push container to ghcr

mitre · Jul 8, 2024 · 31ec2aa · 31ec2aa
1 parent 5ce6de2
commit 31ec2aa
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 10 deletions.
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -40,12 +40,27 @@ jobs:
           echo ${{ env.CERTIFICATE_KEY_FILE_BASE64 }} > CERTIFICATE_KEY_FILE
           base64 --decode CERTIFICATE_KEY_FILE > certificates/mongodb.pem
 
-      - name: Run Packer
+      - name: Run Packer Hardening
         run: |
           packer init mongo-hardening.pkr.hcl
           packer build mongo-hardening.pkr.hcl
           docker ps -a
           docker image ls
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Tag and Push Docker Image
+        run: |
+          docker tag mongo-hardened:latest ghcr.io/${{ github.repository_owner }}/mongo-hardened:latest
+          docker push ghcr.io/${{ github.repository_owner }}/mongo-hardened:latest
+
+      - name: Run Packer Validation
+        run: |
           packer build -var 'report={"report_to_heimdall":"${{ env.REPORT_TO_HEIMDALL }}","heimdall_url":"${{ env.HEIMDALL_URL }}","heimdall_api_key":"${{ env.HEIMDALL_API_KEY }}"}' mongo-validate.pkr.hcl
           docker ps -a
 

diff --git a/mongo-validate.pkr.hcl b/mongo-validate.pkr.hcl
@@ -59,15 +59,15 @@ build {
   name    = "validate"
   sources = ["source.docker.hardened"]
 
-  // # docker ps
-  // provisioner "shell-local" {
-  //   inline = [
-  //     "docker ps -a",
-  //     "docker exec mongo-hardened sh -c 'ls'",
-  //     "inspec detect -t docker://mongo-hardened",
-  //     "docker ps -a"
-  //   ]
-  // }
+  # docker ps
+  provisioner "shell-local" {
+    inline = [
+      "docker ps -a",
+      "docker exec mongo-hardened sh -c 'ls'",
+      "inspec detect -t docker://mongo-hardened",
+      "docker ps -a"
+    ]
+  }
 
   ### SCAN
   provisioner "shell-local" {