patch.yaml

name: patch

on:
  push:
    paths:
      - '**/*'
      - '!README.md'

jobs:
    immunize:
        runs-on: ubuntu-latest
        strategy:
          fail-fast: false
          matrix:
            # provide relevant list of images to scan on each run
            images: ['docker.io/library/nginx:1.21.6', 'docker.io/openpolicyagent/opa:0.46.0']

        outputs:
          # Expose the 'images' array as an output
          images: ${{ matrix.images }}

        steps:

        - name: Checkout Repository
          uses: actions/checkout@v2

        - name: Set up Docker Buildx
          uses: docker/setup-buildx-action@dedd61cf5d839122591f5027c89bf3ad27691d18

        - name: Generate Trivy Report
          uses: aquasecurity/trivy-action@69cbbc0cbbf6a2b0bab8dcf0e9f2d7ead08e87e4
          with:
            scan-type: 'image'
            format: 'json'
            output: 'report.json'
            ignore-unfixed: true
            vuln-type: 'os'
            image-ref: ${{ matrix.images }}

        - name: Check Vuln Count
          id: vuln_count
          run: |
            report_file="report.json"
            vuln_count=$(jq '.Results | length' "$report_file")
            echo "vuln_count=$vuln_count" >> $GITHUB_OUTPUT

        - name: Set Tag
          id: set_tag
          run: echo "::set-env name=PATCHED_TAG::$(echo "${{ matrix.images }}" | cut -d':' -f2 | cut -d'/' -f2 | sed 's/[^0-9.]*//g')-immunized"

        - name: Copa Action
          if: steps.vuln_count.outputs.vuln_count != '0'
          id: copa
          uses: project-copacetic/copa-action@v1.0.0
          with:
            image: ${{ matrix.images }}
            image-report: 'report.json'
            patched-tag: ${{ env.PATCHED_TAG }}
            buildkit-version: 'v0.11.6'
            # optional, default is latest
            copa-version: '0.3.0'

        - name: Log into ghcr
          if: steps.copa.conclusion == 'success'
          id: login
          uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d
          with:
            registry: ghcr.io
            username: ${{ github.actor }}
            password: ${{ secrets.GITHUB_TOKEN }}

        - name: Tag Image for GHCR
          if: steps.login.conclusion == 'success'
          run: |
            docker tag ${{ steps.copa.outputs.patched-image }} ghcr.io/r3drun3/immunize/${{ steps.copa.outputs.patched-image }}


        - name: Docker Push Patched Image
          id: push
          if: steps.login.conclusion == 'success'
          run: |
            docker push ghcr.io/r3drun3/immunize/${{ steps.copa.outputs.patched-image }}

        - name: Write Artifacts
          run: |
            echo ${{ matrix.images }} >> outputs/${{ matrix.images }}.txt

        - name: Upload artifacts
          uses: actions/upload-artifact@v3
          with:
            name: outputs
            path: outputs/*.txt

    send-mail-report:
      runs-on: ubuntu-latest
      needs: immunize
      steps:
        - name: Checkout Repository
          uses: actions/checkout@v2

        - uses: actions/checkout@v3
        - name: Load outputs
          uses: actions/download-artifact@v3
          with:
            name: outputs
            path: outputs

        - run: |
            ls outputs
            cat outputs/*.txt

        # Access the 'images' array from the 'immunize' job outputs
        - name: Set PATCHED_IMAGES
          id: set_patched_images
          run: |
            IMAGES="${{ needs.immunize.outputs.images }}"
            echo "PATCHED_IMAGES=${IMAGES}" >> $GITHUB_ENV
            echo "Patched images: $IMAGES" # Print for debugging
          shell: bash

        - name: Send Mail Report
          run: |
            python $GITHUB_WORKSPACE/send_mail_report.py
          env:
            EMAIL_RECIPIENTS: ${{ secrets.EMAIL_RECIPIENTS }}
            EMAIL_ADDRESS: ${{ secrets.EMAIL_ADDRESS }}
            EMAIL_PASSWORD: ${{ secrets.EMAIL_PASSWORD }}
            PATCHED_IMAGES: ${{ env.PATCHED_IMAGES }}