72 lines
2.1 KiB
YAML
72 lines
2.1 KiB
YAML
name: Build base images (Generally from basin repo)
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
image_tag:
|
|
required: true
|
|
type: string
|
|
fail_on_scan:
|
|
default: true
|
|
type: boolean
|
|
|
|
jobs:
|
|
docker-build-and-push:
|
|
|
|
runs-on: ubuntu-22.04 #ubuntu-latest
|
|
|
|
steps:
|
|
- id: get-id
|
|
name: Get a unique tag for this build
|
|
run: |
|
|
echo "DOCKER_IMAGE=${{ vars.GCP_DOCKER_REGISTRY }}/${{ github.repository }}:${{ inputs.image_tag }}" >> "$GITHUB_OUTPUT";
|
|
|
|
- name: Print image name
|
|
run: |
|
|
echo "${{ steps.get-id.outputs.DOCKER_IMAGE }}";
|
|
|
|
- uses: actions/checkout@v4
|
|
|
|
# ✅ 1) Auth to GCP (this is where your SA key is used)
|
|
- name: Auth to GCP
|
|
uses: google-github-actions/auth@v2
|
|
with:
|
|
# using your existing secret that contains the SA JSON
|
|
credentials_json: ${{ secrets.GCP_SA_KEY }}
|
|
|
|
# ✅ 2) Install gcloud (no creds here)
|
|
- name: Set up gcloud
|
|
uses: google-github-actions/setup-gcloud@v2
|
|
with:
|
|
project_id: ${{ vars.GCP_PROJECT_ID }}
|
|
export_default_credentials: true
|
|
|
|
- name: Configure Docker for GAR
|
|
run: |
|
|
gcloud auth configure-docker ${{vars.GCP_REGION}}-docker.pkg.dev
|
|
|
|
- name: Build and push the Docker image
|
|
run: |
|
|
docker build \
|
|
--file context/Dockerfile \
|
|
--tag ${{ steps.get-id.outputs.DOCKER_IMAGE }} \
|
|
./context;
|
|
|
|
- name: Container details
|
|
run: |
|
|
IMAGE_SIZE=`docker inspect -f "{{ .Size }}" ${{ steps.get-id.outputs.DOCKER_IMAGE }} | numfmt --to=si`;
|
|
echo "$IMAGE_SIZE container ${{ steps.get-id.outputs.DOCKER_IMAGE }}";
|
|
|
|
# - name: Scan Docker Image for vulnerabilities with Grype
|
|
# uses: anchore/scan-action@v6
|
|
# with:
|
|
# image: ${{ steps.get-id.outputs.DOCKER_IMAGE }}
|
|
# cache-db: true #Cache Grype DB in Github Actions
|
|
# output-format: table
|
|
# only-fixed: true
|
|
# severity-cutoff: critical
|
|
# fail-build: ${{ inputs.fail_on_scan }}
|
|
|
|
- name: Push the container image
|
|
run: docker push ${{ steps.get-id.outputs.DOCKER_IMAGE }}
|