Skip to content

Build, Scan & Test Containers

uses: huntridge-labs/argus/.github/workflows/build-containers.yml@1.1.0

Pipeline

5 jobs (2 matrix) · scroll to zoom · drag to pan

Triggers

  • Pull request
  • Push
  • Manual dispatch

Permissions

Scope Access
contents read
security-events write
pull-requests write
packages read

Jobs

matrix — Resolve image matrix

Runs on: ubuntu-latest · Timeout: 5 minutes · Condition: github.event_name != 'push' || !startsWith(github.event.head_commit.message, 'chore(release):')

Steps:

  1. Checkout — actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
  2. Build matrix from argus.yml

build — Build Images

Runs on: ubuntu-latest · Timeout: 15 minutes · Depends on: matrix · Condition: github.event_name != 'push' || !startsWith(github.event.head_commit.message, 'chore(release):')

Steps:

  1. Checkout — actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
  2. Build image
  3. Save image to artifact
  4. Upload image artifact — actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f

scan — Scan ${{ matrix.image }}

Runs on: ubuntu-latest · Timeout: 15 minutes · Depends on: matrix, build · Condition: github.event_name != 'push' || !startsWith(github.event.head_commit.message, 'chore(release):')

Steps:

  1. Download image artifact — actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e
  2. Load image
  3. Checkout (for argus SDK) — actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
  4. Set up Python — actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
  5. Install Argus SDK
  6. Scan with Trivy (SARIF) — aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1
  7. Upload Trivy SARIF — github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13
  8. Scan with Grype — anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2
  9. Scan with Trivy (JSON) — aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1
  10. Generate report with Argus
  11. Upload scan artifacts — actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f

test-cli — Test Argus CLI

Runs on: ubuntu-latest · Timeout: 15 minutes · Depends on: matrix, build · Condition: github.event_name != 'push' || !startsWith(github.event.head_commit.message, 'chore(release):')

Steps:

  1. Checkout — actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
  2. Set up Python — actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
  3. Build and install Argus wheel
  4. Download all image artifacts — actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e
  5. Load and retag images
  6. Package safety check
  7. Verify wheel installation
  8. Run argus scan
  9. Resolve latest run directory
  10. Verify outputs
  11. Validate SARIF
  12. Validate JSON results
  13. Validate audit trail
  14. Validate output-vars
  15. Upload test results — actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f

comment-pr — Container Scan Summary

Runs on: ubuntu-latest · Depends on: scan, test-cli

Steps:

  1. Checkout (for comment-pr action) — actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
  2. Download scanner summaries — actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e
  3. Set up Python — actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
  4. Install Argus SDK
  5. Combine scanner summaries
  6. Comment PR with scan results — ./.github/actions/comment-pr