nginx-s3/.woodpecker/build-container.yml

70 lines
1.7 KiB
YAML
Raw Normal View History

2023-11-07 15:36:24 +00:00
---
when:
- event: [pull_request, tag]
- event: [push, manual]
branch:
- ${CI_REPO_DEFAULT_BRANCH}
steps:
2024-01-16 15:27:02 +00:00
- name: security-build
image: quay.io/thegeeklab/wp-docker-buildx:3
2023-11-07 15:36:24 +00:00
settings:
containerfile: Containerfile.multiarch
output: type=oci,dest=oci/${CI_REPO_NAME},tar=false
repo: thegeeklab/${CI_REPO_NAME}
2024-01-16 15:27:02 +00:00
- name: security-scan
2023-11-07 15:36:24 +00:00
image: ghcr.io/aquasecurity/trivy
commands:
- trivy -v
- trivy image --input oci/${CI_REPO_NAME}
environment:
TRIVY_EXIT_CODE: "1"
TRIVY_IGNORE_UNFIXED: "true"
TRIVY_NO_PROGRESS: "true"
TRIVY_SEVERITY: HIGH,CRITICAL
TRIVY_TIMEOUT: 1m
2024-01-16 15:30:53 +00:00
- name: publish-dockerhub
image: quay.io/thegeeklab/wp-docker-buildx:3
2024-01-16 15:30:53 +00:00
group: container
2023-11-07 15:36:24 +00:00
settings:
auto_tag: true
containerfile: Containerfile.multiarch
password:
from_secret: docker_password
platforms:
- linux/amd64
- linux/arm64
provenance: false
repo: thegeeklab/${CI_REPO_NAME}
username:
from_secret: docker_username
when:
- event: [tag]
- event: [push, manual]
branch:
- ${CI_REPO_DEFAULT_BRANCH}
2024-01-16 15:30:53 +00:00
- name: publish-quay
image: quay.io/thegeeklab/wp-docker-buildx:3
2024-01-16 15:30:53 +00:00
group: container
2023-11-07 15:36:24 +00:00
settings:
auto_tag: true
containerfile: Containerfile.multiarch
password:
from_secret: quay_password
platforms:
- linux/amd64
- linux/arm64
provenance: false
registry: quay.io
repo: quay.io/thegeeklab/${CI_REPO_NAME}
username:
from_secret: quay_username
when:
- event: [tag]
- event: [push, manual]
branch:
- ${CI_REPO_DEFAULT_BRANCH}