feat: Traefik JSON access log parser — auto-detects format, falls bac… #126
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| permissions: read-all | |
| jobs: | |
| build: | |
| name: Build & Release | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| id-token: write | |
| attestations: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: "1.26" | |
| cache-dependency-path: go.sum | |
| - name: Extract version from tag | |
| id: version | |
| run: echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT" | |
| - name: Build binaries | |
| env: | |
| VERSION: ${{ steps.version.outputs.VERSION }} | |
| run: | | |
| mkdir -p build | |
| # Bare metal binaries (no client-go, ~7MB) | |
| CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \ | |
| -ldflags "-s -w -X main.version=${VERSION}" \ | |
| -o build/defensia-agent-linux-amd64 \ | |
| ./cmd/defensia-agent | |
| CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build \ | |
| -ldflags "-s -w -X main.version=${VERSION}" \ | |
| -o build/defensia-agent-linux-arm64 \ | |
| ./cmd/defensia-agent | |
| # K8s binaries (includes client-go, ~33MB) | |
| CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \ | |
| -tags kubernetes \ | |
| -ldflags "-s -w -X main.version=${VERSION}" \ | |
| -o build/defensia-agent-linux-amd64-k8s \ | |
| ./cmd/defensia-agent | |
| CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build \ | |
| -tags kubernetes \ | |
| -ldflags "-s -w -X main.version=${VERSION}" \ | |
| -o build/defensia-agent-linux-arm64-k8s \ | |
| ./cmd/defensia-agent | |
| - name: Generate checksums | |
| working-directory: build | |
| run: | | |
| sha256sum defensia-agent-linux-amd64 > defensia-agent-linux-amd64.sha256 | |
| sha256sum defensia-agent-linux-arm64 > defensia-agent-linux-arm64.sha256 | |
| sha256sum defensia-agent-linux-amd64-k8s > defensia-agent-linux-amd64-k8s.sha256 | |
| sha256sum defensia-agent-linux-arm64-k8s > defensia-agent-linux-arm64-k8s.sha256 | |
| cat *.sha256 > checksums.txt | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@v3 | |
| - name: Sign release artifacts | |
| env: | |
| COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }} | |
| COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} | |
| working-directory: build | |
| run: | | |
| cosign sign-blob --key env://COSIGN_PRIVATE_KEY --yes \ | |
| --output-signature defensia-agent-linux-amd64.sig \ | |
| defensia-agent-linux-amd64 | |
| cosign sign-blob --key env://COSIGN_PRIVATE_KEY --yes \ | |
| --output-signature defensia-agent-linux-arm64.sig \ | |
| defensia-agent-linux-arm64 | |
| cosign sign-blob --key env://COSIGN_PRIVATE_KEY --yes \ | |
| --output-signature defensia-agent-linux-amd64-k8s.sig \ | |
| defensia-agent-linux-amd64-k8s | |
| cosign sign-blob --key env://COSIGN_PRIVATE_KEY --yes \ | |
| --output-signature defensia-agent-linux-arm64-k8s.sig \ | |
| defensia-agent-linux-arm64-k8s | |
| cosign sign-blob --key env://COSIGN_PRIVATE_KEY --yes \ | |
| --output-signature checksums.txt.sig \ | |
| checksums.txt | |
| - name: Attest build provenance | |
| uses: actions/attest-build-provenance@v2 | |
| with: | |
| subject-path: | | |
| build/defensia-agent-linux-amd64 | |
| build/defensia-agent-linux-arm64 | |
| build/defensia-agent-linux-amd64-k8s | |
| build/defensia-agent-linux-arm64-k8s | |
| - name: Create GitHub Release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| token: ${{ secrets.BOT_TOKEN }} | |
| name: ${{ steps.version.outputs.VERSION }} | |
| body: | | |
| ## Defensia Agent ${{ steps.version.outputs.VERSION }} | |
| ### Install | |
| ```bash | |
| curl -fsSL https://defensia.cloud/install.sh | sudo bash -s -- --token <YOUR_TOKEN> | |
| ``` | |
| ### Docker | |
| ```bash | |
| docker run -d --privileged --net=host --pid=host \ | |
| -v /var/log:/var/log:ro \ | |
| -v /var/run/docker.sock:/var/run/docker.sock:ro \ | |
| -e DEFENSIA_TOKEN=<YOUR_TOKEN> \ | |
| ghcr.io/defensia/agent:${{ steps.version.outputs.VERSION }} | |
| ``` | |
| ### Manual download | |
| | Platform | Binary | | |
| |---|---| | |
| | Linux x86_64 | `defensia-agent-linux-amd64` | | |
| | Linux ARM64 | `defensia-agent-linux-arm64` | | |
| | Linux x86_64 (K8s) | `defensia-agent-linux-amd64-k8s` | | |
| | Linux ARM64 (K8s) | `defensia-agent-linux-arm64-k8s` | | |
| files: | | |
| build/defensia-agent-linux-amd64 | |
| build/defensia-agent-linux-amd64.sha256 | |
| build/defensia-agent-linux-amd64.sig | |
| build/defensia-agent-linux-arm64 | |
| build/defensia-agent-linux-arm64.sha256 | |
| build/defensia-agent-linux-arm64.sig | |
| build/defensia-agent-linux-amd64-k8s | |
| build/defensia-agent-linux-amd64-k8s.sha256 | |
| build/defensia-agent-linux-amd64-k8s.sig | |
| build/defensia-agent-linux-arm64-k8s | |
| build/defensia-agent-linux-arm64-k8s.sha256 | |
| build/defensia-agent-linux-arm64-k8s.sig | |
| build/checksums.txt | |
| build/checksums.txt.sig | |
| install.sh | |
| docker: | |
| name: Docker Image | |
| runs-on: ubuntu-latest | |
| needs: build | |
| permissions: | |
| packages: write | |
| id-token: write | |
| attestations: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Extract version from tag | |
| id: version | |
| run: echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT" | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Set up QEMU (multi-arch) | |
| uses: docker/setup-qemu-action@v3 | |
| - name: Login to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Login to Docker Hub | |
| uses: docker/login-action@v3 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| continue-on-error: true | |
| - name: Build and push | |
| id: docker-build | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| push: true | |
| platforms: linux/amd64,linux/arm64 | |
| build-args: | | |
| VERSION=${{ steps.version.outputs.VERSION }} | |
| BUILD_TAGS=kubernetes | |
| tags: | | |
| ghcr.io/defensia/agent:latest | |
| ghcr.io/defensia/agent:${{ steps.version.outputs.VERSION }} | |
| defensiacloud/agent:latest | |
| defensiacloud/agent:${{ steps.version.outputs.VERSION }} | |
| labels: | | |
| org.opencontainers.image.title=Defensia Agent | |
| org.opencontainers.image.description=Real-time attack detection and blocking for Linux servers | |
| org.opencontainers.image.vendor=Defensia | |
| org.opencontainers.image.source=https://github.com/defensia/agent | |
| org.opencontainers.image.version=${{ steps.version.outputs.VERSION }} | |
| - name: Attest Docker image provenance | |
| uses: actions/attest-build-provenance@v2 | |
| with: | |
| subject-name: ghcr.io/defensia/agent | |
| subject-digest: ${{ steps.docker-build.outputs.digest }} | |
| push-to-registry: true | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@v3 | |
| - name: Sign Docker image | |
| env: | |
| COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }} | |
| COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} | |
| run: | | |
| cosign sign --key env://COSIGN_PRIVATE_KEY \ | |
| --yes \ | |
| ghcr.io/defensia/agent@${{ steps.docker-build.outputs.digest }} | |
| helm: | |
| name: Helm Chart | |
| runs-on: ubuntu-latest | |
| needs: build | |
| permissions: | |
| packages: write | |
| id-token: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Extract version from tag | |
| id: version | |
| run: echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT" | |
| - name: Update Chart appVersion | |
| run: | | |
| sed -i "s/^appVersion:.*/appVersion: \"${{ steps.version.outputs.VERSION }}\"/" charts/defensia-agent/Chart.yaml | |
| - name: Login to GHCR (Helm) | |
| run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io -u ${{ github.actor }} --password-stdin | |
| - name: Login to GHCR (Docker/Cosign) | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Import GPG key | |
| run: | | |
| echo "${{ secrets.GPG_PRIVATE_KEY }}" | gpg --batch --import | |
| gpg --export-secret-keys > /tmp/secring.gpg | |
| - name: Package chart (signed) | |
| run: | | |
| helm package charts/defensia-agent \ | |
| --sign --key "Defensia" --keyring /tmp/secring.gpg \ | |
| -d /tmp/charts | |
| - name: Install oras | |
| run: | | |
| curl -sLO https://github.com/oras-project/oras/releases/download/v1.2.2/oras_1.2.2_linux_amd64.tar.gz | |
| tar xzf oras_1.2.2_linux_amd64.tar.gz -C /usr/local/bin oras | |
| rm oras_1.2.2_linux_amd64.tar.gz | |
| - name: Push chart with provenance to GHCR | |
| id: helm-push | |
| run: | | |
| CHART_VERSION=$(grep '^version:' charts/defensia-agent/Chart.yaml | awk '{print $2}') | |
| CHART_TGZ="/tmp/charts/defensia-agent-${CHART_VERSION}.tgz" | |
| CHART_PROV="${CHART_TGZ}.prov" | |
| # Push chart normally (creates correct Helm OCI manifest) | |
| OUTPUT=$(helm push "${CHART_TGZ}" oci://ghcr.io/defensia/charts 2>&1) | |
| echo "$OUTPUT" | |
| DIGEST=$(echo "$OUTPUT" | grep -oP 'sha256:[a-f0-9]+') | |
| echo "digest=$DIGEST" >> "$GITHUB_OUTPUT" | |
| # Upload .prov blob to registry | |
| PROV_BLOB_OUTPUT=$(oras blob push ghcr.io/defensia/charts/defensia-agent "${CHART_PROV}" 2>&1) | |
| echo "$PROV_BLOB_OUTPUT" | |
| PROV_DIGEST=$(echo "$PROV_BLOB_OUTPUT" | grep -oP 'sha256:[a-f0-9]+' | head -1) | |
| PROV_SIZE=$(wc -c < "${CHART_PROV}" | tr -d ' ') | |
| # Fetch manifest, add .prov as layer, re-push | |
| # (oras attach uses referrers API which GHCR doesn't support) | |
| oras manifest fetch ghcr.io/defensia/charts/defensia-agent:${CHART_VERSION} > /tmp/manifest.json | |
| jq --arg digest "${PROV_DIGEST}" \ | |
| --argjson size ${PROV_SIZE} \ | |
| '.layers += [{"mediaType": "application/vnd.cncf.helm.chart.provenance.v1.prov", "digest": $digest, "size": $size}]' \ | |
| /tmp/manifest.json > /tmp/manifest-signed.json | |
| oras manifest push \ | |
| --media-type "application/vnd.oci.image.manifest.v1+json" \ | |
| ghcr.io/defensia/charts/defensia-agent:${CHART_VERSION} \ | |
| /tmp/manifest-signed.json |