ci: publish trivy-java-db to ECR Public (#37)

Signed-off-by: knqyf263 <knqyf263@gmail.com>
aquasecurity · Sep 27, 2024 · 01e86e1 · 01e86e1
1 parent 577c6a3
commit 01e86e1
Showing 1 changed file with 25 additions and 5 deletions.
diff --git a/.github/workflows/cron.yml b/.github/workflows/cron.yml
@@ -40,16 +40,36 @@ jobs:
         run: mv cache/db/javadb.tar.gz .
 
       - name: Login to GitHub Packages Container registry
-        uses: docker/login-action@v1
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ env.GH_USER }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Upload assets to GHCR
+      - name: Login to ECR
+        uses: docker/login-action@v3
+        with:
+          registry: public.ecr.aws
+          username: ${{ secrets.ECR_ACCESS_KEY_ID }}
+          password: ${{ secrets.ECR_SECRET_ACCESS_KEY }}
+
+      - name: Upload assets to GHCR and ECR Public
         run: |
           lowercase_repo=$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')
           oras version
-          oras push --artifact-type application/vnd.aquasec.trivy.config.v1+json \
-          ghcr.io/${lowercase_repo}:${DB_VERSION} \
-          javadb.tar.gz:application/vnd.aquasec.trivy.javadb.layer.v1.tar+gzip
+          
+          # Define an array of registry base URLs
+          registries=(
+            "ghcr.io"
+            "public.ecr.aws"
+          )
+
+          # Loop through each registry and push the artifact
+          for registry in "${registries[@]}"; do
+            full_registry_url="${registry}/${lowercase_repo}"
+            oras push --artifact-type application/vnd.aquasec.trivy.config.v1+json \
+            "${full_registry_url}:${DB_VERSION}" \
+            javadb.tar.gz:application/vnd.aquasec.trivy.javadb.layer.v1.tar+gzip
+          
+            echo "Pushed to ${full_registry_url}"
+          done