generatehardenedimages.yml

name: Generate hardened images and put them in the registry

on:
  workflow_call:
  workflow_dispatch:

env:
  IRONBANK_USERNAME: ${{ secrets.IRONBANK_USERNAME }}
  IRONBANK_TOKEN: ${{ secrets.IRONBANK_TOKEN }}

jobs:
  generate_hardened_image:
    name: Generate hardened image
    runs-on: ubuntu-20.04
    steps:
      - name: Check out
        uses: actions/checkout@v3
        with:
          fetch-depth: 0
      - name: Set up python
        uses: actions/setup-python@v4
        with:
          python-version: '3.8' # ansible is apparently installed via pipx, and the version of python being used there is 3.8
      - name: Install ansible dependencies
        run: |
          pipx inject ansible-core requests docker
      - name: Run playbook to pull images and start containers
        uses: dawidd6/action-ansible-playbook@v2
        with:
          playbook: pull_images_and_start_containers.yml
          directory: ./ansible
      - name: Run playbook to harden nginx
        uses: dawidd6/action-ansible-playbook@v2
        with:
          playbook: nginx_hardening.yml
          directory: ./ansible
          options: |
            -i hosts.yml
            -u root
      - name: Run playbook to generate new images from hardened containers
        uses: dawidd6/action-ansible-playbook@v2
        with:
          playbook: docker_commit.yml
          directory: ./ansible
      - name: Create images # probably come up with some way to loop this across all the base images we wanna generate, also make the /etc/nginx/html somehow linked to the nginx_site_root var
        run: |
          docker build -t app_on_hardened_nginx_on_ubi8:v1 . -f-<<EOF
          FROM ironbank_nginx_1_23_1_hardened
          COPY src /etc/nginx/html
          USER root
          RUN chown -R nginx:nginx /etc/nginx/html
          USER nginx
          EOF
      - name: Push to ironbank base to GHCR # think this one is just gonna have to be manually duplicated for all the images we make unless matrices??
        uses: redhat-actions/push-to-registry@v2
        with:
          image: app_on_hardened_nginx_on_ubi8
          tags: v1
          registry: ghcr.io/${{ github.repository_owner }}
          username: ${{ github.actor }}
          password: ${{ github.token }}