test.yml

---

on:  # yamllint disable-line rule:truthy
  pull_request:
    paths-ignore:
      - '**.md'

env:
  DOCKER_NAMESPACE: wayofdev/nginx
  GHCR_NAMESPACE: ghcr.io/wayofdev/docker-nginx

name: 🧪 Test Docker images

concurrency:
  group: "${{ github.workflow }}-${{ github.ref }}"
  cancel-in-progress: true

jobs:
  test:
    strategy:
      fail-fast: false
      matrix:
        os_name: ["alpine"]
        nginx_type: ["dev", "k8s"]
        builder: [{arch: "amd64", os: "ubuntu-latest"}]
    runs-on: ${{ matrix.builder.os }}
    steps:

      - name: 🌎 Set environment variables
        run: |
          tag="${{ matrix.nginx_type }}-${{ matrix.os_name }}-${{ matrix.builder.arch }}"
          target="nginx-${{ matrix.nginx_type }}-${{ matrix.os_name }}"
          echo "TARGET=${target}" >> "$GITHUB_ENV"
          echo "PLATFORM_CACHE_TAG=${tag}" >> "$GITHUB_ENV"

      - name: 📦 Check out the codebase
        uses: actions/checkout@v4.2.0

      - name: 🛠️ Install goss and dgoss
        uses: e1himself/goss-installation-action@v1.2.1
        with:
          version: v0.4.6

      - name: 🤖 Generate dist files
        run: ansible-playbook src/playbook.yml -l ${{ matrix.nginx_type }}-${{ matrix.os_name }}

      - name: 🖥️ Setup docker QEMU
        uses: docker/setup-qemu-action@v3

      - name: 🛠️ Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          buildkitd-flags: "--debug"

      - name: 🔑 Login to docker-hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_TOKEN }}

      - name: 🔑 Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: 🐳 Extract docker meta data
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ${{ env.DOCKER_NAMESPACE }}
            ${{ env.GHCR_NAMESPACE }}
          tags: |
            type=raw,event=branch,value=latest
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
          flavor: |
            latest=false
            prefix=${{ matrix.nginx_type }}-${{ matrix.os_name }}-

      - name: 🧪 Bake image for testing
        id: bake
        uses: docker/bake-action@v5.8.0
        with:
          targets: ${{ env.TARGET }}
          files: |
            ./docker-bake.hcl
            ${{ steps.meta.outputs.bake-file }}
          push: false
          set: |
            *.tags=
            *.platform=linux/${{ matrix.builder.arch }}
            *.cache-from=type=gha,scope=build-${{ env.PLATFORM_CACHE_TAG }}
            *.cache-to=type=gha,scope=build-${{ env.PLATFORM_CACHE_TAG }}
            *.output=type=docker,"name=${{ env.DOCKER_NAMESPACE }},${{ env.GHCR_NAMESPACE }}",name-canonical=true

      - name: 🧪 Test Docker image
        run: |
          export IMAGE_TEMPLATE=${{ matrix.nginx_type }}-${{ matrix.os_name }}
          export IMAGE_TAG=${{ env.DOCKER_NAMESPACE }}:latest
          make test

      - name: 🔍 Run Docker Scout
        id: docker-scout
        uses: docker/scout-action@v1
        with:
          command: cves,recommendations
          ignore-unchanged: true
          only-fixed: true
          only-severities: critical,high
          keep-previous-comments: true
          github-token: ${{ secrets.GITHUB_TOKEN }}
          dockerhub-user: ${{ secrets.DOCKER_USERNAME }}
          dockerhub-password: ${{ secrets.DOCKER_TOKEN }}

...