initial release
This commit is contained in:
commit
b05da49bbf
34
.gitea/workflows/build.yaml
Normal file
34
.gitea/workflows/build.yaml
Normal file
@ -0,0 +1,34 @@
|
|||||||
|
name: Container Build
|
||||||
|
|
||||||
|
on:
|
||||||
|
push:
|
||||||
|
branches:
|
||||||
|
- main
|
||||||
|
pull_request:
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
build-image:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
container:
|
||||||
|
image: catthehacker/ubuntu:act-latest
|
||||||
|
steps:
|
||||||
|
- uses: actions/checkout@v4
|
||||||
|
with:
|
||||||
|
submodules: true # Fetch Hugo themes (true OR recursive)
|
||||||
|
fetch-depth: 0 # Fetch all history for .GitInfo and .Lastmod
|
||||||
|
|
||||||
|
- name: Set up QEMU
|
||||||
|
uses: docker/setup-qemu-action@v3
|
||||||
|
|
||||||
|
- name: Set up Docker BuildX
|
||||||
|
uses: docker/setup-buildx-action@v3
|
||||||
|
|
||||||
|
- name: Build
|
||||||
|
uses: docker/build-push-action@v4
|
||||||
|
with:
|
||||||
|
context: .
|
||||||
|
file: ./Dockerfile
|
||||||
|
platforms: |
|
||||||
|
linux/amd64
|
||||||
|
# linux/arm64
|
||||||
|
push: false
|
65
.gitea/workflows/build_and_push.yaml
Normal file
65
.gitea/workflows/build_and_push.yaml
Normal file
@ -0,0 +1,65 @@
|
|||||||
|
name: Container Publish
|
||||||
|
|
||||||
|
on:
|
||||||
|
push:
|
||||||
|
tags:
|
||||||
|
- '*'
|
||||||
|
schedule:
|
||||||
|
- cron: "0 22 * * *"
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
build-image:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
container:
|
||||||
|
image: catthehacker/ubuntu:act-latest
|
||||||
|
steps:
|
||||||
|
- uses: actions/checkout@v4
|
||||||
|
with:
|
||||||
|
submodules: true # Fetch Hugo themes (true OR recursive)
|
||||||
|
fetch-depth: 0 # Fetch all history for .GitInfo and .Lastmod
|
||||||
|
|
||||||
|
- name: Set up QEMU
|
||||||
|
uses: docker/setup-qemu-action@v3
|
||||||
|
|
||||||
|
- name: Set up Docker BuildX
|
||||||
|
uses: docker/setup-buildx-action@v3
|
||||||
|
|
||||||
|
- name: Login to registry
|
||||||
|
uses: docker/login-action@v3
|
||||||
|
with:
|
||||||
|
registry: git.libreschool.org
|
||||||
|
username: ${{ secrets.REGISTRY_USER }}
|
||||||
|
password: ${{ secrets.REGISTRY_TOKEN }}
|
||||||
|
|
||||||
|
- name: Build and publish
|
||||||
|
uses: docker/build-push-action@v4
|
||||||
|
with:
|
||||||
|
context: .
|
||||||
|
file: ./Dockerfile
|
||||||
|
platforms: |
|
||||||
|
linux/amd64
|
||||||
|
# linux/arm64
|
||||||
|
load: true
|
||||||
|
tags: git.libreschool.org/bglug/hugo-extended:latest
|
||||||
|
|
||||||
|
- name: Run Trivy vulnerability scanner
|
||||||
|
id: scan
|
||||||
|
uses: aquasecurity/trivy-action@master
|
||||||
|
with:
|
||||||
|
image-ref: "git.libreschool.org/bglug/hugo-extended:latest"
|
||||||
|
format: "json"
|
||||||
|
output: "trivy-results.json"
|
||||||
|
|
||||||
|
- name: check output
|
||||||
|
run: if [ $(jq '.Results[0].Vulnerabilities|length' trivy-results.json) -ne "0" ] ; then exit 1 ; fi
|
||||||
|
|
||||||
|
- name: Build and publish
|
||||||
|
uses: docker/build-push-action@v4
|
||||||
|
with:
|
||||||
|
context: .
|
||||||
|
file: ./Dockerfile
|
||||||
|
platforms: |
|
||||||
|
linux/amd64
|
||||||
|
# linux/arm64
|
||||||
|
push: true
|
||||||
|
tags: git.libreschool.org/bglug/hugo-extended:latest
|
35
.gitea/workflows/vulnscan.yaml
Normal file
35
.gitea/workflows/vulnscan.yaml
Normal file
@ -0,0 +1,35 @@
|
|||||||
|
name: Vulnerability Scan
|
||||||
|
|
||||||
|
on:
|
||||||
|
schedule:
|
||||||
|
- cron: "0 18 * * *"
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
scan:
|
||||||
|
name: Daily Vulnerability Scan
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
container:
|
||||||
|
image: catthehacker/ubuntu:act-latest
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- name: Login to registry
|
||||||
|
uses: docker/login-action@v3
|
||||||
|
with:
|
||||||
|
registry: git.libreschool.org
|
||||||
|
username: ${{ secrets.REGISTRY_USER }}
|
||||||
|
password: ${{ secrets.REGISTRY_TOKEN }}
|
||||||
|
|
||||||
|
- name: Pull docker image
|
||||||
|
run: docker pull git.libreschool.org/bglug/hugo-extended:latest
|
||||||
|
|
||||||
|
- name: Run Trivy vulnerability scanner
|
||||||
|
id: scan
|
||||||
|
uses: aquasecurity/trivy-action@master
|
||||||
|
with:
|
||||||
|
image-ref: "git.libreschool.org/bglug/hugo-extended:latest"
|
||||||
|
format: "json"
|
||||||
|
output: "trivy-results.json"
|
||||||
|
|
||||||
|
# if some vulnerability is found, we fail
|
||||||
|
- name: check output
|
||||||
|
run: if [ $(jq '.Results[0].Vulnerabilities|length' trivy-results.json) -ne "0" ] ; then exit 1 ; fi
|
7
Dockerfile
Normal file
7
Dockerfile
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
FROM alpine:latest
|
||||||
|
|
||||||
|
RUN \
|
||||||
|
apk -U upgrade && \
|
||||||
|
apk add hugo
|
||||||
|
|
||||||
|
ENTRYPOINT [ "/usr/bin/hugo" ]
|
Loading…
x
Reference in New Issue
Block a user