docker-image.yaml

name: Docker Image CI

on:
  push:
    branches: ["*"]
    tags: ["*"]
  pull_request:

jobs:
  build:
    runs-on: ubuntu-20.04
    permissions:
      contents: read
      security-events: write
      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
      packages: read
    steps:
      - uses: actions/checkout@v3
      - name: Generate Docker metadata
        id: meta
        uses: docker/metadata-action@v4
        with:
          images: |
            docker.io/${{ github.repository }}
          tags: |
            type=schedule
            type=ref,event=branch
            type=ref,event=branch,enable=true,priority=600,suffix=-{{sha}}-{{date 'YYYYMMDD-hhmmss'}}
            type=ref,event=pr
            type=ref,event=tag
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=sha
          flavor: |
            latest=false
      - name: Get Branch Name
        id: extract_branch
        run: |
          echo "branch=$(echo sha-${GITHUB_SHA::7})" >> $GITHUB_OUTPUT
      - name: Branch Name
        run: |
          echo ${{ steps.extract_branch.outputs.branch }}
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v2
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2
      # - name: Run Trivy vulnerability scanner in repo mode
      #   uses: aquasecurity/trivy-action@master
      #   with:
      #     scan-type: "fs"
      #     ignore-unfixed: true
      #     format: "sarif"
      #     output: "trivy-results.sarif"
      #     severity: "HIGH,CRITICAL"
      # - run: |
      #     cat trivy-results.sarif
      # - name: Upload Trivy scan results to GitHub Security tab
      #   uses: github/codeql-action/upload-sarif@v2
      #   with:
      #     sarif_file: "trivy-results.sarif"
      #     wait-for-processing: true
      - name: Login to Docker Hub
        if: GitHub.event_name != 'pull_request'
        uses: docker/login-action@v2
        with:
          registry: docker.io
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}
      - name: Build Docker Image
        uses: docker/build-push-action@v4
        with:
          context: .
          load: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: "docker.io/${{ github.repository }}:${{ steps.extract_branch.outputs.branch }}"
          format: "sarif"
          output: "trivy-results.sarif"
          severity: "HIGH,CRITICAL"
          wait-for-processing: true
      - run: |
          cat trivy-results.sarif
      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: "trivy-results.sarif"
          wait-for-processing: true
      - name: Push
        uses: docker/build-push-action@v4
        with:
          context: .
          push: ${{ GitHub.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}