Skip to content

Commit 13f476c

Browse files
1fabi01fabi0
authored
Merge branch 'main' into docs/fka-fix-58
2 parents b49e35e + 764ac69 commit 13f476c

File tree

5 files changed

+130
-3
lines changed

5 files changed

+130
-3
lines changed

‎.github/workflows/docker-image-scan.yml

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: Docker Image Scan
2+
3+
on:
4+
schedule:
5+
- cron: '0 0 * * 1' # Jeden Montag um 00:00 Uhr
6+
workflow_dispatch:
7+
push:
8+
branches:
9+
- main
10+
paths:
11+
- Samples/PublicSamples/RecordingBot/**
12+
13+
jobs:
14+
scan:
15+
runs-on: ubuntu-latest
16+
17+
steps:
18+
- name: Checkout repository
19+
uses: actions/checkout@v4
20+
21+
- name: Run Trivy Scan
22+
uses: aquasecurity/[email protected]
23+
with:
24+
image-ref: 'ghcr.io/lm-development/aks-sample/aks-sample:latest'
25+
format: 'sarif'
26+
output: 'trivy-results.sarif'
27+
28+
- name: Upload Trivy scan results to GitHub Security tab
29+
uses: github/codeql-action/upload-sarif@v2
30+
with:
31+
sarif_file: 'trivy-results.sarif'

‎.github/workflows/image-scan-anchore-grype.yml

+46
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# This workflow uses actions that are not certified by GitHub.
2+
# They are provided by a third-party and are governed by
3+
# separate terms of service, privacy policy, and support
4+
# documentation.
5+
6+
# This workflow checks out code, builds an image, performs a container image
7+
# vulnerability scan with Anchore's Grype tool, and integrates the results with GitHub Advanced Security
8+
# code scanning feature. For more information on the Anchore scan action usage
9+
# and parameters, see https://github.com/anchore/scan-action. For more
10+
# information on Anchore's container image scanning tool Grype, see
11+
# https://github.com/anchore/grype
12+
name: Anchore Grype vulnerability scan
13+
14+
on:
15+
schedule:
16+
- cron: '0 0 * * 1' # Jeden Montag um 00:00 Uhr
17+
registry_package:
18+
types: [published]
19+
workflow_dispatch:
20+
21+
permissions:
22+
contents: read
23+
packages: read
24+
25+
jobs:
26+
Anchore-Build-Scan:
27+
permissions:
28+
contents: read # for actions/checkout to fetch code
29+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
30+
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
31+
runs-on: ubuntu-latest
32+
steps:
33+
- name: Check out the code
34+
uses: actions/checkout@v4
35+
- name: Log in to registry
36+
run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
37+
- name: Run the Anchore Grype scan action
38+
uses: anchore/scan-action@d5aa5b6cb9414b0c7771438046ff5bcfa2854ed7
39+
id: scan
40+
with:
41+
image: "ghcr.io/lm-development/aks-sample/aks-sample:latest"
42+
fail-build: false
43+
- name: Upload vulnerability report
44+
uses: github/codeql-action/upload-sarif@v3
45+
with:
46+
sarif_file: ${{ steps.scan.outputs.sarif }}

‎.github/workflows/sonarcloud.yaml

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
name: SonarCloud
2+
on:
3+
push:
4+
branches:
5+
- main
6+
pull_request:
7+
types: [opened, synchronize, reopened]
8+
jobs:
9+
build:
10+
name: Build and analyze
11+
runs-on: windows-latest
12+
steps:
13+
- name: Set up JDK 17
14+
uses: actions/setup-java@v3
15+
with:
16+
java-version: 17
17+
distribution: 'zulu' # Alternative distribution options are available.
18+
- uses: actions/checkout@v3
19+
with:
20+
fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
21+
- name: Cache SonarCloud packages
22+
uses: actions/cache@v3
23+
with:
24+
path: ~\sonar\cache
25+
key: ${{ runner.os }}-sonar
26+
restore-keys: ${{ runner.os }}-sonar
27+
- name: Cache SonarCloud scanner
28+
id: cache-sonar-scanner
29+
uses: actions/cache@v3
30+
with:
31+
path: .\.sonar\scanner
32+
key: ${{ runner.os }}-sonar-scanner
33+
restore-keys: ${{ runner.os }}-sonar-scanner
34+
- name: Install SonarCloud scanner
35+
if: steps.cache-sonar-scanner.outputs.cache-hit != 'true'
36+
working-directory: ./Samples/PublicSamples/RecordingBot/src
37+
shell: powershell
38+
run: |
39+
New-Item -Path .\.sonar\scanner -ItemType Directory
40+
dotnet tool update dotnet-sonarscanner --tool-path .\.sonar\scanner
41+
- name: Build and analyze
42+
working-directory: ./Samples/PublicSamples/RecordingBot/src
43+
env:
44+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any
45+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
46+
shell: powershell
47+
run: |
48+
.\.sonar\scanner\dotnet-sonarscanner begin /k:"LM-Development_aks-sample" /o:"lm-development-test" /d:sonar.token="${{ secrets.SONAR_TOKEN }}" /d:sonar.host.url="https://sonarcloud.io"
49+
dotnet build
50+
.\.sonar\scanner\dotnet-sonarscanner end /d:sonar.token="${{ secrets.SONAR_TOKEN }}"

‎Samples/PublicSamples/RecordingBot/build/Dockerfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ WORKDIR /src/RecordingBot.Console
1010
RUN dotnet build RecordingBot.Console.csproj --arch x64 --self-contained --configuration Release --output C:\app
1111

1212

13-
FROM mcr.microsoft.com/windows/server:ltsc2022
13+
FROM mcr.microsoft.com/windows/server:10.0.20348.2655
1414
SHELL ["powershell", "-Command"]
1515

1616
ADD https://aka.ms/vs/17/release/vc_redist.x64.exe /bot/VC_redist.x64.exe

‎Samples/PublicSamples/RecordingBot/deploy/teams-recording-bot/Chart.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,12 @@ type: application
1616
# This is the chart version. This version number should be incremented each time you make changes
1717
# to the chart and its templates, including the app version.
1818
# Versions are expected to follow Semantic Versioning (https://semver.org/)
19-
version: 1.4.1
19+
version: 1.4.2
2020

2121
# This is the version number of the application being deployed. This version number should be
2222
# incremented each time you make changes to the application. Versions are not expected to
2323
# follow Semantic Versioning. They should reflect the version the application is using.
24-
appVersion: 1.3.1
24+
appVersion: 1.3.2
2525

2626
dependencies:
2727
- name: ingress-nginx

0 commit comments

Comments
 (0)