Skip to content

ci: container image audit #121

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hojmark merged 2 commits into from
Mar 11, 2026
Merged

ci: container image audit #121

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
14b71dd
ci: container image audit
hojmark Mar 11, 2026
0db80c8
ci: simplify run command yaml
hojmark Mar 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 16 additions & 4 deletions .github/workflows/audit.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,8 @@ on:
workflow_dispatch:

jobs:
audit:
name: Vulnerability audit
nuget-audit:
name: NuGet packages
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
Expand All @@ -36,6 +36,18 @@ jobs:
# NU1903: Package with high severity detected
# NU1904: Package with critical severity detected
# NU1905: An audit source does not provide a vulnerability database
- name: Audit
- name: Audit NuGet packages
run: >
dotnet restore Drift.sln -p:WarningsAsErrors='"NU1900;NU1901;NU1902;NU1903;NU1904;NU1905"'
dotnet restore Drift.sln
-p:WarningsAsErrors='"NU1900;NU1901;NU1902;NU1903;NU1904;NU1905"'

container-audit:
name: Container image
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
- name: Audit container image
run: >
docker run --rm anchore/grype:latest
--fail-on high
hojmark/drift:latest
16 changes: 8 additions & 8 deletions .github/workflows/ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,11 +37,11 @@ jobs:
uses: ./.github/actions/setup-runner

- name: Run tests
run: |
dotnet run \
--project ./build/_build.csproj \
--target Test \
--commit ${{ github.sha }} \
run: >
dotnet run
--project ./build/_build.csproj
--target Test
--commit ${{ github.sha }}
--msbuildverbosity ${{ github.event.inputs.verbosity }}

- name: Display test results
Expand All @@ -51,7 +51,7 @@ jobs:

# TODO fix publish warnings and re-enable check
- name: Check for warnings
run: |
dotnet run \
--project ./build/_build.csproj \
run: >
dotnet run
--project ./build/_build.csproj
--target CheckBuildWarnings
14 changes: 7 additions & 7 deletions .github/workflows/prerelease.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,13 +25,13 @@ jobs:
- name: Release
env:
CUSTOM_VERSION: ${{ github.event.inputs.customVersion }}
run: |
dotnet run \
--project ./build/_build.csproj \
--target PreRelease \
--commit ${{ github.sha }} \
--githubtoken ${{ secrets.GITHUB_TOKEN }} \
--dockerhubpassword ${{ secrets.DOCKER_HUB_PAT_RW }} \
run: >
dotnet run
--project ./build/_build.csproj
--target PreRelease
--commit ${{ github.sha }}
--githubtoken ${{ secrets.GITHUB_TOKEN }}
--dockerhubpassword ${{ secrets.DOCKER_HUB_PAT_RW }}
--customversion $CUSTOM_VERSION

- name: Display test results
Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,12 +18,12 @@ jobs:
uses: ./.github/actions/setup-runner

- name: Release
run: |
dotnet run \
--project ./build/_build.csproj \
--target Release \
--commit ${{ github.sha }} \
--githubtoken ${{ secrets.GITHUB_TOKEN }} \
run: >
dotnet run
--project ./build/_build.csproj
--target Release
--commit ${{ github.sha }}
--githubtoken ${{ secrets.GITHUB_TOKEN }}
--dockerhubpassword ${{ secrets.DOCKER_HUB_PAT_RW }}

- name: Display test results
Expand Down
16 changes: 8 additions & 8 deletions .github/workflows/renovate.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,11 +30,11 @@ jobs:
private-key: ${{ secrets.RENOVATE_APP_PK }}

- name: Run Renovate
run: |
docker run --rm \
-e RENOVATE_LOG_LEVEL=${{ inputs.log_level }} \
-e RENOVATE_PRINT_CONFIG=${{ inputs.log_level != 'info' }} \
-e RENOVATE_PLATFORM=github \
-e RENOVATE_REPOSITORIES=hojmark/drift \
-e RENOVATE_TOKEN=${{ steps.app-token.outputs.token }} \
renovate/renovate:latest
run: >
docker run --rm
-e RENOVATE_LOG_LEVEL=${{ inputs.log_level }}
-e RENOVATE_PRINT_CONFIG=${{ inputs.log_level != 'info' }}
-e RENOVATE_PLATFORM=github
-e RENOVATE_REPOSITORIES=hojmark/drift
-e RENOVATE_TOKEN=${{ steps.app-token.outputs.token }}
renovate/renovate:latest
Loading