diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 66c5d5a..98c0711 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -43,11 +43,20 @@ jobs: - run: | docker build -f ${{ matrix.image }}/Dockerfile -t localhost:5000/${{ matrix.image }}:${{ github.sha }} ${{ matrix.image }} docker push localhost:5000/${{ matrix.image }}:${{ github.sha }} - docker rmi localhost:5000/${{ matrix.image }}:${{ github.sha }} docker image prune # Scan image for vulnerabilities - name: Aqua Security Trivy image scan run: | curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin ${{ env.TRIVY_VERSION }} - trivy image localhost:5000/${{ matrix.image }}:${{ github.sha }} --exit-code 1 --timeout=20m --security-checks vuln --severity CRITICAL \ No newline at end of file + trivy image localhost:5000/${{ matrix.image }}:${{ github.sha }} --exit-code 1 --timeout=20m --security-checks vuln --severity CRITICAL + + # Run Dockle + - name: Run dockle + uses: goodwithtech/dockle-action@main + with: + image: localhost:5000/${{ matrix.image }}:${{ github.sha }} + format: 'list' + exit-code: '0' + exit-level: 'fatal' + ignore: 'DKL-DI-0006' diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index e4b74fb..af75cc8 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -57,7 +57,6 @@ jobs: - run: | docker build -f ${{ matrix.image }}/Dockerfile -t localhost:5000/${{ matrix.image }}:${{ github.sha }} ${{ matrix.image }} docker push localhost:5000/${{ matrix.image }}:${{ github.sha }} - docker rmi localhost:5000/${{ matrix.image }}:${{ github.sha }} docker image prune # Scan image for vulnerabilities @@ -65,7 +64,17 @@ jobs: run: | curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin ${{ env.TRIVY_VERSION }} trivy image localhost:5000/${{ matrix.image }}:${{ github.sha }} --exit-code 1 --timeout=20m --security-checks vuln --severity CRITICAL - + + # Run Dockle + - name: Run dockle + uses: goodwithtech/dockle-action@main + with: + image: localhost:5000/${{ matrix.image }}:${{ github.sha }} + format: 'list' + exit-code: '0' + exit-level: 'fatal' + ignore: 'DKL-DI-0006' + # Container build and push to a Azure Container registry (ACR) - run: | docker pull localhost:5000/${{ matrix.image }}:${{ github.sha }}