UID2-7877: Use shared manifest for sample image workflows

.github/sample-images.json

@@ -0,0 +1,88 @@
+{
+  "include": [
+    {
+      "name": "reverse-proxy",
+      "dockerfile": "tools/reverse-proxy/Dockerfile",
+      "context": "tools/reverse-proxy",
+      "image": "iabtechlab/uid-reverse-proxy"
+    },
+    {
+      "name": "secure-signals-client-server",
+      "dockerfile": "web-integrations/google-secure-signals/client-server/Dockerfile",
+      "context": "web-integrations/google-secure-signals/client-server",
+      "image": "iabtechlab/uid-google-secure-signals-client-server"
+    },
+    {
+      "name": "secure-signals-client-side",
+      "dockerfile": "web-integrations/google-secure-signals/client-side/Dockerfile",
+      "context": "web-integrations/google-secure-signals/client-side",
+      "image": "iabtechlab/uid-google-secure-signals-client-side"
+    },
+    {
+      "name": "secure-signals-server-side",
+      "dockerfile": "web-integrations/google-secure-signals/server-side/Dockerfile",
+      "context": "web-integrations/google-secure-signals/server-side",
+      "image": "iabtechlab/uid-google-secure-signals-server-side"
+    },
+    {
+      "name": "secure-signals-react-client-side",
+      "dockerfile": "web-integrations/google-secure-signals/react-client-side/Dockerfile",
+      "context": "web-integrations/google-secure-signals/react-client-side",
+      "image": "iabtechlab/uid-google-secure-signals-react-client-side"
+    },
+    {
+      "name": "javascript-sdk-client-side",
+      "dockerfile": "web-integrations/javascript-sdk/client-side/Dockerfile",
+      "context": "web-integrations/javascript-sdk/client-side",
+      "image": "iabtechlab/uid-javascript-sdk-client-side"
+    },
+    {
+      "name": "javascript-sdk-client-server",
+      "dockerfile": "web-integrations/javascript-sdk/client-server/Dockerfile",
+      "context": "web-integrations/javascript-sdk/client-server",
+      "image": "iabtechlab/uid-javascript-sdk-client-server"
+    },
+    {
+      "name": "javascript-sdk-react-client-side",
+      "dockerfile": "web-integrations/javascript-sdk/react-client-side/Dockerfile",
+      "context": "web-integrations/javascript-sdk/react-client-side",
+      "image": "iabtechlab/uid-javascript-sdk-react-client-side"
+    },
+    {
+      "name": "server-side",
+      "dockerfile": "web-integrations/server-side/Dockerfile",
+      "context": "web-integrations/server-side",
+      "image": "iabtechlab/uid-server-side"
+    },
+    {
+      "name": "prebid-client-side",
+      "dockerfile": "web-integrations/prebid-integrations/client-side/Dockerfile",
+      "context": "web-integrations/prebid-integrations",
+      "image": "iabtechlab/uid-prebid-client-side"
+    },
+    {
+      "name": "prebid-client-server",
+      "dockerfile": "web-integrations/prebid-integrations/client-server/Dockerfile",
+      "context": "web-integrations/prebid-integrations",
+      "image": "iabtechlab/uid-prebid-client-server"
+    },
+    {
+      "name": "prebid-client-side-deferred",
+      "dockerfile": "web-integrations/prebid-integrations/client-side-deferred/Dockerfile",
+      "context": "web-integrations/prebid-integrations",
+      "image": "iabtechlab/uid-prebid-client-side-deferred"
+    },
+    {
+      "name": "prebid-secure-signals-client-side",
+      "dockerfile": "web-integrations/prebid-secure-signals/client-side/Dockerfile",
+      "context": "web-integrations/prebid-secure-signals",
+      "image": "iabtechlab/uid-prebid-secure-signals-client-side"
+    },
+    {
+      "name": "hashing-tool",
+      "dockerfile": "tools/hashing-tool/Dockerfile",
+      "context": "tools/hashing-tool",
+      "image": "iabtechlab/uid-hashing-tool"
+    }
+  ]
+}

.github/workflows/release-all-docker-images.yaml

@@ -13,6 +13,16 @@ on:
         - Snapshot
 
 jobs:
+  loadImageMatrix:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.matrix.outputs.matrix }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Load sample image matrix
+        id: matrix
+        run: echo "matrix=$(jq -c . .github/sample-images.json)" >> "$GITHUB_OUTPUT"
+
   incrementVersionNumber:
     uses: iabtechlab/uid2-shared-actions/.github/workflows/shared-increase-version-number.yaml@v3
     with:
@@ -21,184 +31,21 @@ jobs:
       merge_environment: ${{ github.ref_protected && 'ci-auto-merge' || '' }}
     secrets: inherit
 
-  publishReverseProxyImage:
-    uses: iabtechlab/uid2-shared-actions/.github/workflows/shared-publish-to-docker-versioned.yaml@v3
-    needs: incrementVersionNumber
-    with: 
-      new_version: ${{ needs.incrementVersionNumber.outputs.new_version }}
-      image_tag: ${{ needs.incrementVersionNumber.outputs.image_tag }}
-      release_type: ${{ inputs.release_type }}
-      docker_file: tools/reverse-proxy/Dockerfile
-      docker_context: tools/reverse-proxy
-      docker_image_name: iabtechlab/uid-reverse-proxy
-      docker_registry: ghcr.io
-    secrets: inherit
-
-  publishSecureSignalsClientServerImage:
-    uses: iabtechlab/uid2-shared-actions/.github/workflows/shared-publish-to-docker-versioned.yaml@v3
-    needs: incrementVersionNumber
-    with: 
-      new_version: ${{ needs.incrementVersionNumber.outputs.new_version }}
-      image_tag: ${{ needs.incrementVersionNumber.outputs.image_tag }}
-      release_type: ${{ inputs.release_type }}
-      docker_file: web-integrations/google-secure-signals/client-server/Dockerfile
-      docker_context: web-integrations/google-secure-signals/client-server
-      docker_image_name: iabtechlab/uid-google-secure-signals-client-server
-      docker_registry: ghcr.io
-    secrets: inherit
-
-  publishSecureSignalsClientSideImage:
-    uses: iabtechlab/uid2-shared-actions/.github/workflows/shared-publish-to-docker-versioned.yaml@v3
-    needs: incrementVersionNumber
-    with: 
-      new_version: ${{ needs.incrementVersionNumber.outputs.new_version }}
-      image_tag: ${{ needs.incrementVersionNumber.outputs.image_tag }}
-      release_type: ${{ inputs.release_type }}
-      docker_file: web-integrations/google-secure-signals/client-side/Dockerfile
-      docker_context: web-integrations/google-secure-signals/client-side
-      docker_image_name: iabtechlab/uid-google-secure-signals-client-side
-      docker_registry: ghcr.io
-    secrets: inherit
-
-  publishSecureSignalsServerSideImage:
+  publishImages:
+    name: Publish ${{ matrix.name }}
+    needs:
+      - loadImageMatrix
+      - incrementVersionNumber
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.loadImageMatrix.outputs.matrix) }}
     uses: iabtechlab/uid2-shared-actions/.github/workflows/shared-publish-to-docker-versioned.yaml@v3
-    needs: incrementVersionNumber
-    with: 
-      new_version: ${{ needs.incrementVersionNumber.outputs.new_version }}
-      image_tag: ${{ needs.incrementVersionNumber.outputs.image_tag }}
-      release_type: ${{ inputs.release_type }}
-      docker_file: web-integrations/google-secure-signals/server-side/Dockerfile
-      docker_context: web-integrations/google-secure-signals/server-side
-      docker_image_name: iabtechlab/uid-google-secure-signals-server-side
-      docker_registry: ghcr.io
-    secrets: inherit
-
-  publishSecureSignalsReactClientSideImage:
-    uses: iabtechlab/uid2-shared-actions/.github/workflows/shared-publish-to-docker-versioned.yaml@v3
-    needs: incrementVersionNumber
-    with: 
-      new_version: ${{ needs.incrementVersionNumber.outputs.new_version }}
-      image_tag: ${{ needs.incrementVersionNumber.outputs.image_tag }}
-      release_type: ${{ inputs.release_type }}
-      docker_file: web-integrations/google-secure-signals/react-client-side/Dockerfile
-      docker_context: web-integrations/google-secure-signals/react-client-side
-      docker_image_name: iabtechlab/uid-google-secure-signals-react-client-side
-      docker_registry: ghcr.io
-    secrets: inherit
-
-  publishJavascriptSdkClientSideImage:
-    uses: iabtechlab/uid2-shared-actions/.github/workflows/shared-publish-to-docker-versioned.yaml@v3
-    needs: incrementVersionNumber
-    with: 
-      new_version: ${{ needs.incrementVersionNumber.outputs.new_version }}
-      image_tag: ${{ needs.incrementVersionNumber.outputs.image_tag }}
-      release_type: ${{ inputs.release_type }}
-      docker_file: web-integrations/javascript-sdk/client-side/Dockerfile
-      docker_context: web-integrations/javascript-sdk/client-side
-      docker_image_name: iabtechlab/uid-javascript-sdk-client-side
-      docker_registry: ghcr.io
-    secrets: inherit
-
-  publishJavascriptSdkClientServerImage:
-    uses: iabtechlab/uid2-shared-actions/.github/workflows/shared-publish-to-docker-versioned.yaml@v3
-    needs: incrementVersionNumber
-    with: 
-      new_version: ${{ needs.incrementVersionNumber.outputs.new_version }}
-      image_tag: ${{ needs.incrementVersionNumber.outputs.image_tag }}
-      release_type: ${{ inputs.release_type }}
-      docker_file: web-integrations/javascript-sdk/client-server/Dockerfile
-      docker_context: web-integrations/javascript-sdk/client-server
-      docker_image_name: iabtechlab/uid-javascript-sdk-client-server
-      docker_registry: ghcr.io
-    secrets: inherit
-
-  publishJavascriptSdkReactClientSideImage:
-    uses: iabtechlab/uid2-shared-actions/.github/workflows/shared-publish-to-docker-versioned.yaml@v3
-    needs: incrementVersionNumber
-    with: 
-      new_version: ${{ needs.incrementVersionNumber.outputs.new_version }}
-      image_tag: ${{ needs.incrementVersionNumber.outputs.image_tag }}
-      release_type: ${{ inputs.release_type }}
-      docker_file: web-integrations/javascript-sdk/react-client-side/Dockerfile
-      docker_context: web-integrations/javascript-sdk/react-client-side
-      docker_image_name: iabtechlab/uid-javascript-sdk-react-client-side
-      docker_registry: ghcr.io
-    secrets: inherit
-
-  publishServerSideImage:
-    uses: iabtechlab/uid2-shared-actions/.github/workflows/shared-publish-to-docker-versioned.yaml@v3
-    needs: incrementVersionNumber
-    with: 
-      new_version: ${{ needs.incrementVersionNumber.outputs.new_version }}
-      image_tag: ${{ needs.incrementVersionNumber.outputs.image_tag }}
-      release_type: ${{ inputs.release_type }}
-      docker_file: web-integrations/server-side/Dockerfile
-      docker_context: web-integrations/server-side
-      docker_image_name: iabtechlab/uid-server-side
-      docker_registry: ghcr.io
-    secrets: inherit
-
-  publishPrebidClientSideImage:
-    uses: iabtechlab/uid2-shared-actions/.github/workflows/shared-publish-to-docker-versioned.yaml@v3
-    needs: incrementVersionNumber
-    with: 
-      new_version: ${{ needs.incrementVersionNumber.outputs.new_version }}
-      image_tag: ${{ needs.incrementVersionNumber.outputs.image_tag }}
-      release_type: ${{ inputs.release_type }}
-      docker_file: web-integrations/prebid-integrations/client-side/Dockerfile
-      docker_context: web-integrations/prebid-integrations
-      docker_image_name: iabtechlab/uid-prebid-client-side
-      docker_registry: ghcr.io
-    secrets: inherit
-
-  publishPrebidClientServerImage:
-    uses: iabtechlab/uid2-shared-actions/.github/workflows/shared-publish-to-docker-versioned.yaml@v3
-    needs: incrementVersionNumber
-    with: 
-      new_version: ${{ needs.incrementVersionNumber.outputs.new_version }}
-      image_tag: ${{ needs.incrementVersionNumber.outputs.image_tag }}
-      release_type: ${{ inputs.release_type }}
-      docker_file: web-integrations/prebid-integrations/client-server/Dockerfile
-      docker_context: web-integrations/prebid-integrations
-      docker_image_name: iabtechlab/uid-prebid-client-server
-      docker_registry: ghcr.io
-    secrets: inherit
-
-  publishPrebidClientSideDeferredImage:
-    uses: iabtechlab/uid2-shared-actions/.github/workflows/shared-publish-to-docker-versioned.yaml@v3
-    needs: incrementVersionNumber
-    with: 
-      new_version: ${{ needs.incrementVersionNumber.outputs.new_version }}
-      image_tag: ${{ needs.incrementVersionNumber.outputs.image_tag }}
-      release_type: ${{ inputs.release_type }}
-      docker_file: web-integrations/prebid-integrations/client-side-deferred/Dockerfile
-      docker_context: web-integrations/prebid-integrations
-      docker_image_name: iabtechlab/uid-prebid-client-side-deferred
-      docker_registry: ghcr.io
-    secrets: inherit
-
-  publishPrebidSecureSignalsClientSideImage:
-    uses: iabtechlab/uid2-shared-actions/.github/workflows/shared-publish-to-docker-versioned.yaml@v3
-    needs: incrementVersionNumber
-    with: 
-      new_version: ${{ needs.incrementVersionNumber.outputs.new_version }}
-      image_tag: ${{ needs.incrementVersionNumber.outputs.image_tag }}
-      release_type: ${{ inputs.release_type }}
-      docker_file: web-integrations/prebid-secure-signals/client-side/Dockerfile
-      docker_context: web-integrations/prebid-secure-signals
-      docker_image_name: iabtechlab/uid-prebid-secure-signals-client-side
-      docker_registry: ghcr.io
-    secrets: inherit
-
-  publishHashingToolImage:
-    uses: iabtechlab/uid2-shared-actions/.github/workflows/shared-publish-to-docker-versioned.yaml@v3
-    needs: incrementVersionNumber
-    with: 
+    with:
       new_version: ${{ needs.incrementVersionNumber.outputs.new_version }}
       image_tag: ${{ needs.incrementVersionNumber.outputs.image_tag }}
       release_type: ${{ inputs.release_type }}
-      docker_file: tools/hashing-tool/Dockerfile
-      docker_context: tools/hashing-tool
-      docker_image_name: iabtechlab/uid-hashing-tool
+      docker_file: ${{ matrix.dockerfile }}
+      docker_context: ${{ matrix.context }}
+      docker_image_name: ${{ matrix.image }}
       docker_registry: ghcr.io
     secrets: inherit

.github/workflows/vulnerability-scan-failure-notify.yaml

@@ -15,9 +15,65 @@ on:
     - cron: '0 0 * * *'   # 5:00 PM GMT -7
 
 jobs:
-  vulnerability-scan-failure-notify:
-    uses: IABTechLab/uid2-shared-actions/.github/workflows/shared-vulnerability-scan-failure-notify.yaml@v3
-    secrets:
-      SLACK_WEBHOOK : ${{ secrets.SLACK_WEBHOOK }}
-    with:
-      scan_type : fs
+  load-image-matrix:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.matrix.outputs.matrix }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Load sample image matrix
+        id: matrix
+        run: echo "matrix=$(jq -c . .github/sample-images.json)" >> "$GITHUB_OUTPUT"
+
+  filesystem-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Scan repository
+        uses: IABTechLab/uid2-shared-actions/actions/vulnerability_scan@v3
+        with:
+          scan_type: fs
+          scan_severity: ${{ inputs.vulnerability_severity || 'CRITICAL,HIGH' }}
+          failure_severity: ${{ inputs.vulnerability_severity || 'CRITICAL,HIGH' }}
+          publish_vulnerabilities: 'false'
+
+  image-scan:
+    name: Image scan - ${{ matrix.name }}
+    needs: load-image-matrix
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.load-image-matrix.outputs.matrix) }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Build image
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        with:
+          context: ${{ matrix.context }}
+          file: ${{ matrix.dockerfile }}
+          load: true
+          tags: image-scan:${{ matrix.name }}-${{ github.sha }}
+      - name: Scan image
+        uses: IABTechLab/uid2-shared-actions/actions/vulnerability_scan@v3
+        with:
+          scan_type: image
+          image_ref: image-scan:${{ matrix.name }}-${{ github.sha }}
+          scan_severity: ${{ inputs.vulnerability_severity || 'CRITICAL,HIGH' }}
+          failure_severity: ${{ inputs.vulnerability_severity || 'CRITICAL,HIGH' }}
+          publish_vulnerabilities: 'false'
+
+  notify-on-failure:
+    name: Notify Slack on vulnerability scan failure
+    if: ${{ always() && (needs.filesystem-scan.result == 'failure' || needs.image-scan.result == 'failure') }}
+    needs:
+      - filesystem-scan
+      - image-scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Notify Slack
+        env:
+          SLACK_COLOR: danger
+          SLACK_MESSAGE: ':x: One or more vulnerability scans failed. Please review details: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}. Check past alerts before acting and log new actions to avoid duplicate efforts.'
+          SLACK_TITLE: Vulnerability Scan Failure
+          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
+        uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2