name: Artifacts on: workflow_call: inputs: publish: description: Publish artifacts to the artifact store default: false required: false type: boolean outputs: container-image-name: description: Container image name value: ${{ jobs.container-image.outputs.name }} container-image-digest: description: Container image digest value: ${{ jobs.container-image.outputs.digest }} container-image-tag: description: Container image tag value: ${{ jobs.container-image.outputs.tag }} container-image-ref: description: Container image ref value: ${{ jobs.container-image.outputs.ref }} container-image-url-depot: description: Container image URL from Depot value: ${{ jobs.container-image.outputs.depot-image-url }} permissions: contents: read jobs: container-image: name: Container image runs-on: ubuntu-latest permissions: contents: read packages: write id-token: write security-events: write outputs: name: ${{ steps.image-name.outputs.value }} digest: ${{ steps.build.outputs.digest }} tag: ${{ steps.meta.outputs.version }} ref: ${{ steps.image-ref.outputs.value }} depot-image-url: "registry.depot.dev/${{ steps.build.outputs.project-id }}@${{ steps.build.outputs.imageid }}" steps: - name: Checkout repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Set up Depot CLI uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.7.1 - name: Set image name id: image-name run: echo "value=ghcr.io/${{ github.repository }}" >> "$GITHUB_OUTPUT" - name: Gather build metadata id: meta uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 with: images: ${{ steps.image-name.outputs.value }} flavor: | latest = false tags: | type=ref,event=branch type=ref,event=pr,prefix=pr- type=semver,pattern={{raw}} type=raw,value=latest,enable={{is_default_branch}} type=ref,event=branch,suffix=-{{sha}}-{{date 'X'}},enable={{is_default_branch}} - name: Login to GitHub Container Registry uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ github.token }} if: inputs.publish - name: Build and push image id: build uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0 with: context: . build-args: | VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }} platforms: linux/amd64,linux/arm64 # The confluent library doesn't support ARMv7 tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} push: ${{ inputs.publish }} save: true project: ${{ vars.DEPOT_PROJECT }} - name: Set image ref id: image-ref run: echo "value=${STEPS_IMAGE_NAME_OUTPUTS_VALUE}@${STEPS_BUILD_OUTPUTS_DIGEST}" >> "$GITHUB_OUTPUT" env: STEPS_IMAGE_NAME_OUTPUTS_VALUE: ${{ steps.image-name.outputs.value }} STEPS_BUILD_OUTPUTS_DIGEST: ${{ steps.build.outputs.digest }} - name: Retrieve pull token id: pull-token run: | PULL_TOKEN="$(depot pull-token --project "${VARS_DEPOT_PROJECT}")" echo "token=$PULL_TOKEN" >> "$GITHUB_OUTPUT" echo "::add-mask::$PULL_TOKEN" env: VARS_DEPOT_PROJECT: ${{ vars.DEPOT_PROJECT }} ### Trivy is comporomised # # - name: Run Trivy vulnerability scanner # uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # 0.33.1 # with: # image-ref: registry.depot.dev/${{ vars.DEPOT_PROJECT }}:${{ steps.build.outputs.build-id }} # format: sarif # output: trivy-results.sarif # env: # TRIVY_USERNAME: x-token # TRIVY_PASSWORD: ${{ steps.pull-token.outputs.token }} # TRIVY_DB_REPOSITORY: ghcr.io/openmeterio/trivy-db:2 # - name: Upload Trivy scan results as artifact # uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 # with: # name: "[${{ github.job }}] Trivy scan results" # path: trivy-results.sarif # retention-days: 5 # - name: Upload Trivy scan results to GitHub Security tab # uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.29.5 # with: # sarif_file: trivy-results.sarif benthos-collector-container-image: name: Benthos Collector Container image runs-on: ubuntu-latest permissions: contents: read packages: write id-token: write security-events: write outputs: name: ${{ steps.image-name.outputs.value }} digest: ${{ steps.build.outputs.digest }} tag: ${{ steps.meta.outputs.version }} ref: ${{ steps.image-ref.outputs.value }} steps: - name: Checkout repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Set up Depot CLI uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.7.1 - name: Set image name id: image-name run: echo "value=ghcr.io/openmeterio/benthos-collector" >> "$GITHUB_OUTPUT" - name: Gather build metadata id: meta uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 with: images: ${{ steps.image-name.outputs.value }} flavor: | latest = false tags: | type=ref,event=branch type=ref,event=pr,prefix=pr- type=semver,pattern={{raw}} type=raw,value=latest,enable={{is_default_branch}} type=ref,event=branch,suffix=-{{sha}}-{{date 'X'}},enable={{is_default_branch}} - name: Login to GitHub Container Registry uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ github.token }} if: inputs.publish - name: Build and push image id: build uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0 with: context: . file: benthos-collector.Dockerfile build-args: | VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }} platforms: linux/amd64,linux/arm64 tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} push: ${{ inputs.publish }} save: true project: ${{ vars.DEPOT_PROJECT }} - name: Set image ref id: image-ref run: echo "value=${STEPS_IMAGE_NAME_OUTPUTS_VALUE}@${STEPS_BUILD_OUTPUTS_DIGEST}" >> "$GITHUB_OUTPUT" env: STEPS_IMAGE_NAME_OUTPUTS_VALUE: ${{ steps.image-name.outputs.value }} STEPS_BUILD_OUTPUTS_DIGEST: ${{ steps.build.outputs.digest }} - name: Retrieve pull token id: pull-token run: | PULL_TOKEN="$(depot pull-token --project "${VARS_DEPOT_PROJECT}")" echo "token=$PULL_TOKEN" >> "$GITHUB_OUTPUT" echo "::add-mask::$PULL_TOKEN" env: VARS_DEPOT_PROJECT: ${{ vars.DEPOT_PROJECT }} # - name: Run Trivy vulnerability scanner # uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # 0.33.1 # with: # image-ref: registry.depot.dev/${{ vars.DEPOT_PROJECT }}:${{ steps.build.outputs.build-id }} # format: sarif # output: trivy-results.sarif # env: # TRIVY_USERNAME: x-token # TRIVY_PASSWORD: ${{ steps.pull-token.outputs.token }} # TRIVY_DB_REPOSITORY: ghcr.io/openmeterio/trivy-db:2 # - name: Upload Trivy scan results as artifact # uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 # with: # name: "[${{ github.job }}] Trivy scan results" # path: trivy-results.sarif # retention-days: 5 # - name: Upload Trivy scan results to GitHub Security tab # uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.29.5 # with: # sarif_file: trivy-results.sarif