build.yml

name: Build and push docker image

on:
  push:
    tags: ['*']
    branches: ["dev"]
    paths-ignore:
      - README.md
      - LICENSE
      - .github/workflows/update-dockerhub-desc.yml
      - .github/workflows/test-pr.yml

env:
  IMAGE_REGISTRY: ${{ vars.REGISTRY_PUBLIC }}
  #<account>/<repo>
  IMAGE_NAME: ${{ github.repository }}
  TEST_TAG: test-build

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Prepare
        id: prepare
        run: |
          DOCKER_PLATFORMS=${{ vars.CONTAINER_ARCH }}

          VERSION=${GITHUB_REF#refs/*/}
          TAGS="${{ env.IMAGE_NAME }}:${VERSION}"

          if [[ $GITHUB_REF == refs/tags/* ]]; then
            TAGS="$TAGS,${{ env.IMAGE_NAME }}:latest"
          fi
          
          for TAG in $(echo $TAGS | sed 's/,/ /g'); do
            TAGS="$TAGS,quay.io/$TAG"
          done

          echo "platforms=${DOCKER_PLATFORMS}" >> $GITHUB_OUTPUT
          echo "tags=${TAGS}" >> $GITHUB_OUTPUT

      - name: Set up QEMU
        id: qemu
        uses: docker/setup-qemu-action@v3
        with:
          image: tonistiigi/binfmt:latest
          platforms: all

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        id: buildx

      - name: Login to DockerHub
        uses: docker/login-action@v3
        with:
          registry: ${{ env.IMAGE_REGISTRY }}
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Login to Quay.io
        uses: docker/login-action@v3
        with:
          registry: quay.io
          username: ${{ secrets.QUAYIO_USERNAME }}
          password: ${{ secrets.QUAYIO_TOKEN }}

      - name: Build and Test
        run: |
          export TEST_IMAGE_NAME=${{ env.IMAGE_NAME }}:${{ env.TEST_TAG }}
          docker compose --file docker-compose.test.yml up --exit-code-from sut -t 10 --build

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'docker.io/${{ env.IMAGE_NAME }}:${{ env.TEST_TAG }}'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'
          exit-code: 0
        env:
          TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'

      - name: Run the Anchore scan action
        uses: anchore/scan-action@v5
        id: anchore-scan
        with:
          image: 'docker.io/${{ env.IMAGE_NAME }}:${{ env.TEST_TAG }}'
          output-format: sarif
          fail-build: false

      - name: Upload Anchore Scan Report
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ steps.anchore-scan.outputs.sarif }}

      - name: Get changed container files
        id: changed-files
        uses: tj-actions/changed-files@v45
        with:
          files: |
            rootfs/**
            Dockerfile

      - name: Determine release
        id: new-release
        run: |
          echo "Any container files changed? ${{ steps.changed-files.outputs.any_changed }}"
          echo "Changed files: ${{ steps.changed-files.outputs.all_changed_files }}"

          if [ "${{ steps.changed-files.outputs.any_changed }}" = 'true' ] || [[ $GITHUB_REF == refs/tags/* ]]
          then
            echo "required=true" >> $GITHUB_OUTPUT
          else
            echo "required=false" >> $GITHUB_OUTPUT
          fi

      - name: Build and push
        if: steps.new-release.outputs.required == 'true'
        uses: docker/build-push-action@v6
        with:
          context: .
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.prepare.outputs.tags }}
          platforms: ${{ steps.prepare.outputs.platforms }}
          provenance: false