Skip to content

Bump nginx from 1.27.1-alpine to 1.27.2-alpine #107

Bump nginx from 1.27.1-alpine to 1.27.2-alpine

Bump nginx from 1.27.1-alpine to 1.27.2-alpine #107

name: Docker Openresty
on:
push:
branches:
- master
tags:
- "v[0-9]+.[0-9]+.[0-9]+"
pull_request:
branches:
- master
concurrency:
group: ${{ github.ref_name }}-docker-openresty
cancel-in-progress: true
jobs:
build-docker:
name: Build Docker Image
runs-on: ubuntu-22.04
services:
registry:
image: registry:2
ports:
- 5000:5000
steps:
- name: Checkout Repository
uses: actions/checkout@v4
- name: Docker Buildx
uses: docker/setup-buildx-action@v3
with:
driver-opts: network=host
- name: DockerHub Login
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
if: github.event_name != 'pull_request'
- name: Login to GitHub Container Registry
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
password: ${{ secrets.GITHUB_TOKEN }}
if: github.event_name != 'pull_request'
- name: Docker meta
id: meta
uses: docker/metadata-action@v5
with:
images: |
name=opentracing/openresty,enable=${{ github.event_name != 'pull_request' }}
name=ghcr.io/opentracing-contrib/openresty,enable=${{ github.event_name != 'pull_request' }}
name=localhost:5000/opentracing/openresty
tags: |
type=edge
type=ref,event=pr
type=semver,pattern={{version}}
env:
DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
- name: Build and push
uses: docker/build-push-action@v6
with:
file: Dockerfile-openresty
pull: true
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
annotations: ${{ steps.meta.outputs.annotations }}
cache-from: type=gha,scope=openresty
cache-to: type=gha,scope=openresty,mode=max
sbom: true
provenance: mode=max
- name: Inspect SBOM and output manifest
run: |
docker buildx imagetools inspect localhost:5000/opentracing/openresty:${{ steps.meta.outputs.version }} --format '{{ json .SBOM.SPDX }}' > sbom-openresty.json
docker buildx imagetools inspect localhost:5000/opentracing/openresty:${{ steps.meta.outputs.version }} --format '{{ json .Provenance.SLSA }}' > provenance-openresty.json
docker buildx imagetools inspect localhost:5000/opentracing/openresty:${{ steps.meta.outputs.version }} --raw
- name: Scan SBOM
id: scan
uses: anchore/scan-action@v4
with:
sbom: "sbom-openresty.json"
only-fixed: true
add-cpes-if-none: true
fail-build: false
- name: Upload scan result to GitHub Security tab
uses: github/codeql-action/upload-sarif@v3
continue-on-error: true
with:
sarif_file: ${{ steps.scan.outputs.sarif }}
if: always()
- name: Upload Scan Results
uses: actions/upload-artifact@v4
continue-on-error: true
with:
name: scan-results-openresty
path: |
${{ steps.scan.outputs.sarif }}
*.json
if: always()