From f70dc6f0778bf890b239f57be4db29bc0204cce9 Mon Sep 17 00:00:00 2001 From: Cole Voss Date: Tue, 27 Jul 2021 18:08:55 -0500 Subject: [PATCH 01/15] trivy image scanning --- .github/workflows/test.yaml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index f521c13..d2864b9 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -118,6 +118,19 @@ jobs: run: | docker build -t typescript-node-boilerplate:${{ github.sha }} . + - name: Run Trivy vulnerability scanner + uses: aquasecurity/trivy-action@master + with: + image-ref: 'typescript-node-boilerplate:${{ github.sha }}' + format: 'template' + template: '@/contrib/sarif.tpl' + output: 'trivy-results.sarif' + + - name: Upload Trivy scan results to GitHub Security tab + uses: github/codeql-action/upload-sarif@v1 + with: + sarif_file: 'trivy-results.sarif' + update-deployment: name: Update Deployment runs-on: ubuntu-latest From a4b4ca6968d999e163a01c8ddfe69cafc25a498e Mon Sep 17 00:00:00 2001 From: Cole Voss Date: Tue, 27 Jul 2021 18:14:43 -0500 Subject: [PATCH 02/15] remove upload --- .github/workflows/test.yaml | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index d2864b9..5830ab4 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -122,14 +122,19 @@ jobs: uses: aquasecurity/trivy-action@master with: image-ref: 'typescript-node-boilerplate:${{ github.sha }}' - format: 'template' - template: '@/contrib/sarif.tpl' - output: 'trivy-results.sarif' - - - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v1 - with: - sarif_file: 'trivy-results.sarif' + format: 'table' + exit-code: '1' + ignore-unfixed: true + vuln-type: 'os,library' + severity: 'CRITICAL,HIGH' + # format: 'template' + # template: '@/contrib/sarif.tpl' + # output: 'trivy-results.sarif' + + # - name: Upload Trivy scan results to GitHub Security tab + # uses: github/codeql-action/upload-sarif@v1 + # with: + # sarif_file: 'trivy-results.sarif' update-deployment: name: Update Deployment From f8fe1828e383cf45a9356454fa90f30a8fc9ecc8 Mon Sep 17 00:00:00 2001 From: Cole Voss Date: Tue, 27 Jul 2021 18:22:55 -0500 Subject: [PATCH 03/15] use build push action --- .github/workflows/test.yaml | 56 +++++++++++++++++++++++++++---------- 1 file changed, 41 insertions(+), 15 deletions(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 5830ab4..56c86f2 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -114,28 +114,54 @@ jobs: steps: - uses: actions/checkout@v2 - - name: Build Image - run: | - docker build -t typescript-node-boilerplate:${{ github.sha }} . + # - name: Build Image + # run: | + # docker build -t typescript-node-boilerplate:${{ github.sha }} . - - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@master - with: - image-ref: 'typescript-node-boilerplate:${{ github.sha }}' - format: 'table' - exit-code: '1' - ignore-unfixed: true - vuln-type: 'os,library' - severity: 'CRITICAL,HIGH' - # format: 'template' - # template: '@/contrib/sarif.tpl' - # output: 'trivy-results.sarif' + # - name: Run Trivy vulnerability scanner + # uses: aquasecurity/trivy-action@master + # with: + # image-ref: 'typescript-node-boilerplate:${{ github.sha }}' + # format: 'table' + # exit-code: '1' + # ignore-unfixed: true + # vuln-type: 'os,library' + # severity: 'CRITICAL,HIGH' + # format: 'template' + # template: '@/contrib/sarif.tpl' + # output: 'trivy-results.sarif' # - name: Upload Trivy scan results to GitHub Security tab # uses: github/codeql-action/upload-sarif@v1 # with: # sarif_file: 'trivy-results.sarif' + - name: Set up QEMU + uses: docker/setup-qemu-action@v1 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v1 + + - name: Build and push + uses: docker/build-push-action@v2 + with: + context: . + push: false + tags: typescript-node-boilerplate:${{ github.sha }} + cache-from: type=local,src=/tmp/.buildx-cache + cache-to: type=local,dest=/tmp/.buildx-cache-new + + - name: Image digest + run: echo ${{ steps.docker_build.outputs.digest }} + + - # Temp fix + # https://github.com/docker/build-push-action/issues/252 + # https://github.com/moby/buildkit/issues/1896 + name: Move cache + run: | + rm -rf /tmp/.buildx-cache + mv /tmp/.buildx-cache-new /tmp/.buildx-cache + update-deployment: name: Update Deployment runs-on: ubuntu-latest From 3c07f052b6a84ec0beef79ecb9c235d8f47753bc Mon Sep 17 00:00:00 2001 From: Cole Voss Date: Tue, 27 Jul 2021 18:28:01 -0500 Subject: [PATCH 04/15] better cache? --- .github/workflows/test.yaml | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 56c86f2..4b77f6d 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -65,7 +65,7 @@ jobs: unit-test: name: Unit Tests runs-on: ubuntu-latest - needs: build + # needs: build steps: - uses: actions/checkout@v2 - uses: actions/setup-node@v1 @@ -90,7 +90,7 @@ jobs: integration-test: name: Integration Tests runs-on: ubuntu-latest - needs: build + # needs: build steps: - uses: actions/checkout@v2 - uses: actions/setup-node@v1 @@ -110,7 +110,7 @@ jobs: name: Build Docker Image runs-on: ubuntu-latest # needs: [integration-test, unit-test, linting] - needs: [integration-test, unit-test] + needs: [build, integration-test, unit-test] steps: - uses: actions/checkout@v2 @@ -142,7 +142,16 @@ jobs: - name: Set up Docker Buildx uses: docker/setup-buildx-action@v1 + - name: Cache Docker layers + uses: actions/cache@v2 + with: + path: /tmp/.buildx-cache + key: ${{ runner.os }}-buildx-${{ github.sha }} + restore-keys: | + ${{ runner.os }}-buildx- + - name: Build and push + id: docker_build uses: docker/build-push-action@v2 with: context: . From 5f9446caf643a49b484968ffce92cce93ef3099a Mon Sep 17 00:00:00 2001 From: Cole Voss Date: Tue, 27 Jul 2021 18:32:34 -0500 Subject: [PATCH 05/15] Fix job order --- .github/workflows/test.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 4b77f6d..cb6dd2b 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -66,6 +66,7 @@ jobs: name: Unit Tests runs-on: ubuntu-latest # needs: build + needs: create-deployment steps: - uses: actions/checkout@v2 - uses: actions/setup-node@v1 @@ -91,6 +92,7 @@ jobs: name: Integration Tests runs-on: ubuntu-latest # needs: build + needs: create-deployment steps: - uses: actions/checkout@v2 - uses: actions/setup-node@v1 From 25851ddcc4914e953bf362fdd66b6f956dfcc7e1 Mon Sep 17 00:00:00 2001 From: Cole Voss Date: Tue, 27 Jul 2021 18:47:39 -0500 Subject: [PATCH 06/15] cache npm --- .github/workflows/test.yaml | 65 +++++++++---------------------------- 1 file changed, 16 insertions(+), 49 deletions(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index cb6dd2b..0d70177 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -33,40 +33,29 @@ jobs: with: node-version: '16' + - name: Cache node modules + uses: actions/cache@v2 + env: + cache-name: cache-node-modules + with: + # npm cache files are stored in `~/.npm` on Linux/macOS + path: ~/.npm + key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package-lock.json') }} + restore-keys: | + ${{ runner.os }}-build-${{ env.cache-name }}- + ${{ runner.os }}-build- + ${{ runner.os }}- + - name: Install run: npm ci - name: Build run: npm run build --if-present - # linting: - # name: Super Lint - # runs-on: ubuntu-latest - # needs: build - - # steps: - # - name: Checkout Code - # uses: actions/checkout@v2 - # with: - # # Full git history is needed to get a proper list of changed files within `super-linter` - # fetch-depth: 0 - - # ################################ - # # Run Linter against code base # - # ################################ - # - name: Lint Code Base - # uses: github/super-linter@v4 - # env: - # DEFAULT_BRANCH: master - # GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # VALIDATE_ALL_CODEBASE: false - # VALIDATE_GITHUB_ACTIONS: false - unit-test: name: Unit Tests runs-on: ubuntu-latest - # needs: build - needs: create-deployment + needs: build steps: - uses: actions/checkout@v2 - uses: actions/setup-node@v1 @@ -91,8 +80,7 @@ jobs: integration-test: name: Integration Tests runs-on: ubuntu-latest - # needs: build - needs: create-deployment + needs: build steps: - uses: actions/checkout@v2 - uses: actions/setup-node@v1 @@ -112,31 +100,10 @@ jobs: name: Build Docker Image runs-on: ubuntu-latest # needs: [integration-test, unit-test, linting] - needs: [build, integration-test, unit-test] + needs: [integration-test, unit-test] steps: - uses: actions/checkout@v2 - # - name: Build Image - # run: | - # docker build -t typescript-node-boilerplate:${{ github.sha }} . - - # - name: Run Trivy vulnerability scanner - # uses: aquasecurity/trivy-action@master - # with: - # image-ref: 'typescript-node-boilerplate:${{ github.sha }}' - # format: 'table' - # exit-code: '1' - # ignore-unfixed: true - # vuln-type: 'os,library' - # severity: 'CRITICAL,HIGH' - # format: 'template' - # template: '@/contrib/sarif.tpl' - # output: 'trivy-results.sarif' - - # - name: Upload Trivy scan results to GitHub Security tab - # uses: github/codeql-action/upload-sarif@v1 - # with: - # sarif_file: 'trivy-results.sarif' - name: Set up QEMU uses: docker/setup-qemu-action@v1 From bc7d8fe87d5d89ef5c5cf8c475f51ea63d05f14d Mon Sep 17 00:00:00 2001 From: Cole Voss Date: Tue, 27 Jul 2021 18:52:07 -0500 Subject: [PATCH 07/15] use setup npm cache --- .github/workflows/test.yaml | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 0d70177..b362cd7 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -32,19 +32,7 @@ jobs: - uses: actions/setup-node@v1 with: node-version: '16' - - - name: Cache node modules - uses: actions/cache@v2 - env: - cache-name: cache-node-modules - with: - # npm cache files are stored in `~/.npm` on Linux/macOS - path: ~/.npm - key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package-lock.json') }} - restore-keys: | - ${{ runner.os }}-build-${{ env.cache-name }}- - ${{ runner.os }}-build- - ${{ runner.os }}- + cache: npm - name: Install run: npm ci @@ -61,6 +49,7 @@ jobs: - uses: actions/setup-node@v1 with: node-version: '16' + cache: npm - name: Install run: npm ci @@ -86,6 +75,7 @@ jobs: - uses: actions/setup-node@v1 with: node-version: '16' + cache: npm - name: Install run: npm ci From 1aed2443807ae50ff5e24369f1fb95715fcc7fdb Mon Sep 17 00:00:00 2001 From: Cole Voss Date: Tue, 27 Jul 2021 18:54:01 -0500 Subject: [PATCH 08/15] update setup node --- .github/workflows/test.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index b362cd7..8e83674 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -29,7 +29,7 @@ jobs: needs: create-deployment steps: - uses: actions/checkout@v2 - - uses: actions/setup-node@v1 + - uses: actions/setup-node@v2 with: node-version: '16' cache: npm @@ -46,7 +46,7 @@ jobs: needs: build steps: - uses: actions/checkout@v2 - - uses: actions/setup-node@v1 + - uses: actions/setup-node@v2 with: node-version: '16' cache: npm @@ -72,7 +72,7 @@ jobs: needs: build steps: - uses: actions/checkout@v2 - - uses: actions/setup-node@v1 + - uses: actions/setup-node@v2 with: node-version: '16' cache: npm From df3aad27f4a37e186d96901ecb7a9102d40ee6c4 Mon Sep 17 00:00:00 2001 From: Cole Voss Date: Tue, 27 Jul 2021 19:08:02 -0500 Subject: [PATCH 09/15] publish docker image to hub --- .github/workflows/test.yaml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 8e83674..ab43c32 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -54,9 +54,6 @@ jobs: - name: Install run: npm ci - - name: Build - run: npm run build --if-present - - name: Test run: npm test @@ -80,9 +77,6 @@ jobs: - name: Install run: npm ci - - name: Build - run: npm run build --if-present - - name: Test run: npm test @@ -109,12 +103,18 @@ jobs: restore-keys: | ${{ runner.os }}-buildx- + - name: Login to DockerHub + uses: docker/login-action@v1 + with: + username: ${{ secrets.DOCKERHUB_USERNAME }} + password: ${{ secrets.DOCKERHUB_TOKEN }} + - name: Build and push id: docker_build uses: docker/build-push-action@v2 with: context: . - push: false + push: true tags: typescript-node-boilerplate:${{ github.sha }} cache-from: type=local,src=/tmp/.buildx-cache cache-to: type=local,dest=/tmp/.buildx-cache-new From 01416c3398682deb9a893375c6b7f417b6244115 Mon Sep 17 00:00:00 2001 From: Cole Voss Date: Tue, 27 Jul 2021 19:13:56 -0500 Subject: [PATCH 10/15] fix tag? --- .github/workflows/test.yaml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index ab43c32..e245be4 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -95,6 +95,12 @@ jobs: - name: Set up Docker Buildx uses: docker/setup-buildx-action@v1 + - name: Login to DockerHub + uses: docker/login-action@v1 + with: + username: ${{ secrets.DOCKERHUB_USERNAME }} + password: ${{ secrets.DOCKERHUB_TOKEN }} + - name: Cache Docker layers uses: actions/cache@v2 with: @@ -103,19 +109,13 @@ jobs: restore-keys: | ${{ runner.os }}-buildx- - - name: Login to DockerHub - uses: docker/login-action@v1 - with: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_TOKEN }} - - name: Build and push id: docker_build uses: docker/build-push-action@v2 with: context: . push: true - tags: typescript-node-boilerplate:${{ github.sha }} + tags: ${{ secrets.DOCKERHUB_USERNAME }}/typescript-node-boilerplate:${{ github.sha }} cache-from: type=local,src=/tmp/.buildx-cache cache-to: type=local,dest=/tmp/.buildx-cache-new From 5150c8273802e2bcc4964bde3901a3eb58aa6df2 Mon Sep 17 00:00:00 2001 From: Cole Voss Date: Tue, 27 Jul 2021 19:19:30 -0500 Subject: [PATCH 11/15] tag it up --- .github/workflows/test.yaml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index e245be4..5c72f29 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -115,7 +115,15 @@ jobs: with: context: . push: true - tags: ${{ secrets.DOCKERHUB_USERNAME }}/typescript-node-boilerplate:${{ github.sha }} + images: | + ${{ secrets.DOCKERHUB_USERNAME }}/typescript-node-boilerplate + # tags: | + # ${{ github.sha }} + tags: | + type=schedule + type=ref,event=branch + type=ref,event=pr + type=sha cache-from: type=local,src=/tmp/.buildx-cache cache-to: type=local,dest=/tmp/.buildx-cache-new From 3db521ee48780aa336f6f5152d61fafe95086c31 Mon Sep 17 00:00:00 2001 From: Cole Voss Date: Tue, 27 Jul 2021 19:21:57 -0500 Subject: [PATCH 12/15] docker meta --- .github/workflows/test.yaml | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 5c72f29..2fe8992 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -89,6 +89,21 @@ jobs: steps: - uses: actions/checkout@v2 + - name: Docker meta + id: meta + uses: docker/metadata-action@v3 + with: + # list of Docker images to use as base name for tags + images: | + ${{ secrets.DOCKERHUB_USERNAME }}/typescript-node-boilerplate + # tags: | + # ${{ github.sha }} + tags: | + type=schedule + type=ref,event=branch + type=ref,event=pr + type=sha + - name: Set up QEMU uses: docker/setup-qemu-action@v1 @@ -115,15 +130,8 @@ jobs: with: context: . push: true - images: | - ${{ secrets.DOCKERHUB_USERNAME }}/typescript-node-boilerplate - # tags: | - # ${{ github.sha }} - tags: | - type=schedule - type=ref,event=branch - type=ref,event=pr - type=sha + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} cache-from: type=local,src=/tmp/.buildx-cache cache-to: type=local,dest=/tmp/.buildx-cache-new From 01c67446c9df20850029165423d1164f457bbe4f Mon Sep 17 00:00:00 2001 From: Cole Voss Date: Tue, 27 Jul 2021 19:26:33 -0500 Subject: [PATCH 13/15] use github sha for tag --- .github/workflows/test.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 2fe8992..b029aac 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -99,6 +99,7 @@ jobs: # tags: | # ${{ github.sha }} tags: | + ${{ github.sha }} type=schedule type=ref,event=branch type=ref,event=pr From 2c97eec771cb76a04b1cf68fb3c74e23718a4946 Mon Sep 17 00:00:00 2001 From: Cole Voss Date: Tue, 27 Jul 2021 19:34:42 -0500 Subject: [PATCH 14/15] push i guess --- .github/workflows/test.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index b029aac..392c033 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -103,6 +103,7 @@ jobs: type=schedule type=ref,event=branch type=ref,event=pr + type=ref,event=push type=sha - name: Set up QEMU From c39a1d9e9fe292fd360e79c60b8a32a8411aa390 Mon Sep 17 00:00:00 2001 From: Cole Voss Date: Tue, 27 Jul 2021 19:38:50 -0500 Subject: [PATCH 15/15] remove push event --- .github/workflows/test.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 392c033..b029aac 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -103,7 +103,6 @@ jobs: type=schedule type=ref,event=branch type=ref,event=pr - type=ref,event=push type=sha - name: Set up QEMU