Skip to content

Commit 824bebf

Browse files
meysam81meysam81
committed
chore(build): integrate semantic-release
1 parent fe27589 commit 824bebf

File tree

7 files changed

+1155
-186
lines changed

7 files changed

+1155
-186
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 40 additions & 185 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,5 @@
11
name: ci
22

3-
concurrency:
4-
group: ${{ github.event_name }}-${{ github.ref_name }}
5-
cancel-in-progress: ${{ !startsWith(github.ref, 'refs/tags/') }}
6-
73
on:
84
pull_request:
95
branches:
@@ -14,198 +10,57 @@ on:
1410
tags:
1511
- "*"
1612

17-
env:
18-
IMAGE_REPOSITORY: ${{ github.repository }}
19-
IMAGE_REGISTRY: ghcr.io
20-
2113
jobs:
22-
build-docker-pr:
23-
if: github.event_name == 'pull_request'
24-
permissions:
25-
contents: read
26-
packages: write
27-
pull-requests: write
14+
build-edge:
15+
if: |
16+
contains(fromJson('["push","pull_request"]'), github.event_name) &&
17+
github.ref == 'refs/heads/main'
2818
runs-on: ubuntu-latest
2919
steps:
30-
- name: Checkout
31-
uses: actions/checkout@v4
32-
- name: Set up QEMU
33-
uses: docker/setup-qemu-action@v3
34-
- name: Set up Docker Buildx
35-
uses: docker/setup-buildx-action@v3
36-
- name: Login to Docker Container Registry
37-
uses: docker/login-action@v3
38-
with:
39-
username: ${{ secrets.DOCKERHUB_USERNAME }}
40-
password: ${{ secrets.DOCKERHUB_PASSWORD }}
41-
- name: Login to GitHub Container Registry
42-
uses: docker/login-action@v3
43-
with:
44-
password: ${{ secrets.GITHUB_TOKEN }}
45-
registry: ghcr.io
46-
username: ${{ github.actor }}
47-
- id: meta
48-
name: Docker metadata
49-
uses: docker/metadata-action@v5
50-
with:
51-
images: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_REPOSITORY }}
52-
- name: Build and push
53-
uses: docker/build-push-action@v6
54-
with:
55-
cache-from: type=gha
56-
cache-to: type=gha,mode=max
57-
labels: ${{ steps.meta.outputs.labels }}
58-
platforms: linux/amd64,linux/arm64
59-
push: true
60-
tags: |
61-
${{ steps.meta.outputs.tags }}
62-
${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_REPOSITORY }}:${{ github.run_id }}
63-
- if: contains(github.event.pull_request.labels.*.name, 'check-cves')
64-
name: Docker Scout - cves
65-
uses: docker/scout-action@v1
66-
with:
67-
command: cves
68-
ignore-unchanged: true
69-
image: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_REPOSITORY }}:${{ github.run_id }}
70-
only-fixed: true
71-
only-severities: medium,high,critical
72-
sarif-file: sarif.output.json
73-
summary: true
74-
- if: contains(github.event.pull_request.labels.*.name, 'check-cves')
75-
name: Upload artifact
76-
uses: actions/upload-artifact@v4
77-
with:
78-
if-no-files-found: warn
79-
name: scout-results
80-
path: sarif.output.json
20+
- name: Build docker
21+
uses: meysam81/build-docker@main
22+
with:
23+
cosign: true
24+
image-extra-tags: |
25+
ghcr.io/${{ github.repository }}:${{ github.run_id }}
26+
ghcr.io/${{ github.repository }}:latest
27+
image-name: ghcr.io/${{ github.repository }}
28+
kubescape: true
29+
kubescape-upload-sarif: true
8130

82-
build-docker-edge:
31+
semantic-release:
8332
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
84-
permissions:
85-
contents: read
86-
packages: write
87-
security-events: write
8833
runs-on: ubuntu-latest
89-
steps:
90-
- name: Checkout
91-
uses: actions/checkout@v4
92-
- name: Set up QEMU
93-
uses: docker/setup-qemu-action@v3
94-
- name: Set up Docker Buildx
95-
uses: docker/setup-buildx-action@v3
96-
- name: Login to Docker Container Registry
97-
uses: docker/login-action@v3
98-
with:
99-
username: ${{ secrets.DOCKERHUB_USERNAME }}
100-
password: ${{ secrets.DOCKERHUB_PASSWORD }}
101-
- name: Login to GitHub Container Registry
102-
uses: docker/login-action@v3
103-
with:
104-
password: ${{ secrets.GITHUB_TOKEN }}
105-
registry: ghcr.io
106-
username: ${{ github.actor }}
107-
- id: meta
108-
name: Docker metadata
109-
uses: docker/metadata-action@v5
110-
with:
111-
images: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_REPOSITORY }}
112-
- name: Build and push
113-
uses: docker/build-push-action@v6
114-
with:
115-
cache-from: type=gha
116-
cache-to: type=gha,mode=max
117-
labels: ${{ steps.meta.outputs.labels }}
118-
platforms: linux/amd64,linux/arm64
119-
push: true
120-
tags: |
121-
${{ steps.meta.outputs.tags }}
122-
${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_REPOSITORY }}:${{ github.run_id }}
123-
${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_REPOSITORY }}:latest
124-
- name: Docker Scout - cves
125-
uses: docker/scout-action@v1
126-
with:
127-
command: cves
128-
ignore-unchanged: true
129-
image: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_REPOSITORY }}:${{ github.run_id }}
130-
only-fixed: true
131-
only-severities: medium,high,critical
132-
sarif-file: sarif.output.json
133-
summary: true
134-
- name: Upload artifact
135-
uses: actions/upload-artifact@v4
136-
with:
137-
if-no-files-found: warn
138-
name: scout-results
139-
path: sarif.output.json
140-
141-
build-docker-stable:
142-
if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
14334
permissions:
144-
contents: read
35+
contents: write
14536
packages: write
146-
runs-on: ubuntu-latest
37+
issues: write
38+
pull-requests: write
39+
id-token: write
14740
steps:
14841
- name: Checkout
14942
uses: actions/checkout@v4
150-
- name: Set up QEMU
151-
uses: docker/setup-qemu-action@v3
152-
- name: Set up Docker Buildx
153-
uses: docker/setup-buildx-action@v3
154-
- name: Login to Docker Container Registry
155-
uses: docker/login-action@v3
156-
with:
157-
username: ${{ secrets.DOCKERHUB_USERNAME }}
158-
password: ${{ secrets.DOCKERHUB_PASSWORD }}
159-
- name: Login to GitHub Container Registry
160-
uses: docker/login-action@v3
161-
with:
162-
password: ${{ secrets.GITHUB_TOKEN }}
163-
registry: ghcr.io
164-
username: ${{ github.actor }}
165-
- id: meta
166-
name: Docker metadata
167-
uses: docker/metadata-action@v5
16843
with:
169-
images: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_REPOSITORY }}
170-
- name: Build and push
171-
uses: docker/build-push-action@v6
44+
fetch-depth: 0
45+
- name: Setup bun
46+
uses: oven-sh/setup-bun@v2
17247
with:
173-
cache-from: type=gha
174-
cache-to: type=gha,mode=max
175-
labels: ${{ steps.meta.outputs.labels }}
176-
platforms: linux/amd64,linux/arm64
177-
push: true
178-
tags: |
179-
${{ steps.meta.outputs.tags }}
180-
${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_REPOSITORY }}:${{ github.ref_name }}
181-
- name: Docker Scout - cves
182-
uses: docker/scout-action@v1
183-
with:
184-
command: cves
185-
ignore-unchanged: true
186-
image: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_REPOSITORY }}:${{ github.ref_name }}
187-
only-fixed: true
188-
only-severities: medium,high,critical
189-
sarif-file: sarif.output.json
190-
summary: true
191-
- name: Upload artifact
192-
uses: actions/upload-artifact@v4
193-
with:
194-
if-no-files-found: warn
195-
name: scout-results
196-
path: sarif.output.json
197-
198-
github-release:
199-
if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
200-
permissions:
201-
contents: write
202-
runs-on: ubuntu-latest
203-
steps:
204-
- name: Checkout
205-
uses: actions/checkout@v4
206-
- continue-on-error: true
48+
bun-version: latest
49+
- name: Install bun deps
50+
run: bun install
51+
- id: semantic-release
52+
name: Release
20753
env:
208-
GH_TOKEN: ${{ github.token }}
209-
name: Create release
210-
run: |
211-
gh release create ${{ github.ref_name }} -t ${{ github.ref_name }} --generate-notes
54+
GITHUB_TOKEN: ${{ github.token }}
55+
run: bunx semantic-release@v24
56+
- if: steps.semantic-release.outputs.version != ''
57+
name: Build docker
58+
uses: meysam81/build-docker@main
59+
with:
60+
cosign: true
61+
image-extra-tags: |
62+
ghcr.io/${{ github.repository }}:${{ steps.semantic-release.outputs.version }}
63+
image-name: ghcr.io/${{ github.repository }}
64+
kubescape: true
65+
kubescape-upload-sarif: true
66+
ref: ${{ steps.semantic-release.outputs.version }}

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
.secrets
2+
node_modules/

‎.pre-commit-config.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,16 @@
1+
ci:
2+
autofix_commit_msg: |
3+
[pre-commit.ci] auto fixes from pre-commit.com hooks
4+
5+
[skip ci]
6+
autofix_prs: true
7+
autoupdate_commit_msg: |
8+
[pre-commit.ci] pre-commit autoupdate
9+
10+
[skip ci]
11+
autoupdate_schedule: weekly
12+
submodules: false
13+
114
repos:
215
- repo: https://github.com/pre-commit/pre-commit-hooks
316
rev: v5.0.0
@@ -59,3 +72,7 @@ repos:
5972
- id: ruff
6073
args: [ --fix ]
6174
- id: ruff-format
75+
- repo: https://github.com/rhysd/actionlint
76+
rev: v1.7.7
77+
hooks:
78+
- id: actionlint

‎.releaserc‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
branches:
3+
- main
4+
plugins:
5+
- - "@semantic-release/commit-analyzer"
6+
- preset: angular
7+
releaseRules:
8+
- type: chore
9+
release: patch
10+
- "@semantic-release/release-notes-generator"
11+
- "@semantic-release/git"
12+
- "@semantic-release/github"
13+
- - "@semantic-release/exec"
14+
- successCmd: echo version=v${nextRelease.version} >> $GITHUB_OUTPUT

0 commit comments

Comments
 (0)