127 lines
4.7 KiB
YAML
127 lines
4.7 KiB
YAML
name: System Dependency Updates
|
|
|
|
on:
|
|
schedule:
|
|
- cron: "0 0 * * 0" # Weekly on Sunday at midnight
|
|
workflow_dispatch: # Allow manual triggering
|
|
|
|
# Cancel in-progress runs when a new workflow with the same group is triggered
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
update-dependencies:
|
|
name: Rebuild with Latest Dependencies
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Build with latest dependencies
|
|
uses: docker/build-push-action@v5
|
|
with:
|
|
context: .
|
|
tags: aprsme:latest
|
|
load: true
|
|
no-cache: true
|
|
pull: true
|
|
cache-from: type=gha
|
|
cache-to: type=gha,mode=max
|
|
|
|
- name: Run Trivy vulnerability scanner
|
|
uses: aquasecurity/trivy-action@master
|
|
with:
|
|
image-ref: aprsme:latest
|
|
format: "sarif"
|
|
output: "trivy-results.sarif"
|
|
severity: "CRITICAL,HIGH"
|
|
timeout: "10m"
|
|
scanners: "vuln"
|
|
|
|
- name: Upload Trivy scan results
|
|
uses: github/codeql-action/upload-sarif@v3
|
|
if: always()
|
|
with:
|
|
sarif_file: "trivy-results.sarif"
|
|
category: "Dependency Update Scan"
|
|
|
|
- name: Generate vulnerability summary
|
|
if: always()
|
|
run: |
|
|
echo "# System Dependency Update Report" > dep-update-report.md
|
|
echo "## Date: $(date -u +'%Y-%m-%d')" >> dep-update-report.md
|
|
echo "" >> dep-update-report.md
|
|
|
|
echo "### OS Package Vulnerabilities" >> dep-update-report.md
|
|
echo "```" >> dep-update-report.md
|
|
trivy image --severity HIGH,CRITICAL --no-progress aprsme:latest >> dep-update-report.md
|
|
echo "```" >> dep-update-report.md
|
|
|
|
- name: Upload vulnerability summary
|
|
if: always()
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: dependency-update-report
|
|
path: dep-update-report.md
|
|
retention-days: 30
|
|
|
|
- name: Check if base image is outdated
|
|
id: check_base_image
|
|
run: |
|
|
# Extract current Debian version from Dockerfile
|
|
CURRENT_VERSION=$(grep 'DEBIAN_VERSION=' Dockerfile | head -1 | cut -d'=' -f2 | tr -d '"')
|
|
echo "Current Debian version: $CURRENT_VERSION"
|
|
|
|
# Get latest version from Docker Hub
|
|
LATEST_VERSION=$(curl -s https://registry.hub.docker.com/v2/repositories/library/debian/tags | \
|
|
grep -o '"name":"[^"]*-slim"' | grep bullseye | sort -r | head -1 | cut -d'"' -f4)
|
|
echo "Latest Debian version: $LATEST_VERSION"
|
|
|
|
if [ "$CURRENT_VERSION" != "$LATEST_VERSION" ] && [ ! -z "$LATEST_VERSION" ]; then
|
|
echo "Base image is outdated. Current: $CURRENT_VERSION, Latest: $LATEST_VERSION"
|
|
echo "outdated=true" >> $GITHUB_OUTPUT
|
|
echo "latest_version=$LATEST_VERSION" >> $GITHUB_OUTPUT
|
|
else
|
|
echo "Base image is up to date or couldn't determine latest version"
|
|
echo "outdated=false" >> $GITHUB_OUTPUT
|
|
fi
|
|
|
|
- name: Create PR for base image update
|
|
if: steps.check_base_image.outputs.outdated == 'true'
|
|
uses: peter-evans/create-pull-request@v6
|
|
with:
|
|
token: ${{ secrets.GITHUB_TOKEN }}
|
|
commit-message: "chore: update Debian base image to ${{ steps.check_base_image.outputs.latest_version }}"
|
|
title: "Update Debian base image to ${{ steps.check_base_image.outputs.latest_version }}"
|
|
body: |
|
|
This PR updates the Debian base image to the latest version:
|
|
- Current: `${{ env.CURRENT_VERSION }}`
|
|
- Latest: `${{ steps.check_base_image.outputs.latest_version }}`
|
|
|
|
This update includes the latest security patches and system dependencies.
|
|
|
|
*This PR was automatically created by the dependency updates workflow.*
|
|
branch: update-base-image
|
|
base: main
|
|
delete-branch: true
|
|
add-paths: |
|
|
Dockerfile
|
|
|
|
- name: Summary
|
|
if: always()
|
|
run: |
|
|
echo "## Dependency Update Summary" >> $GITHUB_STEP_SUMMARY
|
|
echo "" >> $GITHUB_STEP_SUMMARY
|
|
echo "- ✅ Image rebuilt with latest dependencies" >> $GITHUB_STEP_SUMMARY
|
|
echo "- 📊 Vulnerability scan completed" >> $GITHUB_STEP_SUMMARY
|
|
|
|
if [ "${{ steps.check_base_image.outputs.outdated }}" == "true" ]; then
|
|
echo "- 🔄 Base image update PR created" >> $GITHUB_STEP_SUMMARY
|
|
else
|
|
echo "- ✓ Base image is up to date" >> $GITHUB_STEP_SUMMARY
|
|
fi
|