build-and-push.yml

name: Build & Push
on:
  schedule:
    # https://github.com/aquasecurity/trivy-db/blob/db9bf07792afba73dceb20b99723c8af007da1f8/.github/workflows/cron.yml#L5
    # https://github.com/aquasecurity/trivy-java-db/blob/be4b443fed1db725fb1d21688567a5b644df9ea7/.github/workflows/cron.yml#L5
    - cron: '30 */6 * * *'
  push:
    branches:
      - main
  workflow_dispatch:
jobs:
  build-and-push:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::396667938998:role/trivy-lambda
          aws-region: us-east-1
      
      - name: Login to Amazon ECR
        uses: aws-actions/amazon-ecr-login@v2
        with:
          registry-type: public

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
        with:
          platforms: linux/amd64,linux/arm64

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: public.ecr.aws/t9f5l7n9/trivy-lambda:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max