Skip to content

Commit 8f728de

Browse files
ukangaukanga
committed
Separate ecr image build to use arm64 runner for arm64 builds
1 parent e0d1932 commit 8f728de

File tree

1 file changed

+205
-0
lines changed

1 file changed

+205
-0
lines changed

‎.github/workflows/ecr-image-build-w-arm-runner.yml‎

Lines changed: 205 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,205 @@
1+
---
2+
name: AWS ECR Build Image with ARM Runner
3+
4+
on:
5+
release:
6+
types:
7+
- "released"
8+
push:
9+
- "main"
10+
- "*-rc"
11+
tags:
12+
- "v*"
13+
14+
jobs:
15+
build:
16+
strategy:
17+
fail-fast: false
18+
matrix:
19+
platforms:
20+
- [linux/amd64, ubuntu-latest]
21+
- [linux/arm64, ubuntu-arm64-runner]
22+
runs-on: ${{ matrix.platforms[1] }}
23+
steps:
24+
- name: Prepare
25+
run: |
26+
platform=${{ matrix.platforms[0] }}
27+
echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
28+
29+
- name: Checkout
30+
uses: actions/checkout@v4
31+
32+
- name: Set up Docker Buildx
33+
uses: docker/setup-buildx-action@v3
34+
35+
- name: Configure AWS credentials
36+
uses: aws-actions/configure-aws-credentials@v4
37+
with:
38+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
39+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
40+
aws-region: eu-central-1
41+
42+
- name: Login to Amazon ECR
43+
id: login-ecr
44+
uses: aws-actions/amazon-ecr-login@v2
45+
46+
- name: Docker meta
47+
id: meta
48+
uses: docker/metadata-action@v5
49+
with:
50+
images: ${{ steps.login-ecr.outputs.registry }}/onaio/onadata
51+
tags: |
52+
type=ref,event=branch
53+
type=ref,event=tag
54+
55+
- name: Setup SSH Agent and add Github to known hosts
56+
env:
57+
SSH_AUTH_SOCK: /tmp/ssh-agent.sock
58+
run: |
59+
ssh-agent -a $SSH_AUTH_SOCK >> /dev/null
60+
ssh-add - <<< "${{ secrets.SSH_PRIVATE_KEY }}"
61+
mkdir -p ~/.ssh
62+
ssh-keyscan github.com > ~/.ssh/known_hosts
63+
64+
- name: Get the version
65+
id: get-version
66+
if: github.event_name != 'push'
67+
run: echo "version=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
68+
69+
- name: Get the branch name
70+
id: get-branch-name
71+
if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
72+
run: echo "version=${GITHUB_REF#refs/heads/}" >> $GITHUB_ENV
73+
74+
- name: (Ubuntu) Build and push
75+
id: docker-build-ubuntu
76+
uses: docker/build-push-action@v5
77+
with:
78+
context: .
79+
file: ./docker/onadata-uwsgi/Dockerfile.ubuntu
80+
platforms: ${{ matrix.platforms[0] }}
81+
cache-from: type=registry,ref=${{ steps.login-ecr.outputs.registry }}/onaio/onadata:${{ env.version || github.ref_name }}
82+
cache-to: type=inline
83+
ssh: |
84+
default=/tmp/ssh-agent.sock
85+
build-args: |
86+
optional_packages=PyYAML django-redis ${{ secrets.ECR_OPTIONAL_PACKAGES }}
87+
push: true
88+
labels: ${{ steps.meta.outputs.labels }}
89+
provenance: false
90+
outputs: type=image,name=${{ steps.login-ecr.outputs.registry }}/onaio/onadata,push-by-digest=true,name-canonical=true,push=true
91+
-
92+
name: Export digest
93+
run: |
94+
mkdir -p /tmp/digests
95+
digest="${{ steps.docker-build-ubuntu.outputs.digest }}"
96+
touch "/tmp/digests/${digest#sha256:}"
97+
-
98+
name: Upload digest
99+
uses: actions/upload-artifact@v4
100+
with:
101+
name: digests-${{ env.PLATFORM_PAIR }}
102+
path: /tmp/digests/*
103+
if-no-files-found: error
104+
retention-days: 1
105+
106+
merge:
107+
runs-on: ubuntu-latest
108+
needs:
109+
- build
110+
steps:
111+
- name: Download digests
112+
uses: actions/download-artifact@v4
113+
with:
114+
path: /tmp/digests
115+
pattern: digests-*
116+
merge-multiple: true
117+
118+
- name: Set up Docker Buildx
119+
uses: docker/setup-buildx-action@v3
120+
121+
- name: Configure AWS credentials
122+
uses: aws-actions/configure-aws-credentials@v4
123+
with:
124+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
125+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
126+
aws-region: eu-central-1
127+
128+
- name: Login to Amazon ECR
129+
id: login-ecr
130+
uses: aws-actions/amazon-ecr-login@v2
131+
132+
- name: Docker meta
133+
id: meta
134+
uses: docker/metadata-action@v5
135+
with:
136+
images: ${{ steps.login-ecr.outputs.registry }}/onaio/onadata
137+
tags: |
138+
type=ref,event=branch
139+
type=ref,event=tag
140+
141+
- name: Create manifest list and push
142+
working-directory: /tmp/digests
143+
run: |
144+
docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
145+
$(printf '${{ steps.login-ecr.outputs.registry }}/onaio/onadata@sha256:%s ' *)
146+
147+
- name: Inspect image
148+
run: |
149+
docker buildx imagetools inspect ${{ steps.login-ecr.outputs.registry }}/onaio/onadata:${{ steps.meta.outputs.version }}
150+
151+
- name: Run Trivy vulnerability scanner
152+
uses: aquasecurity/trivy-action@master
153+
with:
154+
image-ref: ${{ steps.login-ecr.outputs.registry }}/onaio/onadata:${{ steps.meta.outputs.version }}
155+
format: 'sarif'
156+
output: 'trivy-results.sarif'
157+
158+
- name: Upload Trivy scan result to Github security lab
159+
uses: github/codeql-action/upload-sarif@v3
160+
with:
161+
sarif_file: 'trivy-results.sarif'
162+
continue-on-error: true
163+
164+
- name: Run Trivy vulnerability scanner for Slack
165+
uses: aquasecurity/trivy-action@master
166+
with:
167+
image-ref: ${{ steps.login-ecr.outputs.registry }}/onaio/onadata:${{ steps.meta.outputs.version }}
168+
format: json
169+
output: 'trivy-results.json'
170+
171+
- name: Create summary of trivy issues
172+
run: |
173+
summary=$(jq -r '.Results[] | select(.Vulnerabilities) | .Vulnerabilities | group_by(.Severity) | map({Severity: .[0].Severity, Count: length}) | .[] | [.Severity, .Count] | join(": ")' trivy-results.json | awk 'NR > 1 { printf(" | ") } {printf "%s",$0}')
174+
if [ -z $summary ]
175+
then
176+
summary="0 Issues"
177+
fi
178+
echo "SUMMARY=$summary" >> $GITHUB_ENV
179+
180+
- name: Send Slack Notification
181+
uses: slackapi/[email protected]
182+
with:
183+
payload: |
184+
{
185+
"text": "Trivy scan results for ${{ steps.meta.outputs.version }}",
186+
"blocks": [
187+
{
188+
"type": "section",
189+
"text": {
190+
"type": "mrkdwn",
191+
"text": "[Ona Data] Trivy scan results: ${{ env.SUMMARY }}"
192+
}
193+
},
194+
{
195+
"type": "section",
196+
"text": {
197+
"type": "mrkdwn",
198+
"text": "View scan results: https://github.com/${{ github.repository }}/security/code-scanning?query=branch:${{ env.version || github.ref_name }}+is:open++"
199+
}
200+
}
201+
]
202+
}
203+
env:
204+
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
205+
SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

0 commit comments

Comments
 (0)