name: 'SDK: Container Build and Push' on: push: branches: - 'v3' # For v3-latest - 'v4.6' # For v4-latest - 'master' # For latest paths-ignore: - '.github/**' - '!.github/workflows/sdk-container-build-push.yml' - 'README.md' - 'docs/**' - 'ui/**' - 'api/**' release: types: - 'published' permissions: contents: read concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: false env: # Container configuration IMAGE_NAME: prowler DOCKERFILE_PATH: ./Dockerfile # Python configuration PYTHON_VERSION: '3.12' # Tags (dynamically set based on version) LATEST_TAG: latest STABLE_TAG: stable # Container registries PROWLERCLOUD_DOCKERHUB_REPOSITORY: prowlercloud PROWLERCLOUD_DOCKERHUB_IMAGE: prowler # AWS configuration (for ECR) AWS_REGION: us-east-1 jobs: container-build-push: if: github.repository == 'prowler-cloud/prowler' runs-on: ubuntu-latest timeout-minutes: 45 permissions: contents: read packages: write outputs: prowler_version: ${{ steps.get-prowler-version.outputs.prowler_version }} prowler_version_major: ${{ steps.get-prowler-version.outputs.prowler_version_major }} env: POETRY_VIRTUALENVS_CREATE: 'false' steps: - name: Checkout repository uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - name: Set up Python ${{ env.PYTHON_VERSION }} uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0 with: python-version: ${{ env.PYTHON_VERSION }} - name: Install Poetry run: | pipx install poetry==2.1.1 pipx inject poetry poetry-bumpversion - name: Get Prowler version and set tags id: get-prowler-version run: | PROWLER_VERSION="$(poetry version -s 2>/dev/null)" echo "prowler_version=${PROWLER_VERSION}" >> "${GITHUB_OUTPUT}" echo "PROWLER_VERSION=${PROWLER_VERSION}" >> "${GITHUB_ENV}" # Extract major version PROWLER_VERSION_MAJOR="${PROWLER_VERSION%%.*}" echo "prowler_version_major=${PROWLER_VERSION_MAJOR}" >> "${GITHUB_OUTPUT}" echo "PROWLER_VERSION_MAJOR=${PROWLER_VERSION_MAJOR}" >> "${GITHUB_ENV}" # Set version-specific tags case ${PROWLER_VERSION_MAJOR} in 3) echo "LATEST_TAG=v3-latest" >> "${GITHUB_ENV}" echo "STABLE_TAG=v3-stable" >> "${GITHUB_ENV}" echo "✓ Prowler v3 detected - tags: v3-latest, v3-stable" ;; 4) echo "LATEST_TAG=v4-latest" >> "${GITHUB_ENV}" echo "STABLE_TAG=v4-stable" >> "${GITHUB_ENV}" echo "✓ Prowler v4 detected - tags: v4-latest, v4-stable" ;; 5) echo "LATEST_TAG=latest" >> "${GITHUB_ENV}" echo "STABLE_TAG=stable" >> "${GITHUB_ENV}" echo "✓ Prowler v5 detected - tags: latest, stable" ;; *) echo "::error::Unsupported Prowler major version: ${PROWLER_VERSION_MAJOR}" exit 1 ;; esac - name: Login to DockerHub uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Login to Public ECR uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0 with: registry: public.ecr.aws username: ${{ secrets.PUBLIC_ECR_AWS_ACCESS_KEY_ID }} password: ${{ secrets.PUBLIC_ECR_AWS_SECRET_ACCESS_KEY }} env: AWS_REGION: ${{ env.AWS_REGION }} - name: Set up Docker Buildx uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 - name: Build and push SDK container (latest) if: github.event_name == 'push' uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0 with: context: . file: ${{ env.DOCKERFILE_PATH }} push: true tags: | ${{ secrets.DOCKER_HUB_REPOSITORY }}/${{ env.IMAGE_NAME }}:${{ env.LATEST_TAG }} ${{ secrets.PUBLIC_ECR_REPOSITORY }}/${{ env.IMAGE_NAME }}:${{ env.LATEST_TAG }} ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ env.LATEST_TAG }} cache-from: type=gha cache-to: type=gha,mode=max - name: Notify container push started if: github.event_name == 'release' uses: ./.github/actions/slack-notification env: SLACK_CHANNEL_ID: ${{ secrets.SLACK_PLATFORM_DEPLOYMENTS }} COMPONENT: SDK RELEASE_TAG: ${{ env.PROWLER_VERSION }} GITHUB_SERVER_URL: ${{ github.server_url }} GITHUB_REPOSITORY: ${{ github.repository }} GITHUB_RUN_ID: ${{ github.run_id }} with: slack-bot-token: ${{ secrets.SLACK_BOT_TOKEN }} payload-file-path: "./.github/scripts/slack-messages/container-release-started.json" - name: Build and push SDK container (release) if: github.event_name == 'release' id: container-push uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0 with: context: . file: ${{ env.DOCKERFILE_PATH }} push: true tags: | ${{ secrets.DOCKER_HUB_REPOSITORY }}/${{ env.IMAGE_NAME }}:${{ env.PROWLER_VERSION }} ${{ secrets.DOCKER_HUB_REPOSITORY }}/${{ env.IMAGE_NAME }}:${{ env.STABLE_TAG }} ${{ secrets.PUBLIC_ECR_REPOSITORY }}/${{ env.IMAGE_NAME }}:${{ env.PROWLER_VERSION }} ${{ secrets.PUBLIC_ECR_REPOSITORY }}/${{ env.IMAGE_NAME }}:${{ env.STABLE_TAG }} ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ env.PROWLER_VERSION }} ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ env.STABLE_TAG }} cache-from: type=gha cache-to: type=gha,mode=max - name: Notify container push completed if: github.event_name == 'release' && always() uses: ./.github/actions/slack-notification env: SLACK_CHANNEL_ID: ${{ secrets.SLACK_PLATFORM_DEPLOYMENTS }} COMPONENT: SDK RELEASE_TAG: ${{ env.PROWLER_VERSION }} GITHUB_SERVER_URL: ${{ github.server_url }} GITHUB_REPOSITORY: ${{ github.repository }} GITHUB_RUN_ID: ${{ github.run_id }} with: slack-bot-token: ${{ secrets.SLACK_BOT_TOKEN }} payload-file-path: "./.github/scripts/slack-messages/container-release-completed.json" step-outcome: ${{ steps.container-push.outcome }} dispatch-v3-deployment: if: needs.container-build-push.outputs.prowler_version_major == '3' needs: container-build-push runs-on: ubuntu-latest timeout-minutes: 5 permissions: contents: read steps: - name: Calculate short SHA id: short-sha run: echo "short_sha=${GITHUB_SHA::7}" >> $GITHUB_OUTPUT - name: Dispatch v3 deployment (latest) if: github.event_name == 'push' uses: peter-evans/repository-dispatch@5fc4efd1a4797ddb68ffd0714a238564e4cc0e6f # v4.0.0 with: token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }} repository: ${{ secrets.DISPATCH_OWNER }}/${{ secrets.DISPATCH_REPO }} event-type: dispatch client-payload: '{"version":"v3-latest","tag":"${{ steps.short-sha.outputs.short_sha }}"}' - name: Dispatch v3 deployment (release) if: github.event_name == 'release' uses: peter-evans/repository-dispatch@5fc4efd1a4797ddb68ffd0714a238564e4cc0e6f # v4.0.0 with: token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }} repository: ${{ secrets.DISPATCH_OWNER }}/${{ secrets.DISPATCH_REPO }} event-type: dispatch client-payload: '{"version":"release","tag":"${{ needs.container-build-push.outputs.prowler_version }}"}'