vaultwarden/.woodpecker/build-container.yml
Renovator Bot e1cf5b787e
All checks were successful
ci/woodpecker/push/build-package Pipeline was successful
ci/woodpecker/push/build-container Pipeline was successful
ci/woodpecker/push/docs Pipeline was successful
ci/woodpecker/push/notify Pipeline was successful
chore(deps): update quay.io/thegeeklab/wp-docker-buildx docker tag to v5 (#208)
Reviewed-on: #208
Co-authored-by: Renovator Bot <renovator@rknet.org>
Co-committed-by: Renovator Bot <renovator@rknet.org>
2024-07-08 21:32:03 +02:00

69 lines
1.8 KiB
YAML

---
when:
- event: [pull_request, tag]
- event: [push, manual]
branch:
- ${CI_REPO_DEFAULT_BRANCH}
steps:
- name: security-build
image: quay.io/thegeeklab/wp-docker-buildx:5
settings:
containerfile: Containerfile
output: type=oci,dest=oci/${CI_REPO_NAME},tar=false
repo: thegeeklab/${CI_REPO_NAME}
cache_to: type=local,dest=oci/cache/${CI_REPO_NAME},mode=max
- name: security-scan
image: ghcr.io/aquasecurity/trivy
commands:
- trivy -v
- trivy image --input oci/${CI_REPO_NAME}
environment:
TRIVY_EXIT_CODE: "1"
TRIVY_IGNORE_UNFIXED: "true"
TRIVY_NO_PROGRESS: "true"
TRIVY_SEVERITY: HIGH,CRITICAL
TRIVY_TIMEOUT: 1m
- name: publish-dockerhub
image: quay.io/thegeeklab/wp-docker-buildx:5
group: container
settings:
auto_tag: true
containerfile: Containerfile
password:
from_secret: docker_password
provenance: false
repo: thegeeklab/${CI_REPO_NAME}
username:
from_secret: docker_username
cache_from:
- 'type=local\\,src=oci/cache/${CI_REPO_NAME}'
when:
- event: [tag]
- event: [push, manual]
branch:
- ${CI_REPO_DEFAULT_BRANCH}
- name: publish-quay
image: quay.io/thegeeklab/wp-docker-buildx:5
group: container
settings:
auto_tag: true
containerfile: Containerfile
password:
from_secret: quay_password
provenance: false
registry: quay.io
repo: quay.io/thegeeklab/${CI_REPO_NAME}
username:
from_secret: quay_username
cache_from:
- 'type=local\\,src=oci/cache/${CI_REPO_NAME}'
when:
- event: [tag]
- event: [push, manual]
branch:
- ${CI_REPO_DEFAULT_BRANCH}