docker.yml

name: docker

on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'push' && github.run_number || github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  docker:
    name: Build Docker image
    runs-on: ubuntu-latest
    strategy:
      matrix:
        app:
          - synchronizer
          - proxy
        fips_mode:
          - enabled
          - disabled
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup QEMU
        uses: docker/setup-qemu-action@v3
        with:
          platforms: amd64,arm64

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Dockerhub
        uses: docker/login-action@v3
        with:
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_RO_TOKEN }}

      - name: Login to Artifactory
        if: ${{ github.event_name == 'push' }}
        uses: docker/login-action@v3
        with:
          registry: ${{ vars.ARTIFACTORY_DOCKER_REGISTRY }}
          username: ${{ vars.ARTIFACTORY_DOCKER_USER }}
          password: ${{ secrets.ARTIFACTORY_DOCKER_PASS }}

      - name: Get version
        run: echo "VERSION=$(awk '/^const Version/{gsub(/"/, "", $4); print $4}' splitio/version.go)" >> $GITHUB_ENV

      - name: Docker Build and Push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: docker/Dockerfile.${{ matrix.app }}
          push: ${{ github.event_name == 'push' }}
          platforms: linux/amd64,linux/arm64
          tags: ${{ vars.ARTIFACTORY_DOCKER_REGISTRY }}/split-${{ matrix.app }}${{ matrix.fips_mode == 'enabled' && '-fips' || ''}}:${{ env.VERSION }},${{ vars.ARTIFACTORY_DOCKER_REGISTRY }}/split-${{ matrix.app }}${{ matrix.fips_mode == 'enabled' && '-fips' || '' }}:latest
          build-args: |
            FIPS_MODE=${{ matrix.fips_mode }}

  lacework:
    name: Scan Docker image
    if: ${{ github.event_name == 'pull_request' }}
    runs-on: ubuntu-latest
    strategy:
      matrix:
        app:
          - synchronizer
          - proxy
        fips_mode:
          - enabled
          - disabled
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Get version
        run: echo "VERSION=$(awk '/^const Version/{gsub(/"/, "", $4); print $4}' splitio/version.go)" >> $GITHUB_ENV

      - name: Login to Dockerhub
        uses: docker/login-action@v3
        with:
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_RO_TOKEN }}

      - name: Docker Build and Push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: docker/Dockerfile.${{ matrix.app }}
          push: false
          tags: ${{ vars.ARTIFACTORY_DOCKER_REGISTRY }}/split-${{ matrix.app }}${{ matrix.fips_mode == 'enabled' && '-fips' || ''}}:${{ env.VERSION }}
          build-args: |
            FIPS_MODE=${{ matrix.fips_mode }}

      - name: Scan container using Lacework
        uses: lacework/lw-scanner-action@v1.4.3
        with:
          LW_ACCOUNT_NAME: ${{ vars.LW_ACCOUNT_NAME }}
          LW_ACCESS_TOKEN: ${{ secrets.LW_ACCESS_TOKEN }}
          IMAGE_NAME: ${{ vars.ARTIFACTORY_DOCKER_REGISTRY }}/split-${{ matrix.app }}${{ matrix.fips_mode == 'enabled' && '-fips' || ''}}
          IMAGE_TAG: ${{ env.VERSION }}
          SAVE_RESULTS_IN_LACEWORK: true
          RESULTS_IN_GITHUB_SUMMARY: true