[security] Apply security fixes and prepare for release 0.5.3 #131
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Continuous integration, including test and integration test | |
| name: Main test | |
| # Run in master and dev branches and in all pull requests to those branches | |
| on: | |
| push: | |
| branches: [ master, dev ] | |
| pull_request: | |
| branches: [ master, dev ] | |
| jobs: | |
| # Build and test the code | |
| kotlin: | |
| # The type of runner that the job will run on | |
| runs-on: ubuntu-latest | |
| # Steps represent a sequence of tasks that will be executed as part of the job | |
| steps: | |
| # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it | |
| - uses: actions/checkout@v3 | |
| - uses: actions/setup-java@v3 | |
| with: | |
| distribution: temurin | |
| java-version: 17 | |
| - name: Setup Gradle | |
| uses: gradle/gradle-build-action@v2 | |
| # Compile the code | |
| - name: Compile code | |
| run: ./gradlew assemble | |
| # Gradle check | |
| - name: Check | |
| run: ./gradlew check | |
| # Build and test the code | |
| node: | |
| # The type of runner that the job will run on | |
| runs-on: ubuntu-latest | |
| # Steps represent a sequence of tasks that will be executed as part of the job | |
| steps: | |
| # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it | |
| - uses: actions/checkout@v3 | |
| - name: Use Node.js 16 | |
| uses: actions/setup-node@v3 | |
| with: | |
| node-version: 16 | |
| cache: npm | |
| cache-dependency-path: '**/package-lock.json' | |
| # Compile the code | |
| - name: Install dependencies | |
| working-directory: ./radar-app-config-frontend | |
| run: npm install | |
| # Compile the code | |
| - name: Build code | |
| working-directory: ./radar-app-config-frontend | |
| run: npm run build | |
| dockerFrontend: | |
| # The type of runner that the job will run on | |
| runs-on: ubuntu-latest | |
| env: | |
| DOCKER_IMAGE: radarbase/radar-app-config-frontend | |
| # Steps represent a sequence of tasks that will be executed as part of the job | |
| steps: | |
| # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it | |
| - uses: actions/checkout@v3 | |
| - name: Login to Docker Hub | |
| uses: docker/login-action@v2 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| # Add Docker labels and tags | |
| - name: Docker meta | |
| id: docker_meta | |
| uses: docker/metadata-action@v4 | |
| with: | |
| images: ${{ env.DOCKER_IMAGE }} | |
| # Setup docker build environment | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v2 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v2 | |
| - name: Cache Docker layers | |
| id: cache-buildx | |
| uses: actions/cache@v3 | |
| with: | |
| path: /tmp/.buildx-cache | |
| key: ${{ runner.os }}-buildx-frontend-${{ hashFiles('radar-app-config-frontend/**') }} | |
| restore-keys: | | |
| ${{ runner.os }}-buildx-frontend- | |
| - name: Cache parameters | |
| id: cache-parameters | |
| run: | | |
| if [ "${{ steps.cache-buildx.outputs.cache-hit }}" = "true" ]; then | |
| echo "cache_to=" >> $GITHUB_OUTPUT | |
| else | |
| echo "cache_to=type=local,dest=/tmp/.buildx-cache-new,mode=max" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Build docker | |
| uses: docker/build-push-action@v3 | |
| with: | |
| context: ./radar-app-config-frontend | |
| cache-from: type=local,src=/tmp/.buildx-cache | |
| cache-to: ${{ steps.cache-parameters.outputs.cache_to }} | |
| push: true | |
| platforms: linux/amd64,linux/arm64 | |
| tags: ${{ steps.docker_meta.outputs.tags }} | |
| # Use runtime labels from docker_meta as well as fixed labels | |
| labels: | | |
| ${{ steps.docker_meta.outputs.labels }} | |
| maintainer=Peyman Mohtashami <peyman@thehyve.nl>, Joris Borgdorff <joris@thehyve.nl> | |
| org.opencontainers.image.description=RADAR-base app-config frontend | |
| org.opencontainers.image.authors=Peyman Mohtashami <peyman@thehyve.nl>, Joris Borgdorff <joris@thehyve.nl> | |
| org.opencontainers.image.vendor=RADAR-base | |
| org.opencontainers.image.licenses=Apache-2.0 | |
| - name: Inspect docker image | |
| run: | | |
| docker pull ${{ env.DOCKER_IMAGE }}:${{ steps.docker_meta.outputs.version }} | |
| docker image inspect ${{ env.DOCKER_IMAGE }}:${{ steps.docker_meta.outputs.version }} | |
| # Temp fix | |
| # https://github.com/docker/build-push-action/issues/252 | |
| # https://github.com/moby/buildkit/issues/1896 | |
| - name: Move docker build cache | |
| if: steps.cache-buildx.outputs.cache-hit != 'true' | |
| run: | | |
| rm -rf /tmp/.buildx-cache | |
| mv /tmp/.buildx-cache-new /tmp/.buildx-cache | |
| dockerBackend: | |
| # The type of runner that the job will run on | |
| runs-on: ubuntu-latest | |
| env: | |
| DOCKER_IMAGE: radarbase/radar-app-config | |
| # Steps represent a sequence of tasks that will be executed as part of the job | |
| steps: | |
| # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it | |
| - uses: actions/checkout@v3 | |
| - name: Login to Docker Hub | |
| uses: docker/login-action@v2 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| # Add Docker labels and tags | |
| - name: Docker meta | |
| id: docker_meta | |
| uses: docker/metadata-action@v4 | |
| with: | |
| images: ${{ env.DOCKER_IMAGE }} | |
| # Setup docker build environment | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v2 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v2 | |
| - name: Cache Docker layers | |
| id: cache-buildx | |
| uses: actions/cache@v3 | |
| with: | |
| path: /tmp/.buildx-cache | |
| key: ${{ runner.os }}-buildx-backend-${{ hashFiles('radar-app-config/Dockerfile', '**/*.gradle.kts', 'gradle.properties', '*/src/main/**') }} | |
| restore-keys: | | |
| ${{ runner.os }}-buildx-backend- | |
| - name: Cache parameters | |
| id: cache-parameters | |
| run: | | |
| if [ "${{ steps.cache-buildx.outputs.cache-hit }}" = "true" ]; then | |
| echo "cache_to=" >> $GITHUB_OUTPUT | |
| else | |
| echo "cache_to=type=local,dest=/tmp/.buildx-cache-new,mode=max" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Build docker | |
| uses: docker/build-push-action@v3 | |
| with: | |
| context: . | |
| file: radar-app-config/Dockerfile | |
| cache-from: type=local,src=/tmp/.buildx-cache | |
| cache-to: ${{ steps.cache-parameters.outputs.cache_to }} | |
| push: true | |
| platforms: linux/amd64,linux/arm64 | |
| tags: ${{ steps.docker_meta.outputs.tags }} | |
| # Use runtime labels from docker_meta as well as fixed labels | |
| labels: | | |
| ${{ steps.docker_meta.outputs.labels }} | |
| maintainer=Joris Borgdorff <joris@thehyve.nl> | |
| org.opencontainers.image.description=RADAR-base app-config backend | |
| org.opencontainers.image.authors=Joris Borgdorff <joris@thehyve.nl> | |
| org.opencontainers.image.vendor=RADAR-base | |
| org.opencontainers.image.licenses=Apache-2.0 | |
| - name: Load docker image | |
| run: docker pull ${{ env.DOCKER_IMAGE }}:${{ steps.docker_meta.outputs.version }} | |
| - name: Inspect docker image | |
| run: | | |
| docker pull ${{ env.DOCKER_IMAGE }}:${{ steps.docker_meta.outputs.version }} | |
| docker image inspect ${{ env.DOCKER_IMAGE }}:${{ steps.docker_meta.outputs.version }} | |
| docker run --rm ${{ env.DOCKER_IMAGE }}:${{ steps.docker_meta.outputs.version }} curl --version | |
| # Temp fix | |
| # https://github.com/docker/build-push-action/issues/252 | |
| # https://github.com/moby/buildkit/issues/1896 | |
| - name: Move docker build cache | |
| if: steps.cache-buildx.outputs.cache-hit != 'true' | |
| run: | | |
| rm -rf /tmp/.buildx-cache | |
| mv /tmp/.buildx-cache-new /tmp/.buildx-cache |