Skip to content

Build, Scan & Test Containers

uses: huntridge-labs/argus/.github/workflows/build-containers.yml@1.8.1

Pipeline

5 jobs (2 matrix) · scroll to zoom · drag to pan

Triggers

  • Pull request
  • Push
  • Manual dispatch

Permissions

Scope Access
contents read
security-events write
pull-requests write
packages read

Jobs

matrix — Resolve image matrix

Runs on: ubuntu-latest · Timeout: 5 minutes · Condition: github.event_name != 'push' || !startsWith(github.event.head_commit.message, 'chore(release):')

Steps:

  1. Checkout — actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
  2. Build matrix from argus.yml

build — Build Images

Runs on: ubuntu-latest · Timeout: 15 minutes · Depends on: matrix · Condition: github.event_name != 'push' || !startsWith(github.event.head_commit.message, 'chore(release):')

Steps:

  1. Checkout — actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
  2. Build image
  3. Save image to artifact
  4. Upload image artifact — actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a

scan — Scan ${{ matrix.image }}

Runs on: ubuntu-latest · Timeout: 15 minutes · Depends on: matrix, build · Condition: github.event_name != 'push' || !startsWith(github.event.head_commit.message, 'chore(release):')

Steps:

  1. Download image artifact — actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
  2. Load image
  3. Checkout (for argus SDK) — actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
  4. Set up Python — actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
  5. Install Argus SDK
  6. Scan with Trivy (SARIF) — aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
  7. Upload Trivy SARIF — github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a
  8. Scan with Grype — anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2
  9. Scan with Trivy (JSON) — aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
  10. Generate report with Argus
  11. Upload scan artifacts — actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a

test-cli — Test Argus CLI

Runs on: ubuntu-latest · Timeout: 15 minutes · Depends on: matrix, build · Condition: github.event_name != 'push' || !startsWith(github.event.head_commit.message, 'chore(release):')

Steps:

  1. Checkout — actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
  2. Set up Python — actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
  3. Build and install Argus wheel
  4. Download all image artifacts — actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
  5. Load and retag images
  6. Package safety check
  7. Verify wheel installation
  8. Run argus scan
  9. Resolve latest run directory
  10. Verify outputs
  11. Validate SARIF
  12. Validate JSON results
  13. Validate audit trail
  14. Validate output-vars
  15. Upload test results — actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a

comment-pr — Container Scan Summary

Runs on: ubuntu-latest · Depends on: scan, test-cli

Steps:

  1. Checkout (for comment-pr action) — actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
  2. Download scanner summaries — actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
  3. Set up Python — actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
  4. Install Argus SDK
  5. Combine scanner summaries
  6. Comment PR with scan results — ./.github/actions/comment-pr