[Snyk] Security upgrade certifi from 2023.5.7 to 2023.7.22 #1359
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Run jobs on anything pushed or tagged on the master branch | |
| # PyPi is not here, because we only want that on releases/tags | |
| name: MasterCI | |
| on: | |
| release: | |
| types: [published, prereleased, edited] | |
| push: | |
| branches: | |
| - master | |
| pull_request: | |
| jobs: | |
| push-images: | |
| runs-on: ubuntu-latest | |
| env: | |
| IMAGE_DESCRIPTION: Building thousands of models with timeseries data to monitor systems | |
| IMAGE_LICENSE: AGPL-3.0 | |
| IMAGE_HOME_URL: https://github.com/equinor/gordo | |
| DOCKER_REGISTRY: ghcr.io | |
| if: ${{ github.event_name != 'pull_request' || (!github.event.pull_request.draft && !github.event.pull_request.head.repo.fork)}} | |
| steps: | |
| - uses: actions/checkout@v1 | |
| - name: Prepare variables | |
| id: prep | |
| run: | | |
| python3 scripts/github_docker.py -r equinor -i gordo-base | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v1 | |
| - name: Login to production CR | |
| uses: docker/login-action@v1 | |
| if: ${{ steps.prep.outputs.login_prod_cr }} | |
| with: | |
| registry: ${{ env.DOCKER_PROD_REGISTRY }} | |
| username: ${{ secrets.DOCKER_PROD_USERNAME }} | |
| password: ${{ secrets.DOCKER_PROD_PASSWORD }} | |
| - name: Login to CR | |
| uses: docker/login-action@v1 | |
| if: ${{ steps.prep.outputs.login_cr }} | |
| with: | |
| registry: ${{ env.DOCKER_REGISTRY }} | |
| username: ${{ secrets.DOCKER_GITHUB_USER }} | |
| password: ${{ secrets.DOCKER_GITHUB_PASSWORD }} | |
| - name: Build base image | |
| uses: docker/build-push-action@v2 | |
| with: | |
| context: . | |
| file: ./Dockerfile | |
| tags: ${{ steps.prep.outputs.base_image }} | |
| load: true | |
| - name: Run Trivy vulnerability scanner | |
| env: | |
| IMAGE: ${{ steps.prep.outputs.base_image }} | |
| run: | | |
| bash scripts/trivy_scan.sh "$IMAGE" | |
| - name: Push gordo-base | |
| uses: docker/build-push-action@v2 | |
| if: ${{ steps.prep.outputs.push_image }} | |
| with: | |
| push: true | |
| context: . | |
| file: ./Dockerfile | |
| tags: ${{ steps.prep.outputs.tags_gordo_base }} | |
| labels: | | |
| org.opencontainers.image.title=Gordo | |
| org.opencontainers.image.description=${{ env.IMAGE_DESCRIPTION }} | |
| org.opencontainers.image.source=${{ env.IMAGE_HOME_URL }} | |
| org.opencontainers.image.version=${{ steps.prep.outputs.version }} | |
| org.opencontainers.image.created=${{ steps.prep.outputs.created }} | |
| org.opencontainers.image.revision=${{ github.sha }} | |
| org.opencontainers.image.licenses=${{ env.IMAGE_LICENSE }} |