry with tag, registry with digest
|
|
echo "$images" | grep -q 'example.com/library/nginx:v1'
|
|
echo "$images" | grep -q 'example.com/library/base@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
|
|
# K8s-only: registry with tag, registry with digest
|
|
echo "$images" | grep -q 'example.com/library/app:v2'
|
|
echo "$images" | grep -q 'example.com/myproject/helper@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb'
|
|
# Shared ref (in both Dockerfile and K8s) — must appear exactly once
|
|
echo "$images" | grep -q 'example.com/distroless/static:nonroot'
|
|
count=$(echo "$images" | tr ',' '\n' | grep -c 'example.com/distroless/static:nonroot' || true)
|
|
[ "$count" -eq 1 ] || { echo "expected shared ref once, got: $count"; exit 1; }
|
|
# Total unique refs: 5
|
|
total=$(echo "$images" | tr ',' '\n' | grep -c . || true)
|
|
[ "$total" -eq 5 ] || { echo "expected 5 unique refs, got: $total"; exit 1; }
|