Skip to content

Upgrade to php-zts 8.3.1 #483

Upgrade to php-zts 8.3.1

Upgrade to php-zts 8.3.1 #483

Workflow file for this run

name: CI
on:
push:
branches:
- 'release/**'
pull_request:
jobs:
build-amd64:
name: Build PHP Image amd64
runs-on: ubuntu-latest
continue-on-error: false
steps:
- name: "Checkout code"
uses: actions/checkout@v3
- name: Lint Dockerfile
uses: hadolint/[email protected]
with:
dockerfile: "Dockerfile"
format: "tty"
no-color: "true"
output-file: "/dev/stdout"
- name: "Build Alpine"
run: >
./build_images.sh temporary-build-image linux/amd64
- name: "Export image"
run: mv dockercache amdcache
- name: 'Upload Artifact'
uses: actions/upload-artifact@v3
with:
name: amdcache
path: amdcache
retention-days: 1
build-arm64:
name: Build PHP Image arm64
runs-on: ARM64
continue-on-error: false
steps:
- name: "Checkout code"
uses: actions/checkout@v3
- name: Lint Dockerfile
uses: hadolint/[email protected]
with:
dockerfile: "Dockerfile"
format: "tty"
no-color: "true"
output-file: "/dev/stdout"
- name: "Build Alpine"
run: >
./build_images.sh temporary-build-image linux/arm64/v8
- name: "Export image"
run: mv dockercache armcache
- name: 'Upload Artifact'
uses: actions/upload-artifact@v3
with:
name: armcache
path: armcache
retention-days: 1
upload:
name: Upload PHP Image
runs-on: ubuntu-latest
needs:
- build-arm64
- build-amd64
continue-on-error: false
steps:
- name: "Checkout code"
uses: actions/checkout@v3
- name: Download amd64
uses: actions/download-artifact@v3
with:
name: amdcache
path: amdcache
- name: Download arm64
uses: actions/download-artifact@v3
with:
name: armcache
path: armcache
- name: "Create docker cache"
run: >
cp -rf amdcache dockercache
- name: "Reload build cache for amd64"
run: >
./build_images.sh temporary-build-image linux/amd64
- name: "Smoke test with php -v"
run: docker run --pull=never --rm -t temporary-build-image-linux-amd64 php -v
- name: "PHP_VERSION Env"
run: echo "PHP_VERSION=`docker run --pull=never --rm -t temporary-build-image-linux-amd64 php --version | head -n 1 | cut -f 2 -d ' '``docker run --pull=never --rm -t temporary-build-image-linux-amd64 php --version | grep 'ZTS' >/dev/null && echo '-zts' || echo ''`" >> $GITHUB_ENV
- name: Tag also with php:${{ env.PHP_VERSION }}
run: docker tag temporary-build-image-linux-amd64 php-${{ env.PHP_VERSION }}
- name: "Check Alpine -i"
run: docker run --pull=never --rm -t php-${{ env.PHP_VERSION }} php -i
- name: "Check Alpine -v"
run: docker run --pull=never --rm -t php-${{ env.PHP_VERSION }} php -v
- name: "Run Tests"
run: tests/run_tests.sh
env:
DOCKER_REGISTRY_IMAGE: "temporary-build-image-linux-amd64"
- name: Run Alpine Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
image-ref: php-${{ env.PHP_VERSION }}
format: 'table'
exit-code: '0' # we don't break the build if vulnerabilities are included!
ignore-unfixed: true
vuln-type: 'os,library'
severity: 'CRITICAL,HIGH'
- if: contains(github.ref, 'refs/heads/release/')
name: Run Alpine Trivy vulnerability scanner and upload to github security tab
uses: aquasecurity/trivy-action@master
with:
image-ref: php-${{ env.PHP_VERSION }}
format: 'sarif'
output: 'trivy-results.sarif'
- if: contains(github.ref, 'refs/heads/release/')
name: Upload Alpine Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: 'trivy-results.sarif'
#
- if: contains(github.ref, 'refs/heads/release/')
name: Run Trivy in GitHub SBOM mode and submit results to Dependency Snapshots
uses: aquasecurity/trivy-action@master
with:
format: 'github'
output: 'dependency-results.sbom.json'
image-ref: 'temporary-build-image-linux-amd64'
github-pat: ${{ secrets.PAT }}
- if: contains(github.ref, 'refs/heads/release/')
name: Login to DockerHub
uses: docker/login-action@v2
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
- if: contains(github.ref, 'refs/heads/release/')
name: Login to Quay.io
uses: docker/login-action@v2
with:
registry: quay.io
username: ${{ secrets.QUAY_USERNAME }}
password: ${{ secrets.QUAY_PASSWORD }}
- if: contains(github.ref, 'refs/heads/release/')
name: Login to ghcr.io
uses: docker/login-action@v2
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- if: contains(github.ref, 'refs/heads/release/')
name: "Build and Push Multi Arch PHP"
env:
GHCR_DOCKER_IMAGE_NAME: ghcr.io/endava/docker-php:${{ env.PHP_VERSION }}
QUAY_DOCKER_IMAGE_NAME: quay.io/endava/php:${{ env.PHP_VERSION }}
run: ./build_and_push_multi_arch_images.sh endava/php:${{ env.PHP_VERSION }}