chore(deps): bump werkzeug from 3.0.3 to 3.0.4 (#68) #71
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build da imagem de container Redis | |
| on: | |
| push: | |
| branches: | |
| - 'main' | |
| jobs: | |
| build: | |
| name: Build da Imagem redis | |
| runs-on: ubuntu-20.04 | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Fazer checkout do código | |
| uses: actions/checkout@6d193bf28034eafb982f37bd894289fe649468fc | |
| - name: Configurar QEMU | |
| uses: docker/[email protected] | |
| - name: Instalar Cosign | |
| uses: sigstore/[email protected] | |
| - name: Configurar Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Fazer login no Docker Hub | |
| uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 | |
| with: | |
| username: ${{ secrets.DOCKER_USERNAME }} | |
| password: ${{ secrets.DOCKER_PASSWORD }} | |
| - name: Extrair metadados (tags, labels) para Docker | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: nataliagranato/redis | |
| - name: Gerar nome único para a tag | |
| id: generate-tag | |
| run: | | |
| # Obtém os primeiros 5 dígitos do hash do commit e a data | |
| SHORT_HASH=$(git log -1 --pretty=format:%h | cut -c1-5) | |
| TIMESTAMP=$(date +%Y%m%d%H%M%S) | |
| echo "tag=${SHORT_HASH}-${TIMESTAMP}" >> $GITHUB_ENV | |
| echo "::set-output name=tag::${SHORT_HASH}-${TIMESTAMP}" | |
| - name: Construir e enviar a imagem Docker | |
| uses: docker/build-push-action@v6 | |
| id: build-and-push | |
| with: | |
| context: ./redis | |
| file: ./redis/Dockerfile.redis | |
| push: true | |
| tags: nataliagranato/redis:${{ steps.generate-tag.outputs.tag }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| platforms: linux/amd64,linux/arm64 | |
| - name: Aqua Security Trivy | |
| uses: aquasecurity/[email protected] | |
| with: | |
| image-ref: nataliagranato/redis:${{ steps.generate-tag.outputs.tag }} | |
| format: 'sarif' | |
| severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL' | |
| output: 'trivy-results.sarif' | |
| - name: Fazer upload dos resultados do Trivy para a aba de Segurança do GitHub | |
| uses: github/codeql-action/upload-sarif@v3 | |
| if: always() | |
| with: | |
| sarif_file: 'trivy-results.sarif' | |
| - name: Assinar imagem com uma chave | |
| run: | | |
| images="" | |
| for tag in ${TAGS}; do | |
| images+="${tag}@${DIGEST} " | |
| done | |
| cosign sign --yes --key env://COSIGN_PRIVATE_KEY $images | |
| env: | |
| TAGS: ${{ steps.meta.outputs.tags }} | |
| COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }} | |
| COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} | |
| DIGEST: ${{ steps.build-and-push.outputs.digest }} |