Skip to content

Stop using yaml anchors in release action configuration #1170

Stop using yaml anchors in release action configuration

Stop using yaml anchors in release action configuration #1170

Workflow file for this run

---
name: "Security"
on: # yamllint disable-line rule:truthy
push:
branches:
- "!dependabot/*"
- "main"
pull_request:
branches: ["*"]
merge_group:
types:
- "checks_requested"
env:
DOCKERHUB_PUBLIC_ACCESS_TOKEN: "dckr_pat_8AEETZWxu8f7FvJUk9NrpyX_ZEQ"
DOCKERHUB_PUBLIC_USER: "spicedbgithubactions"
jobs:
codeql:
name: "CodeQL Analyze"
if: "${{ github.event_name == 'pull_request' }}" # workaround to https://github.com/github/codeql-action/issues/1537
runs-on: "buildjet-8vcpu-ubuntu-2204"
timeout-minutes: "${{ (matrix.language == 'swift' && 120) || 360 }}"
permissions:
# required for all workflows
security-events: "write"
# only required for workflows in private repositories
actions: "read"
contents: "read"
strategy:
fail-fast: false
matrix:
language: ["go"]
steps:
- uses: "actions/checkout@v4"
- uses: "authzed/actions/setup-go@main"
- uses: "authzed/actions/codeql@main"
trivy:
name: "Analyze Code and Docker Image with Trivvy"
runs-on: "buildjet-2vcpu-ubuntu-2204"
steps:
- uses: "actions/checkout@v4"
with:
# Only a single commit is fetched by default, for the ref/SHA that triggered the workflow. Set fetch-depth: 0
# to fetch all history for all branches and tags. Refer here to learn which commit $GITHUB_SHA
# points to for different events.
#
# this is used so goreleaser generates the right version out of the tags, which we need so that
# trivy does not flag an old SpiceDB version
fetch-depth: 0
- uses: "authzed/actions/setup-go@main"
- uses: "docker/login-action@v3"
with:
username: "${{ env.DOCKERHUB_PUBLIC_USER }}"
password: "${{ env.DOCKERHUB_PUBLIC_ACCESS_TOKEN }}"
- name: "Install snapcraft"
run: |
sudo snap install snapcraft --channel=8.x/stable --classic
mkdir -p $HOME/.cache/snapcraft/download
mkdir -p $HOME/.cache/snapcraft/stage-packages
- uses: "aquasecurity/trivy-action@master"
with:
scan-type: "fs"
ignore-unfixed: true
format: "table"
exit-code: "1"
severity: "CRITICAL,HIGH,MEDIUM"
- uses: "goreleaser/goreleaser-action@v6"
id: "goreleaser"
with:
distribution: "goreleaser-pro"
version: "2.3.2"
args: "release --clean --split --snapshot --single-target --skip=chocolatey"
env:
GORELEASER_KEY: "${{ secrets.GORELEASER_KEY }}"
- name: "Obtain container image to scan"
run: 'echo "IMAGE_VERSION=$(jq .version dist/linux_amd64_v1/metadata.json --raw-output)" >> $GITHUB_ENV'
- name: "run trivy on release image"
run: "docker run -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy image --format table --exit-code 1 --ignore-unfixed --vuln-type os,library --no-progress --severity CRITICAL,HIGH,MEDIUM authzed/spicedb:v${{ env.IMAGE_VERSION }}-amd64"