diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index a8f7d7f..ead5f09 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -10,13 +10,15 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v1 + - name: Set up QEMU + uses: docker/setup-qemu-action@v1 - name: Build env: REPO: ${{ github.repository }} shell: bash run: | echo "docker_repo=${{ env.REPO }}" >> $GITHUB_ENV - make build + make build && make build-arm64 - name: Trivy vulnerability scanner uses: aquasecurity/trivy-action@0.0.20 with: @@ -26,26 +28,39 @@ jobs: ignore-unfixed: true vuln-type: 'os,library' severity: 'CRITICAL,HIGH' + - name: Trivy vulnerability scanner on arm64 image + uses: aquasecurity/trivy-action@0.0.20 + with: + image-ref: '${{ env.docker_repo }}:latest-arm64' + format: 'table' + exit-code: '1' + ignore-unfixed: true + vuln-type: 'os,library' + severity: 'CRITICAL,HIGH' test: runs-on: ubuntu-latest steps: - uses: actions/checkout@v1 + - name: Set up QEMU + uses: docker/setup-qemu-action@v1 - name: Build shell: bash - run: make build + run: make build && make build-arm64 - name: Test - run: make test + run: make test publish: needs: [scan, test] if: github.repository == 'rust-serverless/lambda-rust' runs-on: ubuntu-latest steps: - uses: actions/checkout@v1 + - name: Set up QEMU + uses: docker/setup-qemu-action@v1 - name: Build shell: bash - run: make build + run: make build && make build-arm64 - name: Publish Latest shell: bash run: | echo "${{ secrets.DOCKER_PASSWORD }}" | docker login -u "${{ secrets.DOCKER_USERNAME }}" --password-stdin - make publish + make publish && make publish-arm64 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index fbe6d4c..585c425 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -21,11 +21,13 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v1 + - name: Set up QEMU + uses: docker/setup-qemu-action@v1 - name: Build shell: bash - run: make build + run: make build && make build-arm64 - name: Publish shell: bash run: | echo "${{ secrets.DOCKER_PASSWORD }}" | docker login -u "${{ secrets.DOCKER_USERNAME }}" --password-stdin - make publish-tag + make publish-tag && make publish-tag-arm64 diff --git a/.github/workflows/untrusted.yml b/.github/workflows/untrusted.yml index b611376..15c9604 100644 --- a/.github/workflows/untrusted.yml +++ b/.github/workflows/untrusted.yml @@ -9,6 +9,10 @@ jobs: test: runs-on: ubuntu-latest steps: + - name: Set up QEMU + uses: docker/setup-qemu-action@v1 - uses: actions/checkout@v1 + - name: Build + run: make build && make build-arm64 - name: Test run: make test \ No newline at end of file