forked from dexidp/dex
-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #266 from aristanetworks/mkelly-merge-from-upstream
Merge from upstream
- Loading branch information
Showing
207 changed files
with
8,455 additions
and
4,831 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| name: OpenSSF Scorecard | ||
|
|
||
| on: | ||
| branch_protection_rule: | ||
| push: | ||
| branches: [ main ] | ||
| schedule: | ||
| - cron: '30 0 * * 5' | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| analyze: | ||
| name: Analyze | ||
| runs-on: ubuntu-latest | ||
|
|
||
| permissions: | ||
| actions: read | ||
| contents: read | ||
| id-token: write | ||
| security-events: write | ||
|
|
||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | ||
| with: | ||
| persist-credentials: false | ||
|
|
||
| - name: Run analysis | ||
| uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0 | ||
| with: | ||
| results_file: results.sarif | ||
| results_format: sarif | ||
| publish_results: true | ||
|
|
||
| - name: Upload results as artifact | ||
| uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4 | ||
| with: | ||
| name: OpenSSF Scorecard results | ||
| path: results.sarif | ||
| retention-days: 5 | ||
|
|
||
| - name: Upload results to GitHub Security tab | ||
| uses: github/codeql-action/upload-sarif@afb54ba388a7dca6ecae48f608c4ff05ff4cc77a # v3.25.15 | ||
| with: | ||
| sarif_file: results.sarif |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,12 +1,31 @@ | ||
| name: Artifacts | ||
|
|
||
| on: | ||
| push: | ||
| branches: | ||
| - master | ||
| tags: | ||
| - v[0-9]+.[0-9]+.[0-9]+ | ||
| pull_request: | ||
| workflow_call: | ||
| inputs: | ||
| publish: | ||
| description: Publish artifacts to the artifact store | ||
| default: false | ||
| required: false | ||
| type: boolean | ||
| secrets: | ||
| DOCKER_USERNAME: | ||
| required: true | ||
| DOCKER_PASSWORD: | ||
| required: true | ||
| outputs: | ||
| container-image-name: | ||
| description: Container image name | ||
| value: ${{ jobs.container-images.outputs.name }} | ||
| container-image-digest: | ||
| description: Container image digest | ||
| value: ${{ jobs.container-images.outputs.digest }} | ||
| container-image-ref: | ||
| description: Container image ref | ||
| value: ${{ jobs.container-images.outputs.ref }} | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| container-images: | ||
|
|
@@ -18,80 +37,177 @@ jobs: | |
| - alpine | ||
| - distroless | ||
|
|
||
| permissions: | ||
| attestations: write | ||
| contents: read | ||
| packages: write | ||
| id-token: write | ||
| security-events: write | ||
|
|
||
|
|
||
| outputs: | ||
| name: ${{ steps.image-name.outputs.value }} | ||
| digest: ${{ steps.build.outputs.digest }} | ||
| ref: ${{ steps.image-ref.outputs.value }} | ||
|
|
||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v3 | ||
| - name: Checkout repository | ||
| uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | ||
|
|
||
| - name: Set up QEMU | ||
| uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0 | ||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3.6.1 | ||
|
|
||
| - name: Gather metadata | ||
| - name: Set up Syft | ||
| uses: anchore/sbom-action/download-syft@d94f46e13c6c62f59525ac9a1e147a99dc0b9bf5 # v0.17.0 | ||
|
|
||
| - name: Install cosign | ||
| uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0 | ||
|
|
||
| - name: Set image name | ||
| id: image-name | ||
| run: echo "value=ghcr.io/${{ github.repository }}" >> "$GITHUB_OUTPUT" | ||
|
|
||
| - name: Gather build metadata | ||
| id: meta | ||
| uses: docker/metadata-action@v4 | ||
| uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1 | ||
| with: | ||
| images: | | ||
| ghcr.io/dexidp/dex | ||
| ${{ steps.image-name.outputs.value }} | ||
| dexidp/dex | ||
| flavor: | | ||
| latest = false | ||
| tags: | | ||
| type=ref,event=branch,enable=${{ matrix.variant == 'alpine' }} | ||
| type=ref,event=pr,enable=${{ matrix.variant == 'alpine' }} | ||
| type=ref,event=pr,prefix=pr-,enable=${{ matrix.variant == 'alpine' }} | ||
| type=semver,pattern={{raw}},enable=${{ matrix.variant == 'alpine' }} | ||
| type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && matrix.variant == 'alpine' }} | ||
| type=raw,value=latest,enable=${{ github.ref_name == github.event.repository.default_branch && matrix.variant == 'alpine' }} | ||
| type=ref,event=branch,suffix=-${{ matrix.variant }} | ||
| type=ref,event=pr,suffix=-${{ matrix.variant }} | ||
| type=ref,event=pr,prefix=pr-,suffix=-${{ matrix.variant }} | ||
| type=semver,pattern={{raw}},suffix=-${{ matrix.variant }} | ||
| type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }},suffix=-${{ matrix.variant }} | ||
| type=raw,value=latest,enable={{is_default_branch}},suffix=-${{ matrix.variant }} | ||
| labels: | | ||
| org.opencontainers.image.documentation=https://dexidp.io/docs/ | ||
| - name: Set up QEMU | ||
| uses: docker/setup-qemu-action@v2 | ||
| # Multiple exporters are not supported yet | ||
| # See https://github.com/moby/buildkit/pull/2760 | ||
| - name: Determine build output | ||
| uses: haya14busa/action-cond@94f77f7a80cd666cb3155084e428254fea4281fd # v1.2.1 | ||
| id: build-output | ||
| with: | ||
| platforms: all | ||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v2 | ||
| cond: ${{ inputs.publish }} | ||
| if_true: type=image,push=true | ||
| if_false: type=oci,dest=image.tar | ||
|
|
||
| - name: Login to GitHub Container Registry | ||
| uses: docker/login-action@v2 | ||
| uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0 | ||
| with: | ||
| registry: ghcr.io | ||
| username: ${{ github.repository_owner }} | ||
| username: ${{ github.actor }} | ||
| password: ${{ github.token }} | ||
| if: github.event_name == 'push' | ||
| if: inputs.publish | ||
|
|
||
| - name: Login to Docker Hub | ||
| uses: docker/login-action@v2 | ||
| uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0 | ||
| with: | ||
| username: ${{ secrets.DOCKER_USERNAME }} | ||
| password: ${{ secrets.DOCKER_PASSWORD }} | ||
| if: github.event_name == 'push' | ||
| if: inputs.publish | ||
|
|
||
| - name: Build and push | ||
| uses: docker/build-push-action@v4 | ||
| - name: Build and push image | ||
| id: build | ||
| uses: docker/build-push-action@5176d81f87c23d6fc96624dfdbcd9f3830bbe445 # v6.5.0 | ||
| with: | ||
| context: . | ||
| platforms: linux/amd64,linux/arm/v7,linux/arm64,linux/ppc64le | ||
| # cache-from: type=gha | ||
| # cache-to: type=gha,mode=max | ||
| push: ${{ github.event_name == 'push' }} | ||
| platforms: linux/amd64,linux/arm/v7,linux/arm64,linux/ppc64le,linux/s390x | ||
| tags: ${{ steps.meta.outputs.tags }} | ||
| build-args: | | ||
| BASE_IMAGE=${{ matrix.variant }} | ||
| VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }} | ||
| COMMIT_HASH=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }} | ||
| BUILD_DATE=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }} | ||
| labels: ${{ steps.meta.outputs.labels }} | ||
| # cache-from: type=gha | ||
| # cache-to: type=gha,mode=max | ||
| outputs: ${{ steps.build-output.outputs.value }} | ||
| # push: ${{ inputs.publish }} | ||
|
|
||
| - name: Sign the images with GitHub OIDC Token | ||
| run: | | ||
| cosign sign --yes ${{ steps.image-name.outputs.value }}@${{ steps.build.outputs.digest }} | ||
| if: inputs.publish | ||
|
|
||
| - name: Set image ref | ||
| id: image-ref | ||
| run: echo "value=${{ steps.image-name.outputs.value }}@${{ steps.build.outputs.digest }}" >> "$GITHUB_OUTPUT" | ||
|
|
||
| - name: Fetch image | ||
| run: skopeo --insecure-policy copy docker://${{ steps.image-ref.outputs.value }} oci-archive:image.tar | ||
| if: inputs.publish | ||
|
|
||
| # Uncomment the following lines for debugging: | ||
| # - name: Upload image as artifact | ||
| # uses: actions/upload-artifact@v3 | ||
| # with: | ||
| # name: "[${{ github.job }}] OCI tarball" | ||
| # path: image.tar | ||
|
|
||
| - name: Extract OCI tarball | ||
| run: | | ||
| mkdir -p image | ||
| tar -xf image.tar -C image | ||
| # - name: List tags | ||
| # run: skopeo --insecure-policy list-tags oci:image | ||
| # | ||
| # # See https://github.com/anchore/syft/issues/1545 | ||
| # - name: Extract image from multi-arch image | ||
| # run: skopeo --override-os linux --override-arch amd64 --insecure-policy copy oci:image:${{ steps.image-name.outputs.value }}:${{ steps.meta.outputs.version }} docker-archive:docker.tar | ||
| # | ||
| # - name: Generate SBOM | ||
| # run: syft -o spdx-json=sbom-spdx.json docker-archive:docker.tar | ||
| # | ||
| # - name: Upload SBOM as artifact | ||
| # uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3 | ||
| # with: | ||
| # name: "[${{ github.job }}] SBOM" | ||
| # path: sbom-spdx.json | ||
| # retention-days: 5 | ||
|
|
||
| # TODO: uncomment when the action is working for non ghcr.io pushes. GH Issue: https://github.com/actions/attest-build-provenance/issues/80 | ||
| # - name: Generate build provenance attestation | ||
| # uses: actions/attest-build-provenance@210c1913531870065f03ce1f9440dd87bc0938cd # v1.4.0 | ||
| # with: | ||
| # subject-name: dexidp/dex | ||
| # subject-digest: ${{ steps.build.outputs.digest }} | ||
| # push-to-registry: true | ||
|
|
||
| - name: Generate build provenance attestation | ||
| uses: actions/attest-build-provenance@210c1913531870065f03ce1f9440dd87bc0938cd # v1.4.0 | ||
| with: | ||
| subject-name: ghcr.io/dexidp/dex | ||
| subject-digest: ${{ steps.build.outputs.digest }} | ||
| push-to-registry: true | ||
| if: inputs.publish | ||
|
|
||
| - name: Run Trivy vulnerability scanner | ||
| uses: aquasecurity/[email protected] | ||
| uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # 0.24.0 | ||
| with: | ||
| input: image | ||
| format: sarif | ||
| output: trivy-results.sarif | ||
|
|
||
| - name: Upload Trivy scan results as artifact | ||
| uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4 | ||
| with: | ||
| image-ref: "ghcr.io/dexidp/dex:${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}" | ||
| format: "sarif" | ||
| output: "trivy-results.sarif" | ||
| if: github.event_name == 'push' | ||
| name: "[${{ github.job }}] Trivy scan results" | ||
| path: trivy-results.sarif | ||
| retention-days: 5 | ||
| overwrite: true | ||
|
|
||
| - name: Upload Trivy scan results to GitHub Security tab | ||
| uses: github/codeql-action/upload-sarif@v2 | ||
| uses: github/codeql-action/upload-sarif@afb54ba388a7dca6ecae48f608c4ff05ff4cc77a # v3.25.15 | ||
| with: | ||
| sarif_file: "trivy-results.sarif" | ||
| if: github.event_name == 'push' | ||
| sarif_file: trivy-results.sarif | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.