TinySearch/.github/workflows/docker-publish.yml at main · benmaster82/TinySearch · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
name: Publish Docker image

on:
  release:
    types:
      - published
  workflow_dispatch:
    inputs:
      version:
        description: "Version tag to publish, for example v0.1.4"
        required: true
        type: string
      publish_latest:
        description: "Also publish marcellm01/tinysearch:latest"
        required: true
        default: true
        type: boolean

env:
  IMAGE_NAME: marcellm01/tinysearch

jobs:
  docker:
    name: Build and publish multi-arch image
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set image version
        id: version
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            echo "value=${{ github.event.inputs.version }}" >> "$GITHUB_OUTPUT"
          elif [ "${{ github.event_name }}" = "release" ]; then
            echo "value=${{ github.event.release.tag_name }}" >> "$GITHUB_OUTPUT"
          else
            echo "value=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
          fi

      - name: Set image tags
        id: tags
        env:
          IMAGE_NAME: ${{ env.IMAGE_NAME }}
          IMAGE_VERSION: ${{ steps.version.outputs.value }}
          EVENT_NAME: ${{ github.event_name }}
          PUBLISH_LATEST: ${{ github.event.inputs.publish_latest }}
        run: |
          {
            echo "value<<EOF"
            echo "${IMAGE_NAME}:${IMAGE_VERSION}"
            if [ "${EVENT_NAME}" != "workflow_dispatch" ] || [ "${PUBLISH_LATEST}" = "true" ]; then
              echo "${IMAGE_NAME}:latest"
            fi
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Scan container configuration
        uses: aquasecurity/trivy-action@v0.36.0
        with:
          scan-type: config
          scan-ref: Dockerfile
          scanners: misconfig
          format: table
          severity: CRITICAL,HIGH
          exit-code: "1"
          trivyignores: .trivyignore.yaml

      - name: Scan repository for secrets
        uses: aquasecurity/trivy-action@v0.36.0
        with:
          scan-type: fs
          scan-ref: .
          scanners: secret
          skip-dirs: .venv
          format: table
          severity: CRITICAL,HIGH
          exit-code: "1"

      - name: Log in to Docker Hub
        uses: docker/login-action@v4.5.2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build local image for vulnerability scan
        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: linux/amd64
          load: true
          push: false
          build-args: |
            TINYSEARCH_VERSION=${{ steps.version.outputs.value }}
          tags: ${{ env.IMAGE_NAME }}:scan
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Scan image for vulnerabilities
        uses: aquasecurity/trivy-action@v0.36.0
        env:
          TRIVY_IMAGE_CONFIG_SCANNERS: secret
        with:
          image-ref: ${{ env.IMAGE_NAME }}:scan
          scanners: vuln,secret
          format: table
          severity: CRITICAL,HIGH
          exit-code: "1"
          ignore-unfixed: true

      - name: Build and push
        id: push
        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          sbom: true
          provenance: mode=max
          build-args: |
            TINYSEARCH_VERSION=${{ steps.version.outputs.value }}
          tags: ${{ steps.tags.outputs.value }}
          labels: |
            org.opencontainers.image.title=TinySearch MCP
            org.opencontainers.image.description=TinySearch MCP stdio and HTTP server
            org.opencontainers.image.source=https://github.com/${{ github.repository }}
            org.opencontainers.image.version=${{ steps.version.outputs.value }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Install Cosign
        uses: sigstore/cosign-installer@v3

      - name: Sign published image (keyless)
        env:
          DIGEST: ${{ steps.push.outputs.digest }}
        run: cosign sign --yes "${IMAGE_NAME}@${DIGEST}"