Compare commits

..

No commits in common. "main" and "v1.2.6" have entirely different histories.
main ... v1.2.6

View File

@ -29,21 +29,6 @@ inputs:
required: false required: false
description: "Build Secrets" description: "Build Secrets"
harbor-scan-report:
required: false
default: "true"
description: "Should try to get harbor scan report"
comment-harbor-scan-report:
required: false
default: "true"
description: "Should comment harbor scan report on PR"
harbor-scan-report-comment-marker:
required: false
default: '<!-- actions-comment-pull-request "build-and-push" -->'
description: "Comment marker for harbor scan report"
outputs: outputs:
digest: digest:
description: "Digest" description: "Digest"
@ -68,9 +53,8 @@ runs:
images: ${{ inputs.registry }}/${{ inputs.image }} images: ${{ inputs.registry }}/${{ inputs.image }}
flavor: latest=false flavor: latest=false
tags: | tags: |
# Pull Request # Cache
type=ref,event=pr type=raw,value=${{ github.ref_name }}-cache
type=ref,event=pr,suffix=-{{sha}},priority=8887 # 2
# Branches # Branches
type=ref,event=branch type=ref,event=branch
@ -95,8 +79,8 @@ runs:
push: ${{ inputs.push }} push: ${{ inputs.push }}
file: ${{ inputs.file }} file: ${{ inputs.file }}
tags: ${{ steps.meta.outputs.tags }} tags: ${{ steps.meta.outputs.tags }}
cache-to: type=registry,ref=${{ inputs.registry }}/${{ inputs.image }}:buildcache,mode=max cache-to: type=inline
cache-from: type=registry,ref=${{ inputs.registry }}/${{ inputs.image }}:buildcache cache-from: type=registry,ref=${{ inputs.registry }}/${{ inputs.image }}:${{ github.ref_name }}-cache
build-args: ${{ inputs.build-args }} build-args: ${{ inputs.build-args }}
secrets: ${{ inputs.build-secrets }} secrets: ${{ inputs.build-secrets }}
@ -111,71 +95,3 @@ runs:
env: env:
tags: ${{ steps.meta.outputs.tags }} tags: ${{ steps.meta.outputs.tags }}
json: ${{ steps.meta.outputs.json }} json: ${{ steps.meta.outputs.json }}
- name: Harbor Scan Results
id: harbor-scan-results
if: ${{ inputs.harbor-scan-report }} == 'true'
uses: ditkrg/harbor-scan-results-action@main
with:
image: ${{ steps.set_tag.outputs.tag }}
username: ${{ inputs.username }}
password: ${{ inputs.password }}
digest: ${{ steps.build-and-push.outputs.digest }}
- name: Comment on active branch PR
uses: actions/github-script@v7
if: ${{ inputs.comment-harbor-scan-report }} == 'true'
env:
COMMENT_MARKER: ${{ inputs.harbor-scan-report-comment-marker }}
TRIVY_SCAN_RESULTS: ${{ steps.harbor-scan-results.outputs.report-markdown }}
with:
script: |
const prs = await github.rest.pulls.list({
owner: context.repo.owner,
repo: context.repo.repo,
head: `${context.repo.owner}:${context.ref.replace('refs/heads/', '')}`
});
if (prs.data.length <= 0) {
console.log('No open PR found for the current branch');
return;
}
const pr = prs.data[0];
// Check if there's already a comment from this workflow
const comments = await github.rest.issues.listComments({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: pr.number
});
const comment_marker = process.env.COMMENT_MARKER;
const buildComment = comments.data.find(comment =>
comment.body.includes(comment_marker)
);
const commentBody = `${comment_marker}
${process.env.TRIVY_SCAN_RESULTS}
`;
if (buildComment) {
// Update existing comment
await github.rest.issues.updateComment({
owner: context.repo.owner,
repo: context.repo.repo,
comment_id: buildComment.id,
body: commentBody
});
console.log(`Updated comment to PR #${pr.number}`);
} else {
// Create new comment
await github.rest.issues.createComment({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: pr.number,
body: commentBody
});
console.log(`Added comment to PR #${pr.number}`);
}