Scan images and upload results before pushing them #310
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build images 🔧 | |
| on: | |
| pull_request: | |
| jobs: | |
| get-old-versions: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Extract versions | |
| run: | | |
| docker run --name generic quay.io/kairos/framework:main true || true | |
| docker cp generic:/etc/kairos/versions.yaml versions.old.yaml | |
| docker rm generic | |
| docker run --name fips quay.io/kairos/framework:main-fips true || true | |
| docker cp fips:/etc/kairos/versions.yaml versions-fips.old.yaml | |
| docker rm fips | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: old_versions.zip | |
| path: | | |
| versions.old.yaml | |
| versions-fips.old.yaml | |
| build: | |
| permissions: | |
| id-token: write # OIDC support | |
| contents: write | |
| secrets: inherit | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| security_profile: [generic, fips] | |
| uses: ./.github/workflows/reusable-build.yaml | |
| with: | |
| security_profile: ${{ matrix.security_profile }} | |
| comment-pr: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| pull-requests: write | |
| needs: [build, get-old-versions] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Download versions | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: versions.zip | |
| - name: Download versions fips | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: versions-fips.zip | |
| - name: Download old versions | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: old_versions.zip | |
| - name: Generate PR text | |
| run: | | |
| .github/diffversions.sh | |
| - name: Comment PR | |
| uses: thollander/actions-comment-pull-request@v2 | |
| with: | |
| comment_tag: bot-comment | |
| filePath: pr-message |