Updated permissions #10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Publish Dev Container | |
| on: | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - '.devcontainer/**' | |
| - '.github/workflows/build-devcontainer.yml' | |
| pull_request: | |
| branches: | |
| - main | |
| paths: | |
| - '.devcontainer/**' | |
| workflow_dispatch: | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository }} | |
| jobs: | |
| build-and-publish: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| pull-requests: write # For PR comments from security scan | |
| actions: write # For uploading artifacts from security scan | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Log in to Container Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| tags: | | |
| type=ref,event=branch | |
| type=ref,event=pr | |
| type=sha,prefix={{branch}}- | |
| type=raw,value=latest,enable={{is_default_branch}} | |
| - name: Extract tag names only | |
| id: tags | |
| run: | | |
| # Extract just the tag portions (everything after the last colon) | |
| TAGS=$(echo '${{ steps.meta.outputs.tags }}' | sed 's/.*://' | tr '\n' ',' | sed 's/,$//') | |
| echo "tags=$TAGS" >> $GITHUB_OUTPUT | |
| echo "Extracted tags: $TAGS" | |
| - name: Build and publish dev container | |
| uses: devcontainers/ci@v0.3 | |
| with: | |
| imageName: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| imageTag: ${{ steps.tags.outputs.tags }} | |
| cacheFrom: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| push: filter | |
| refFilterForPush: refs/heads/main | |
| # Test the container with a simple validation | |
| runCmd: | | |
| echo "=== Testing dev container ===" | |
| echo "Python: $(python3 --version)" | |
| echo "Git: $(git --version)" | |
| echo "Pip: $(pip3 --version)" | |
| # Test Python import | |
| python3 -c "import sys; print(f'Python executable: {sys.executable}')" | |
| # Test if common development tools are available | |
| if command -v zsh &> /dev/null; then | |
| echo "Zsh: $(zsh --version)" | |
| fi | |
| if command -v quarto &> /dev/null; then | |
| echo "Quarto: $(quarto --version)" | |
| else | |
| echo "Quarto: Not found (this may be expected)" | |
| fi | |
| echo "=== Dev container validation completed! ===" | |
| # Using the custom Trivy Security Scan action from this repository | |
| - name: Security Scan | |
| id: security-scan | |
| uses: smartdatafoundry/trivy-security-scan/.github/actions/trivy-security-scan@v1.0.0 | |
| with: | |
| image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| registry: ${{ env.REGISTRY }} | |
| severity: 'CRITICAL,HIGH' | |
| detailed-severity: 'CRITICAL,HIGH,MEDIUM,LOW' | |
| ignore-unfixed: 'true' | |
| exit-code: '0' | |
| artifact-name: 'security-scan-results' | |
| artifact-retention-days: '30' | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| post-pr-comment: 'true' | |
| # Optional: Handle scan results programmatically | |
| - name: Process scan results | |
| run: | | |
| echo "Security scan status: ${{ steps.security-scan.outputs.scan-status }}" | |
| echo "Vulnerabilities found: ${{ steps.security-scan.outputs.vulnerability-count }}" | |
| echo "Artifact ID: ${{ steps.security-scan.outputs.artifact-id }}" | |
| # You can add custom logic here based on the scan results | |
| if [ "${{ steps.security-scan.outputs.scan-status }}" = "vulnerabilities_found" ]; then | |
| echo "⚠️ Security vulnerabilities detected!" | |
| echo "Consider reviewing the security report before deploying." | |
| # Optionally, you could fail the build for critical vulnerabilities: | |
| # if [ "${{ steps.security-scan.outputs.vulnerability-count }}" -gt "10" ]; then | |
| # echo "❌ Too many vulnerabilities found (> 10), failing build" | |
| # exit 1 | |
| # fi | |
| else | |
| echo "✅ No critical or high severity vulnerabilities found!" | |
| fi | |
| - name: Container info | |
| if: success() | |
| run: | | |
| echo "✅ Dev container built and published successfully!" | |
| echo "📦 Registry: ${{ env.REGISTRY }}" | |
| echo "🏷️ Image: ${{ env.IMAGE_NAME }}" | |
| echo "🆔 Tags: ${{ steps.meta.outputs.tags }}" | |
| echo "📝 Labels: ${{ steps.meta.outputs.labels }}" | |
| echo "" | |
| echo "To use this dev container:" | |
| echo "1. Reference it in your devcontainer.json:" | |
| echo ' "image": "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:<tag>"' | |
| echo "2. Or use it directly with Docker:" | |
| echo " docker run --rm -it ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:<tag>" | |
| echo "" | |
| echo "Available tags:" | |
| echo "${{ steps.meta.outputs.tags }}" | tr ',' '\n' | sed 's/^/ - /' |