sensor-iso-build-docker-wrap-push-ghcr.yml

name: sensor-iso-build-docker-wrap-push-ghcr

on:
  push:
    branches:
      - main
      - development
    paths:
      - 'sensor-iso/**'
      - 'shared/bin/*'
      - '.trigger_iso_workflow_build'
      - '.github/workflows/sensor-iso-build-docker-wrap-push-ghcr.yml'
  workflow_dispatch:
  repository_dispatch:

jobs:
  build:
    runs-on: ubuntu-22.04
    permissions:
      actions: write
      packages: write
      contents: read
      security-events: write
    defaults:
      run:
        shell: bash
    steps:
      -
        name: Cancel previous run in progress
        uses: styfle/cancel-workflow-action@0.11.0
        with:
          ignore_sha: true
          all_but_latest: true
          access_token: ${{ secrets.GITHUB_TOKEN }}
      -
        name: Set up QEMU
        uses: docker/setup-qemu-action@v2
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2
        with:
          driver-opts: |
            image=moby/buildkit:master
      -
        name: Build environment setup
        run: |
          sudo apt-get -q update
          sudo env DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y -q \
               apt-transport-https \
               bc \
               build-essential \
               ca-certificates \
               curl \
               debhelper-compat \
               debian-archive-keyring \
               debootstrap \
               genisoimage \
               gettext \
               git \
               gnupg2 \
               imagemagick \
               jq \
               po4a \
               rsync \
               software-properties-common \
               squashfs-tools \
               virt-what \
               xorriso
          git clone --depth=1 --single-branch --recurse-submodules --shallow-submodules --branch='debian/1%20230131' 'https://salsa.debian.org/live-team/live-build.git' /tmp/live-build
          cd /tmp/live-build
          dpkg-buildpackage -b -uc -us
          cd /tmp
          sudo dpkg -i /tmp/live-build*.deb
          sudo rm -rf /tmp/live-build /tmp/live-build*.deb
      -
        name: Checkout
        uses: actions/checkout@v3
      -
        name: Extract branch name
        shell: bash
        run: echo "branch=$(echo ${GITHUB_REF#refs/heads/})" >> $GITHUB_OUTPUT
        id: extract_branch
      -
        name: Extract commit SHA
        shell: bash
        run: echo "sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
        id: extract_commit_sha
      -
        name: Extract Malcolm version
        shell: bash
        run: echo "mversion=$(grep -P "^\s+image:.*/malcolm/" docker-compose.yml | awk '{print $2}' | cut -d':' -f2 | uniq -c | sort -nr | awk '{print $2}' | head -n 1)" >> $GITHUB_OUTPUT
        id: extract_malcolm_version
      -
        name: Build image
        run: |
          cp -r ./shared ./docs ./_config.yml ./_includes ./_layouts ./Gemfile ./README.md ./sensor-iso
          cp ./scripts/malcolm_utils.py ./sensor-iso/shared/bin/
          cp ./scripts/documentation_build.sh ./sensor-iso/docs/
          cp -r ./arkime/patch ./sensor-iso/shared/arkime_patch
          pushd ./sensor-iso
          echo "${{ steps.extract_malcolm_version.outputs.mversion }}" > ./shared/version.txt
          echo "${{ secrets.MAXMIND_GEOIP_DB_LICENSE_KEY }}" > ./shared/maxmind_license.txt
          echo "GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}" > ./shared/environment.chroot
          echo "VCS_REVSION=${{ steps.extract_commit_sha.outputs.sha }}" > ./shared/environment.chroot
          sudo /usr/bin/env bash ./build.sh
          rm -rf ./shared/ ./docs/ ./_config.yml ./_includes ./_layouts /Gemfile ./README.md
          sudo chmod 644 ./hedgehog-*.*
          popd
      -
        name: Run Trivy vulnerability scanner
        id: trivy-scan
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: './sensor-iso'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'HIGH,CRITICAL'
          vuln-type: 'os,library'
          hide-progress: true
          ignore-unfixed: true
          exit-code: '0'
      -
        name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        if: always()
        with:
          sarif_file: 'trivy-results.sarif'
      -
        name: ghcr.io login
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      -
        name: Build and push ISO image
        uses: docker/build-push-action@v3
        with:
          context: ./sensor-iso
          push: true
          tags: ghcr.io/${{ github.repository_owner }}/malcolm/hedgehog:${{ steps.extract_branch.outputs.branch }}