diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c82cad6..102ee2b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -26,9 +26,9 @@ jobs: fail-fast: false steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v6 - name: Lint Dockerfile - uses: hadolint/hadolint-action@v3.0.0 + uses: hadolint/hadolint-action@v3.1.0 with: dockerfile: "Dockerfile" format: "tty" @@ -55,13 +55,13 @@ jobs: platform=${{ matrix.platform }} echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v6 - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@v4 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v4 - name: Build and push - uses: docker/build-push-action@v5 + uses: docker/build-push-action@v7 with: context: . platforms: ${{ matrix.platform }} @@ -78,7 +78,7 @@ jobs: run: | docker run --platform ${{ matrix.platform }} --rm temporary-build-image-${{ env.PLATFORM_PAIR }} sh -c 'uname -a && php -v' - name: Upload artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: ${{ env.PLATFORM_PAIR }}-base.tar path: /tmp/${{ env.PLATFORM_PAIR }}-base.tar @@ -118,13 +118,13 @@ jobs: platform=${{ matrix.platform }} echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v6 - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@v4 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v4 - name: Build and push - uses: docker/build-push-action@v5 + uses: docker/build-push-action@v7 with: context: . platforms: ${{ matrix.platform }} @@ -141,7 +141,7 @@ jobs: run: | docker run --platform ${{ matrix.platform }} --rm temporary-build-image-${{ env.PLATFORM_PAIR }} sh -c 'uname -a && php -v' - name: Upload artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: ${{ env.PLATFORM_PAIR }}-${{ matrix.module }}.tar path: /tmp/${{ env.PLATFORM_PAIR }}-${{ matrix.module }}.tar @@ -165,26 +165,26 @@ jobs: platform=${{ matrix.platform }} echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v6 - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@v4 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v4 - if: contains(github.ref, env.RELEASE_REF_FILTER) name: Login to Docker Hub - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} - if: contains(github.ref, env.RELEASE_REF_FILTER) name: Login to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: registry: ${{ env.GITHUB_REGISTRY }} username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Build and push - uses: docker/build-push-action@v5 + uses: docker/build-push-action@v7 with: context: . platforms: ${{ matrix.platform }} @@ -213,7 +213,7 @@ jobs: run: | docker run --platform ${{ matrix.platform }} --rm temporary-build-image-${{ env.PLATFORM_PAIR }} sh -c 'uname -a && php -v' - name: Upload artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: ${{ env.PLATFORM_PAIR }}.tar path: /tmp/${{ env.PLATFORM_PAIR }}.tar @@ -237,9 +237,9 @@ jobs: platform=${{ matrix.platform }} echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@v4 - name: Download ${{ matrix.platform }} artifact - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v7 with: name: ${{ env.PLATFORM_PAIR }}.tar path: /tmp @@ -264,20 +264,20 @@ jobs: - frankenphp steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v6 - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@v4 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v4 - name: Download amd64 artifact if: env.EXCLUDED_PLATFORM != 'linux/amd64' - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v7 with: name: linux-amd64.tar path: /tmp - name: Download arm64 artifact if: env.EXCLUDED_PLATFORM != 'linux/arm64' - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v7 with: name: linux-arm64.tar path: /tmp @@ -312,7 +312,7 @@ jobs: - name: Tag also with php-${{ env.PHP_VERSION }} run: docker tag temporary-build-image-linux-amd64 php-${{ env.PHP_VERSION }} - if: ${{ contains(matrix.suffix, 'unsuffixed') && contains(github.ref, 'refs/heads/release/') }} - uses: aquasecurity/trivy-action@master + uses: aquasecurity/trivy-action@v0.36.0 with: image-ref: php-${{ env.PHP_VERSION }} format: 'table' @@ -323,7 +323,7 @@ jobs: - if: ${{ contains(matrix.suffix, 'unsuffixed') && contains(github.ref, 'refs/heads/release/') }} name: Run Alpine Trivy vulnerability scanner and upload to github security tab - uses: aquasecurity/trivy-action@master + uses: aquasecurity/trivy-action@v0.36.0 with: image-ref: php-${{ env.PHP_VERSION }} format: 'sarif' @@ -331,12 +331,12 @@ jobs: - if: ${{ contains(matrix.suffix, 'unsuffixed') && contains(github.ref, 'refs/heads/release/') }} name: Upload Alpine Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@v4 with: sarif_file: 'trivy-results.sarif' - if: ${{ contains(matrix.suffix, 'unsuffixed') && contains(github.ref, 'refs/heads/release/') }} name: Run Trivy in GitHub SBOM mode and submit results to Dependency Snapshots - uses: aquasecurity/trivy-action@master + uses: aquasecurity/trivy-action@v0.36.0 with: format: 'github' output: 'dependency-results.sbom.json' @@ -344,27 +344,27 @@ jobs: github-pat: ${{ secrets.PAT }} - if: github.event_name != 'pull_request' name: Login to DockerHub - uses: docker/login-action@v3.0.0 + uses: docker/login-action@v4 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} - if: github.event_name != 'pull_request' name: Login to Quay.io - uses: docker/login-action@v3.0.0 + uses: docker/login-action@v4 with: registry: quay.io username: ${{ secrets.QUAY_USERNAME }} password: ${{ secrets.QUAY_PASSWORD }} - name: Log into registry ${{ env.GITHUB_REGISTRY }} if: github.event_name != 'pull_request' - uses: docker/login-action@v3.0.0 + uses: docker/login-action@v4 with: registry: ${{ env.GITHUB_REGISTRY }} username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Extract Dockerfile metadata id: metaUnsuffixed - uses: docker/metadata-action@v5.5.1 + uses: docker/metadata-action@v6 with: tags: | type=raw,value=${{ env.PHP_VERSION }} @@ -386,7 +386,7 @@ jobs: fi - if: contains(matrix.suffix, 'unsuffixed') name: Build and push Docker image - uses: docker/build-push-action@v5.3.0 + uses: docker/build-push-action@v7 with: context: . platforms: ${{ env.PLATFORMS }} @@ -407,7 +407,7 @@ jobs: - if: ${{ !contains(matrix.suffix, 'unsuffixed') }} name: Extract Dockerfile-${{ matrix.suffix }} metadata id: meta - uses: docker/metadata-action@v5.5.1 + uses: docker/metadata-action@v6 with: tags: | type=raw,value=${{ env.PHP_VERSION }}-${{ matrix.suffix }} @@ -417,7 +417,7 @@ jobs: ${{ env.GITHUB_REGISTRY }}/${{ env.GITHUB_IMAGE_NAME }} - if: ${{ !contains(matrix.suffix, 'unsuffixed') }} name: Build and push Dockerfile-${{ matrix.suffix }} - uses: docker/build-push-action@v5.3.0 + uses: docker/build-push-action@v7 with: context: . file: Dockerfile-${{ matrix.suffix }} @@ -433,4 +433,3 @@ jobs: labels: ${{ steps.meta.outputs.labels }} - diff --git a/.github/workflows/release-notes.yml b/.github/workflows/release-notes.yml index 4109163..d1e3fd3 100644 --- a/.github/workflows/release-notes.yml +++ b/.github/workflows/release-notes.yml @@ -11,7 +11,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@v6 - name: Export ZTS_SUFFIX (if zts is enabled) run: echo "ZTS_SUFFIX=`echo ${{ github.ref_name }} | grep 'zts' > /dev/null && echo '-zts' || echo ''`" >> $GITHUB_ENV - name: "Fetch all existing tags" @@ -25,7 +25,7 @@ jobs: - name: Generate Changelog run: docker run --rm -v `pwd`/previous-php-i.txt:/usr/src/app/previous-php-i.txt -v `pwd`/generate-changelog.php:/usr/src/app/generate-changelog.php ghcr.io/endava/docker-php:${{ github.ref_name }} php /usr/src/app/generate-changelog.php ghcr.io/endava/docker-php:${{ github.ref_name }} > RELEASE_NOTES.txt - name: Release - uses: softprops/action-gh-release@v1 + uses: softprops/action-gh-release@v3 if: startsWith(github.ref, 'refs/tags/') with: body_path: RELEASE_NOTES.txt