release.yaml

name: Release
on:
  push:
    tags:
      - "*.*"

jobs:
  build-trivy-operator:
    name: Build trivy-operator
    runs-on: ubuntu-20.04
    permissions:
      contents: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
        with:
          fetch-depth: 0
          persist-credentials: true

      - run: |
          echo "TRIVY=$(curl --silent https://api.github.com/repos/aquasecurity/trivy/releases/latest | jq -r .name | cut -d 'v' -f2)" >> $GITHUB_ENV

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v1

      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v1

      - name: Login to DockerHub
        uses: docker/login-action@v1
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Prepare trivy
        id: prep_trivy
        run: |
          cp trivy-operator.py docker/trivy-operator/trivy-operator.py
          # amd64
          wget -q -O /tmp/trivy.tar.gz https://github.com/aquasecurity/trivy/releases/download/v${{env.TRIVY}}/trivy_${{env.TRIVY}}_Linux-64bit.tar.gz
          tar -C /tmp -xf /tmp/trivy.tar.gz
          mkdir docker/trivy-operator/amd64
          cp /tmp/trivy docker/trivy-operator/amd64/trivy
          rm -f /tmp/trivy.tar.gz /tmp/trivy
          # arm64v8
          wget -q -O /tmp/trivy.tar.gz https://github.com/aquasecurity/trivy/releases/download/v${{env.TRIVY}}/trivy_${{env.TRIVY}}_Linux-ARM64.tar.gz
          tar -C /tmp -xf /tmp/trivy.tar.gz
          mkdir docker/trivy-operator/arm64v8
          cp /tmp/trivy docker/trivy-operator/arm64v8/trivy
          rm -f /tmp/trivy.tar.gz /tmp/trivy

      - name: Build amd64 trivy-operator
        uses: docker/build-push-action@v3.3.0
        with:
          context: docker/trivy-operator/
          build-args:
            ARCH=amd64/
          tags: devopstales/trivy-operator:${{github.ref_name}}-amd64
          push: true
          provenance: false

      - name: Build arm64v8 trivy-operator
        uses: docker/build-push-action@v3.3.0
        with:
          context: docker/trivy-operator/
          build-args:
            ARCH=arm64v8/
          tags: devopstales/trivy-operator:${{github.ref_name}}-arm64v8
          push: true
          provenance: false

      - name: Create and push trivy-operator manifest images
        uses: Noelware/docker-manifest-action@master
        with:
          inputs: devopstales/trivy-operator:${{github.ref_name}}
          images: devopstales/trivy-operator:${{github.ref_name}}-amd64,devopstales/trivy-operator:${{github.ref_name}}-arm64v8
          push: true

  build-kube-bench-scnner:
    name: Build kube-bench-scnner
    runs-on: ubuntu-20.04
    permissions:
      contents: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
        with:
          fetch-depth: 0
          persist-credentials: true

      - run: |
          echo "BENCH=$(curl --silent https://api.github.com/repos/aquasecurity/kube-bench/releases/latest | jq -r .name | cut -d "v" -f2)" >> $GITHUB_ENV

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v1

      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v1

      - name: Login to DockerHub
        uses: docker/login-action@v1
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Prepare kube-bench
        id: prep_kube-bench
        run: |
          cp kube-bench-scnner.py docker/kube-bench-scnner/kube-bench-scnner.py
          # amd64 kube-bench
          wget -q -O /tmp/kube-bench.tar.gz https://github.com/aquasecurity/kube-bench/releases/download/v${{env.BENCH}}/kube-bench_${{env.BENCH}}_linux_amd64.tar.gz
          tar -C /tmp -xf /tmp/kube-bench.tar.gz
          mkdir docker/kube-bench-scnner/amd64
          cp /tmp/kube-bench docker/kube-bench-scnner/amd64/kube-bench
          rm -rf /tmp/kube-bench.tar.gz /tmp/kube-bench
          # arm64v8
          wget -q -O /tmp/kube-bench.tar.gz https://github.com/aquasecurity/kube-bench/releases/download/v${{env.BENCH}}/kube-bench_${{env.BENCH}}_linux_arm64.tar.gz
          tar -C /tmp -xf /tmp/kube-bench.tar.gz
          mkdir docker/kube-bench-scnner/arm64v8
          cp /tmp/kube-bench docker/kube-bench-scnner/arm64v8/kube-bench
          rm -rf /tmp/kube-bench.tar.gz /tmp/kube-bench

      - name: Build amd64 kube-bench-scnner
        uses: docker/build-push-action@v3.3.0
        with:
          context: docker/kube-bench-scnner/
          build-args:
            ARCH=amd64/
          tags: devopstales/kube-bench-scnner:${{github.ref_name}}-amd64
          push: true
          provenance: false

      - name: Build arm64v8 kube-bench-scnner
        uses: docker/build-push-action@v3.3.0
        with:
          context: docker/kube-bench-scnner/
          build-args:
            ARCH=arm64v8/
          tags: devopstales/kube-bench-scnner:${{github.ref_name}}-arm64v8
          push: true
          provenance: false

      - name: Create and push kube-bench-scnner manifest images
        uses: Noelware/docker-manifest-action@master
        with:
          inputs: devopstales/kube-bench-scnner:${{github.ref_name}}
          images: devopstales/kube-bench-scnner:${{github.ref_name}}-amd64,devopstales/kube-bench-scnner:${{github.ref_name}}-arm64v8
          push: true

  release:
    name: Create Release
    runs-on: ubuntu-20.04
    needs:
      - build-trivy-operator
      - build-kube-bench-scnner
    steps:
      - name: Create Release
        id: create_release
        uses: actions/create-release@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag_name: ${{github.ref_name}}
          release_name: Release ${{github.ref_name}}
          body: |
            ### Changes in this Release
          draft: true
          prerelease: false