From e54093a0b4c5a6803522fcacf41cf37b1d631c4e Mon Sep 17 00:00:00 2001 From: Dennis Kuijs Date: Fri, 24 Jul 2026 14:24:16 +0200 Subject: [PATCH 01/10] Fix CI/CD deprecations --- .github/workflows/keycloak.yml | 72 +++++++++++++++++----------------- 1 file changed, 37 insertions(+), 35 deletions(-) diff --git a/.github/workflows/keycloak.yml b/.github/workflows/keycloak.yml index 76c5ee7..e1adb81 100644 --- a/.github/workflows/keycloak.yml +++ b/.github/workflows/keycloak.yml @@ -1,4 +1,4 @@ -name: Docker Image +name: CI/CD # Controls when the action will run. on: @@ -21,11 +21,8 @@ concurrency: jobs: - image_keycloak: - - env: - PLATFORM: linux/amd64,linux/arm64 - + build: + name: CI/CD runs-on: ubuntu-latest steps: @@ -42,55 +39,60 @@ jobs: env: TAG: ${{ github.event.release.tag_name }} - - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - name: set up JDK 17 - uses: actions/setup-java@b6e674f4b717d7b0ae3baee0fbe79f498905dfde # v1 + - name: Set up JDK 17 and gradle cache + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: - java-version: 17 - - - name: grant execute permission for gradlew - run: chmod +x gradlew + distribution: 'temurin' + java-version: '17' + cache: 'gradle' - - name: build with Gradle - run: ./gradlew installDist - - - name: set up QEMU - uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480 # v1 - with: - platforms: all + - name: Build with Gradle + run: | + ./gradlew installDist - - name: install buildx - id: buildx - uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 # v1 + - name: Install QEMU + uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 with: - version: latest - install: true + platforms: linux/amd64,linux/aarch64 - - name: available platforms - run: echo ${{ steps.buildx.outputs.platforms }} + - name: Install Buildx + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - name: Login to DockerHub - uses: docker/login-action@dd4fa0671be5250ee6f50aedf4cb05514abda2c7 # v1 + uses: docker/login-action@06fb636fac595d6fb4b28a5dfcb21a6f5091859c # v4.5.0 with: username: ${{ secrets._TEMP_DOCKERHUB_USER }} password: ${{ secrets._TEMP_DOCKERHUB_PASSWORD }} - - name: build and push images - run: | - docker build --build-arg GIT_COMMIT=${{ github.sha }} --push --platform $PLATFORM $TAG . + - name: Build multi-platform Keycloak image + timeout-minutes: 20 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 + with: + context: . + platforms: linux/amd64,linux/aarch64 + load: true + push: true + tags: ${{ steps.set-tags.outputs.keycloakDockerImage }} + build-args: | + GIT_COMMIT=${{ github.sha }} + env: + DOCKER_BUILD_SUMMARY: false + DOCKER_BUILD_RECORD_UPLOAD: false - - name: Scan keycloak docker image - uses: anchore/scan-action@3343887d815d7b07465f6fdcd395bd66508d486a # v3 + - name: Scan Keycloak Docker image + uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0 id: keycloak-anchore-scan with: image: ${{ steps.set-tags.outputs.keycloakDockerImage }} - fail-build: false + fail-build: true severity-cutoff: critical - name: Upload Anchore scan SARIF report if: ${{ !cancelled() }} - uses: github/codeql-action/upload-sarif@e488e3c8239c26bf8e6704904a8cb59be658d450 # v3 + uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 with: sarif_file: ${{ steps.keycloak-anchore-scan.outputs.sarif }} From 6ba69829f89c3cd4fb8ff92cd627056b25b5e92d Mon Sep 17 00:00:00 2001 From: Dennis Kuijs Date: Fri, 24 Jul 2026 14:26:14 +0200 Subject: [PATCH 02/10] Fix CI/CD deprecations --- .github/workflows/keycloak.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/keycloak.yml b/.github/workflows/keycloak.yml index e1adb81..09e10b2 100644 --- a/.github/workflows/keycloak.yml +++ b/.github/workflows/keycloak.yml @@ -15,6 +15,13 @@ on: paths-ignore: - '**/*.md' + # Validate pull requests without publishing + pull_request: + branches: + - main + paths-ignore: + - '**/*.md' + concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true From 1b9339be9432846358b9b49e5e84fdc1d0b3beb7 Mon Sep 17 00:00:00 2001 From: Dennis Kuijs Date: Fri, 24 Jul 2026 14:27:18 +0200 Subject: [PATCH 03/10] Fix CI/CD deprecations --- .github/workflows/keycloak.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/keycloak.yml b/.github/workflows/keycloak.yml index 09e10b2..61b96c2 100644 --- a/.github/workflows/keycloak.yml +++ b/.github/workflows/keycloak.yml @@ -81,7 +81,7 @@ jobs: context: . platforms: linux/amd64,linux/aarch64 load: true - push: true + push: false tags: ${{ steps.set-tags.outputs.keycloakDockerImage }} build-args: | GIT_COMMIT=${{ github.sha }} From ac5b1f3e945ca96ce23283bd17e17abe9965e4c9 Mon Sep 17 00:00:00 2001 From: Dennis Kuijs Date: Fri, 24 Jul 2026 14:28:55 +0200 Subject: [PATCH 04/10] Fix CI/CD deprecations --- .github/workflows/keycloak.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/keycloak.yml b/.github/workflows/keycloak.yml index 61b96c2..7c6a9d8 100644 --- a/.github/workflows/keycloak.yml +++ b/.github/workflows/keycloak.yml @@ -33,7 +33,7 @@ jobs: runs-on: ubuntu-latest steps: - - name: Set tags + - name: Set tagss id: set-tags run: | if [ -z "$TAG" ]; then From a8730288b59c595ec3cc6e7e4976ee054968ebc0 Mon Sep 17 00:00:00 2001 From: Dennis Kuijs Date: Fri, 24 Jul 2026 14:35:25 +0200 Subject: [PATCH 05/10] Fix CI/CD deprecations --- .github/workflows/keycloak.yml | 33 ++++++++++++++++++++++++--------- 1 file changed, 24 insertions(+), 9 deletions(-) diff --git a/.github/workflows/keycloak.yml b/.github/workflows/keycloak.yml index 7c6a9d8..ce73fd2 100644 --- a/.github/workflows/keycloak.yml +++ b/.github/workflows/keycloak.yml @@ -68,19 +68,13 @@ jobs: - name: Install Buildx uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - - name: Login to DockerHub - uses: docker/login-action@06fb636fac595d6fb4b28a5dfcb21a6f5091859c # v4.5.0 - with: - username: ${{ secrets._TEMP_DOCKERHUB_USER }} - password: ${{ secrets._TEMP_DOCKERHUB_PASSWORD }} - - - name: Build multi-platform Keycloak image + - name: Build and load Keycloak image for Grype scan timeout-minutes: 20 uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: . - platforms: linux/amd64,linux/aarch64 - load: true + platforms: linux/amd64 # "ubuntu-latest" runs on x86 GitHub runners + load: true # Load image locally for Grype Scan push: false tags: ${{ steps.set-tags.outputs.keycloakDockerImage }} build-args: | @@ -106,3 +100,24 @@ jobs: - name: Inspect Anchore scan SARIF report if: ${{ !cancelled() }} run: cat ${{ steps.keycloak-anchore-scan.outputs.sarif }} + + - name: Login to DockerHub + uses: docker/login-action@06fb636fac595d6fb4b28a5dfcb21a6f5091859c # v4.5.0 + with: + username: ${{ secrets._TEMP_DOCKERHUB_USER }} + password: ${{ secrets._TEMP_DOCKERHUB_PASSWORD }} + + - name: Build multi-platform Keycloak image + timeout-minutes: 20 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 + with: + context: . + platforms: linux/amd64,linux/aarch64 + load: false + push: false + tags: ${{ steps.set-tags.outputs.keycloakDockerImage }} + build-args: | + GIT_COMMIT=${{ github.sha }} + env: + DOCKER_BUILD_SUMMARY: false + DOCKER_BUILD_RECORD_UPLOAD: false \ No newline at end of file From 22d6b1eb7e4bdc642d0714b05e2cae69d002e956 Mon Sep 17 00:00:00 2001 From: Dennis Kuijs Date: Fri, 24 Jul 2026 14:41:54 +0200 Subject: [PATCH 06/10] Fix CI/CD deprecations --- .github/workflows/keycloak.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/keycloak.yml b/.github/workflows/keycloak.yml index ce73fd2..e12153f 100644 --- a/.github/workflows/keycloak.yml +++ b/.github/workflows/keycloak.yml @@ -33,7 +33,7 @@ jobs: runs-on: ubuntu-latest steps: - - name: Set tagss + - name: Set tags id: set-tags run: | if [ -z "$TAG" ]; then @@ -102,19 +102,21 @@ jobs: run: cat ${{ steps.keycloak-anchore-scan.outputs.sarif }} - name: Login to DockerHub + if: ${{ github.event_name != 'pull_request' }} uses: docker/login-action@06fb636fac595d6fb4b28a5dfcb21a6f5091859c # v4.5.0 with: username: ${{ secrets._TEMP_DOCKERHUB_USER }} password: ${{ secrets._TEMP_DOCKERHUB_PASSWORD }} - name: Build multi-platform Keycloak image + if: ${{ github.event_name != 'pull_request' }} timeout-minutes: 20 uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: . platforms: linux/amd64,linux/aarch64 load: false - push: false + push: true tags: ${{ steps.set-tags.outputs.keycloakDockerImage }} build-args: | GIT_COMMIT=${{ github.sha }} From edc32ef2b5e15b5995e019e9763e97ffef1e4d66 Mon Sep 17 00:00:00 2001 From: Dennis Kuijs Date: Fri, 24 Jul 2026 14:42:32 +0200 Subject: [PATCH 07/10] Fix CI/CD deprecations --- .github/workflows/keycloak.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/keycloak.yml b/.github/workflows/keycloak.yml index e12153f..cdc23b6 100644 --- a/.github/workflows/keycloak.yml +++ b/.github/workflows/keycloak.yml @@ -122,4 +122,4 @@ jobs: GIT_COMMIT=${{ github.sha }} env: DOCKER_BUILD_SUMMARY: false - DOCKER_BUILD_RECORD_UPLOAD: false \ No newline at end of file + DOCKER_BUILD_RECORD_UPLOAD: false From 5bd59e9c46c0f0f77bbba428ecd2fc02862c3778 Mon Sep 17 00:00:00 2001 From: Dennis Kuijs Date: Fri, 24 Jul 2026 14:44:51 +0200 Subject: [PATCH 08/10] Fix CI/CD deprecations --- .github/workflows/keycloak.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/keycloak.yml b/.github/workflows/keycloak.yml index cdc23b6..1321e30 100644 --- a/.github/workflows/keycloak.yml +++ b/.github/workflows/keycloak.yml @@ -49,11 +49,11 @@ jobs: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - name: Set up JDK 17 and gradle cache + - name: Set up JDK 21 and gradle cache uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: distribution: 'temurin' - java-version: '17' + java-version: '21' cache: 'gradle' - name: Build with Gradle From cee65c7cce5a5f1099b5f7da96d0afa8059e0d48 Mon Sep 17 00:00:00 2001 From: Dennis Kuijs Date: Fri, 24 Jul 2026 14:50:24 +0200 Subject: [PATCH 09/10] Update .github/workflows/keycloak.yml Co-authored-by: Wouter Born --- .github/workflows/keycloak.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/keycloak.yml b/.github/workflows/keycloak.yml index 1321e30..3cd7cb2 100644 --- a/.github/workflows/keycloak.yml +++ b/.github/workflows/keycloak.yml @@ -103,7 +103,7 @@ jobs: - name: Login to DockerHub if: ${{ github.event_name != 'pull_request' }} - uses: docker/login-action@06fb636fac595d6fb4b28a5dfcb21a6f5091859c # v4.5.0 + uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1 with: username: ${{ secrets._TEMP_DOCKERHUB_USER }} password: ${{ secrets._TEMP_DOCKERHUB_PASSWORD }} From 22dfb06095769990175e8e57ca7b2f36e2ccafaf Mon Sep 17 00:00:00 2001 From: Dennis Kuijs Date: Fri, 24 Jul 2026 14:52:30 +0200 Subject: [PATCH 10/10] wip --- .github/workflows/keycloak.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/keycloak.yml b/.github/workflows/keycloak.yml index 3cd7cb2..d512184 100644 --- a/.github/workflows/keycloak.yml +++ b/.github/workflows/keycloak.yml @@ -57,8 +57,7 @@ jobs: cache: 'gradle' - name: Build with Gradle - run: | - ./gradlew installDist + run: ./gradlew installDist - name: Install QEMU uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0