init (#217) #47
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: build-kubehound-images | |
| on: | |
| workflow_dispatch: | |
| push: | |
| tags: | |
| - "v*" | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: datadog/kubehound | |
| permissions: | |
| contents: read | |
| jobs: | |
| docker-build-push: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| # https://docs.github.com/en/actions/using-jobs/using-a-matrix-for-your-jobs | |
| matrix: | |
| include: | |
| - dockerfile: deployments/kubehound/kubegraph/Dockerfile | |
| image: graph | |
| workdir: deployments/kubehound/kubegraph/ | |
| - dockerfile: deployments/kubehound/notebook/Dockerfile | |
| image: ui | |
| workdir: deployments/kubehound/notebook/ | |
| - dockerfile: deployments/kubehound/ingestor/Dockerfile | |
| image: ingestor | |
| workdir: . | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 | |
| with: | |
| # egress-policy: audit | |
| egress-policy: block | |
| allowed-endpoints: > | |
| auth.docker.io:443 | |
| dl-cdn.alpinelinux.org:443 | |
| ghcr.io:443 | |
| github.com:443 | |
| pipelines.actions.githubusercontent.com:443 | |
| pkg-containers.githubusercontent.com:443 | |
| production.cloudflare.docker.com:443 | |
| proxy.golang.org:443 | |
| storage.googleapis.com:443 | |
| *.docker.io:443 | |
| *.docker.com:443 | |
| gcr.io:443 | |
| repo.maven.apache.org:443 | |
| amazonlinux.default.amazonaws.com:443 | |
| amazonlinux.default.amazonaws.com:80 | |
| cdn.amazonlinux.com:443 | |
| rpm.nodesource.com:443 | |
| registry.npmjs.org:443 | |
| pypi.org:443 | |
| *.pypi.org:443 | |
| api.snapcraft.io:443 | |
| files.pythonhosted.org:443 | |
| acghubeus1.actions.githubusercontent.com:443 | |
| pipelinesghubeus8.actions.githubusercontent.com:443 | |
| productionresultssa8.blob.core.windows.net:443 | |
| results-receiver.actions.githubusercontent.com:443 | |
| vstsmms.actions.githubusercontent.com:443 | |
| - name: Checkout | |
| uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab | |
| with: | |
| fetch-depth: 0 | |
| - name: Log into registry ${{ env.REGISTRY }} | |
| uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@4c0219f9ac95b02789c1075625400b2acbff50b1 | |
| - name: Build and push Docker image | |
| if: ${{ github.event_name == 'push' }} | |
| uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671 | |
| with: | |
| context: ${{ matrix.workdir }} | |
| platforms: linux/amd64,linux/arm64 | |
| file: ${{ matrix.dockerfile }} | |
| push: true | |
| build-args: | | |
| VERSION=${{ github.ref_name }} | |
| tags: | | |
| ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-${{ matrix.image }}:${{ github.ref_name }} | |
| ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-${{ matrix.image }}:latest | |
| - name: Build and push Docker image | |
| if: ${{ github.event_name == 'workflow_dispatch' }} | |
| uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671 | |
| with: | |
| context: ${{ matrix.workdir }} | |
| platforms: linux/amd64,linux/arm64 | |
| file: ${{ matrix.dockerfile }} | |
| push: true | |
| build-args: | | |
| VERSION=${{ github.sha }} | |
| tags: | | |
| ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-${{ matrix.image }}:snapshot-${{ github.sha }} | |
| ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-${{ matrix.image }}:latest |