Steffen Skui
7336b17f79
Build and push soc-collector / build (push) Successful in 31s
A single Docker image, configured entirely by env vars (SOC_URL + SOC_TOKEN + targets). Runs once and exits; schedule with cron. Four self-skipping sources: - surface nmap open-port/service scan (SOC_TARGETS) - cve Trivy HIGH/CRITICAL scan of running images (Docker socket) - tls cert-expiry / weak-TLS / missing-headers (SOC_DOMAINS) - config 0.0.0.0 binds, --privileged, rw docker-socket mounts (Docker socket) Stable slugs per source so SOC Center versions/diffs/alerts. Pure stdlib; image adds nmap + trivy. MIT, intended as a public Ethica repo.
50 lines
1.7 KiB
YAML
50 lines
1.7 KiB
YAML
# Build the soc-collector image and push it to the Gitea registry (public package).
|
|
# This is a run-anywhere tool — there is NO deploy step; users `docker run` the image.
|
|
# Reuses the Ethica org CI config: var REGISTRY_USER, secret REGISTRY_TOKEN.
|
|
|
|
name: Build and push soc-collector
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
env:
|
|
IMAGE: git.skui.io/ethica/soc-collector
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Log in to the Gitea registry
|
|
run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.skui.io -u "${{ vars.REGISTRY_USER }}" --password-stdin
|
|
|
|
- name: Determine version tag
|
|
id: version
|
|
run: |
|
|
echo "version=$(date -u +%Y.%m.%d).${{ github.run_number }}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Build (retry transient base-image pulls)
|
|
run: |
|
|
n=0
|
|
until docker build --pull -t "$IMAGE:${{ steps.version.outputs.version }}" -t "$IMAGE:latest" .; do
|
|
n=$((n+1)); [ "$n" -ge 3 ] && { echo "build failed after $n attempts"; exit 1; }
|
|
echo "build attempt $n failed — retrying in $((n*15))s"; sleep $((n*15))
|
|
done
|
|
|
|
- name: Push (retry transient registry TLS timeouts)
|
|
run: |
|
|
for ref in "$IMAGE:${{ steps.version.outputs.version }}" "$IMAGE:latest"; do
|
|
n=0
|
|
until docker push "$ref"; do
|
|
n=$((n+1)); [ "$n" -ge 3 ] && { echo "push of $ref failed after $n attempts"; exit 1; }
|
|
echo "push attempt $n failed (transient registry TLS timeout) — retrying in $((n*15))s"; sleep $((n*15))
|
|
done
|
|
done
|