Updated ci.yml, ecr-scheduled-security-scan.yml and ecr-scheduled-sec…

.github/workflows/ci.yml

@@ -1,184 +1,74 @@
-name: CI/CD
+name: CI/CD PHP Build and Scan
 
-on: push
+on:
+  push:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
-  build:
-    runs-on: ubuntu-latest
+  build-and-scan-images-for-vulnerabilities:
     strategy:
       fail-fast: false
       matrix:
         include:
           ## Alpine
           ### Alpine 3.18
           - image: "alpine/3.18/8.1/Dockerfile"
-            tags: [ "spryker/php:8.1-alpine3.18" ]
-            platforms: [ "linux/amd64", "linux/arm64" ]
+            tag: "spryker/php:8.1-alpine3.18"
+            platforms: "linux/amd64,linux/arm64"
           - image: "alpine/3.18/8.2/Dockerfile"
-            tags: [ "spryker/php:8.2-alpine3.18" ]
-            platforms: [ "linux/amd64", "linux/arm64" ]
+            tag: "spryker/php:8.2-alpine3.18"
+            platforms: "linux/amd64,linux/arm64"
           - image: "alpine/3.18/8.3/Dockerfile"
-            tags: [ "spryker/php:8.3-alpine3.18" ]
-            platforms: [ "linux/amd64", "linux/arm64" ]
+            tag: "spryker/php:8.3-alpine3.18"
+            platforms: "linux/amd64,linux/arm64"
 
           ### Alpine 3.19
           - image: "alpine/3.19/8.1/Dockerfile"
-            tags: [ "spryker/php:8.1-alpine3.19" ]
-            platforms: [ "linux/amd64", "linux/arm64" ]
+            tag: "spryker/php:8.1-alpine3.19"
+            platforms: "linux/amd64,linux/arm64"
           - image: "alpine/3.19/8.2/Dockerfile"
-            tags: [ "spryker/php:8.2-alpine3.19" ]
-            platforms: [ "linux/amd64", "linux/arm64" ]
+            tag: "spryker/php:8.2-alpine3.19"
+            platforms: "linux/amd64,linux/arm64"
           - image: "alpine/3.19/8.3/Dockerfile"
-            tags: [ "spryker/php:8.3-alpine3.19" ]
-            platforms: [ "linux/amd64", "linux/arm64" ]
+            tag: "spryker/php:8.3-alpine3.19"
+            platforms: "linux/amd64,linux/arm64"
 
           ### Alpine 3.20
           - image: "alpine/3.20/8.1/Dockerfile"
-            tags: [ "spryker/php:8.1", "spryker/php:8.1-alpine3.20" ]
-            platforms: [ "linux/amd64", "linux/arm64" ]
+            tag: "spryker/php:8.1-alpine3.20"
+            platforms: "linux/amd64,linux/arm64"
           - image: "alpine/3.20/8.2/Dockerfile"
-            tags: [ "spryker/php:latest", "spryker/php:8.2", "spryker/php:8.2-alpine3.20" ]
-            platforms: [ "linux/amd64", "linux/arm64" ]
+            tag: "spryker/php:8.2-alpine3.20"
+            platforms: "linux/amd64,linux/arm64"
           - image: "alpine/3.20/8.3/Dockerfile"
-            tags: [ "spryker/php:8.3", "spryker/php:8.3-alpine3.20" ]
-            platforms: [ "linux/amd64", "linux/arm64" ]
+            tag: "spryker/php:8.3-alpine3.20"
+            platforms: "linux/amd64,linux/arm64"
 
           ## Debian
           ### Debian bullseye
           - image: "debian/bullseye/8.0/Dockerfile"
-            tags: [ "spryker/php:8.0-debian" ]
-            platforms: [ "linux/amd64", "linux/arm64" ]
+            tag: "spryker/php:8.0-debian"
+            platforms: "linux/amd64,linux/arm64"
           - image: "debian/bullseye/8.1/Dockerfile"
-            tags: [ "spryker/php:8.1-debian" ]
-            platforms: [ "linux/amd64", "linux/arm64" ]
+            tag: "spryker/php:8.1-debian"
+            platforms: "linux/amd64,linux/arm64"
           - image: "debian/bullseye/8.2/Dockerfile"
-            tags: [ "spryker/php:8.2-debian" ]
-            platforms: [ "linux/amd64", "linux/arm64" ]
+            tag: "spryker/php:8.2-debian"
+            platforms: "linux/amd64,linux/arm64"
           - image: "debian/bullseye/8.3/Dockerfile"
-            tags: [ "spryker/php:8.3-debian" ]
-            platforms: [ "linux/amd64", "linux/arm64" ]
-
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-
-      - name: Get the previous commit hash
-        id: previous_commit
-        run: |
-          if [ "${{ github.ref }}" == "refs/heads/master" ]; then
-            PREV_COMMIT_HASH=$(git rev-parse HEAD^1)
-          else
-            PREV_COMMIT_HASH=$(git rev-parse origin/master)
-            IMAGE_TAG="${{ matrix.tags[0] }}"
-            echo "Pulling image $IMAGE_TAG"
-            docker pull "$IMAGE_TAG"
-
-            NEW_TAG="${IMAGE_TAG}-${PREV_COMMIT_HASH}"
-            echo "Re-tagging image to $NEW_TAG"
-            docker tag "$IMAGE_TAG" "$NEW_TAG"
-
-            echo "Removing the pulled image $IMAGE_TAG"
-            docker rmi "$IMAGE_TAG" || true
-          fi
-          echo "PREV_COMMIT_HASH=$PREV_COMMIT_HASH" >> $GITHUB_ENV
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-
-      - name: Login to DockerHub
-        uses: docker/login-action@v1
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Re-tag images with previous commit hash
-        if: ${{ github.ref == 'refs/heads/master' }}
-        run: |
-          PREV_HASH=${{ env.PREV_COMMIT_HASH }}
-          IMAGE_TAGS="${{ join(matrix.tags, ' ') }}"
-          for IMAGE_TAG in $IMAGE_TAGS; do
-            docker pull "$IMAGE_TAG"
-            NEW_TAG="${IMAGE_TAG}-${PREV_HASH}"
-            docker tag "$IMAGE_TAG" "$NEW_TAG"
-            echo "Re-tagged image: $NEW_TAG"
-            docker push $NEW_TAG
-          done
-
-      - name: Build and push
-        id: docker_build
-        uses: docker/build-push-action@v2
-        with:
-          push: ${{ github.ref == 'refs/heads/master' }}
-          load: ${{ github.ref != 'refs/heads/master' }}
-          file: ${{ matrix.image }}
-          tags: ${{ join(matrix.tags) }}
-          platforms: ${{ github.ref == 'refs/heads/master' && join(matrix.platforms) || 'linux/amd64' }}
-
-      - name: Pull image for master branch
-        if: github.ref == 'refs/heads/master'
-        run: |
-          echo "Pulling image for master branch"
-          docker pull ${{ matrix.tags[0] }}
-
-      - name: Current image report
-        id: manifest
-        run: |
-          CURRENT_TAG=${{ matrix.tags[0] }}
-          bash .github/compare-images.sh $CURRENT_TAG > current-image-report.txt || true
-          cat current-image-report.txt
-
-      - name: Previous image report
-        run: |
-          PREVIOUS_TAG="${{ matrix.tags[0] }}-${{ env.PREV_COMMIT_HASH }}"
-          bash .github/compare-images.sh $PREVIOUS_TAG > previous-image-report.txt || true
-          cat previous-image-report.txt
-
-      - name: Run the diff and format output
-        id: diff
-        run: bash .github/format-output.sh
-
-      - name: Fetch Job ID
-        id: fetch_job_id
-        if: ${{ github.ref == 'refs/heads/master' && env.DIFF_OUTPUT != '' }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          JOBS_JSON=$(curl -s -H "Authorization: Bearer $GITHUB_TOKEN" \
-            "https://api.github.com/repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/jobs")
-          echo "$JOBS_JSON" > jobs-response.json
-          cat jobs-response.json
-          JOB_ID=$(echo "$JOBS_JSON" | jq -r '.jobs[0].id')
-          echo "Extracted Job ID: $JOB_ID"
-          echo "::set-output name=job_id::$JOB_ID"
-
-      - name: Send Slack Notification
-        if: ${{ github.ref == 'refs/heads/master' && env.DIFF_OUTPUT != '' }}
-        uses: slackapi/[email protected]
-        with:
-          payload: |
-            {
-              "attachments": [
-                {
-                  "color": "good", 
-                  "fields": [
-                    {
-                      "title": "New version of ${{ matrix.tags[0] }} has been published",
-                      "value": "You can check the:\n- *Manifest*: <https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}/job/${{ steps.fetch_job_id.outputs.job_id }}#step:9:1|View Manifest>\n- *Diff*: <https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}/job/${{ steps.fetch_job_id.outputs.job_id }}#step:11:7|View Diff>\n\nThis version was built out of <https://github.com/${{ github.repository }}/commit/${{ github.sha }}|${{ github.sha }}>.",
-                      "short": false
-                    }
-                  ]
-                }
-              ]
-            }
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_CE_RELEASE_WEBHOOK }}
-          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
+            tag: "spryker/php:8.3-debian"
+            platforms: "linux/amd64,linux/arm64"
+
+    name: Build and Scan - ${{ matrix.tag }}
+    uses: spryker-projects/gha-reusable-workflows/.github/workflows/ci.yml@main
+    with:
+      image: ${{ matrix.image }}
+      tag: ${{ matrix.tag }}
+      platforms: ${{ matrix.platforms }}
+    secrets:
+      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_CE_RELEASE_WEBHOOK }}

.github/workflows/ecr-scheduled-security-scan.yml

@@ -1,4 +1,4 @@
-name: ECR vulnerability detection
+name: ECR PHP Vulnerability Scan
 
 on:
   schedule:
@@ -9,121 +9,63 @@ on:
 
 jobs:
   vulnerability-detection:
-    runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
         include:
           ## Alpine
           ### Alpine 3.18
           - image: "alpine/3.18/8.1/Dockerfile"
-            tags: "8.1-alpine3.18"
+            tag: "8.1-alpine3.18"
             platforms: "linux/amd64"
+            image_type: "PHP"
           - image: "alpine/3.18/8.2/Dockerfile"
-            tags: "8.2-alpine3.18"
+            tag: "8.2-alpine3.18"
             platforms: "linux/amd64"
+            image_type: "PHP"
           - image: "alpine/3.18/8.3/Dockerfile"
-            tags: "8.3-alpine3.18"
+            tag: "8.3-alpine3.18"
             platforms: "linux/amd64"
+            image_type: "PHP"
 
           ### Alpine 3.19
           - image: "alpine/3.19/8.1/Dockerfile"
-            tags: "8.1-alpine3.19"
+            tag: "8.1-alpine3.19"
             platforms: "linux/amd64"
+            image_type: "PHP"
           - image: "alpine/3.19/8.2/Dockerfile"
-            tags: "8.2-alpine3.19"
+            tag: "8.2-alpine3.19"
             platforms: "linux/amd64"
+            image_type: "PHP"
           - image: "alpine/3.19/8.3/Dockerfile"
-            tags: "8.3-alpine3.19"
+            tag: "8.3-alpine3.19"
             platforms: "linux/amd64"
+            image_type: "PHP"
 
           ### Alpine 3.20
           - image: "alpine/3.20/8.1/Dockerfile"
-            tags: "8.1-alpine3.20"
+            tag: "8.1-alpine3.20"
             platforms: "linux/amd64"
+            image_type: "PHP"
           - image: "alpine/3.20/8.2/Dockerfile"
-            tags: "8.2-alpine3.20"
+            tag: "8.2-alpine3.20"
             platforms: "linux/amd64"
+            image_type: "PHP"
           - image: "alpine/3.20/8.3/Dockerfile"
-            tags: "8.3-alpine3.20"
+            tag: "8.3-alpine3.20"
             platforms: "linux/amd64"
+            image_type: "PHP"
 
-    steps:
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v1
-        with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: ${{ secrets.AWS_REGION }}
-
-      - name: Login to AWS ECR
-        uses: aws-actions/amazon-ecr-login@v1
-
-      - name: Build and push
-        id: docker-build
-        uses: docker/build-push-action@v2
-        with:
-          push: true
-          file: ${{ matrix.image }}
-          tags: ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ secrets.AWS_REGION }}.amazonaws.com/${{ secrets.AWS_ECR_REPO }}:${{ matrix.tags }}-${{ github.sha }}
-          platforms: ${{ matrix.platforms }}
-
-      - name: Scan Docker image
-        id: docker-scan
-        uses: alexjurkiewicz/[email protected]
-        with:
-          repository: ${{ secrets.AWS_ECR_REPO }}
-          tag: ${{ join(matrix.tags) }}-${{ github.sha }}
-
-      - name: Delete images after scan images
-        run: |
-          aws ecr batch-delete-image --repository-name ${{ secrets.AWS_ECR_REPO }} --image-id imageTag="${{ join(matrix.tags) }}-${{ github.sha }}"
-
-      - run: |
-          echo "${{ steps.docker-scan.outputs.total }} total vulnerabilities."
-
-      - name: Set Date and Time
-        id: set-date
-        if: github.event.schedule == '0 9 * * *'
-        run: echo "::set-output name=current_datetime::$(date +'%Y-%m-%d %H:%M:%S')"
-
-      - name: Set Color
-        id: set-color
-        if: github.event.schedule == '0 9 * * *'
-        run: |
-          if [[ "${{ true }}" ]]; then
-            COLOR="#008000"
-          else
-            COLOR="#ff0000"
-          fi
-          echo "::set-output name=color::$COLOR"
-
-      - name: Send GitHub Action trigger data to Slack workflow
-        id: slack
-        if: github.event.schedule == '0 9 * * *'
-        uses: slackapi/[email protected]
-        with:
-          payload: |
-            {
-              "text": "Scanned image tag *${{ matrix.tags }}*.",
-              "attachments": [
-                {
-                  "pretext": "ECR vulnerability scan outputs for ${{ steps.set-date.outputs.current_datetime }}",
-                  "color": "${{ steps.set-color.outputs.color }}",
-                  "fields": [
-                    {
-                      "title": "Status",
-                      "short": true,
-                      "value": "*${{ steps.docker-scan.outputs.total }}* total vulnerabilities"
-                    }
-                  ]
-                }
-              ]
-            }
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
-
-      - name: Fail the execution
-        if: ${{ steps.docker-scan.outputs.total > 0 }}
-        run: exit 1
+    uses: spryker-projects/gha-reusable-workflows/.github/workflows/ecr-scheduled-security-scan.yml@main
+    with:
+      image: ${{ matrix.image }}
+      tag: ${{ matrix.tag }}
+      platforms: ${{ matrix.platforms }}
+      image_type: ${{ matrix.image_type }}
+    secrets:
+      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      AWS_REGION: ${{ secrets.AWS_REGION }}
+      AWS_ACCOUNT_ID: ${{ secrets.AWS_ACCOUNT_ID }}
+      AWS_ECR_REPO: ${{ secrets.AWS_ECR_REPO }}
+      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}