ci: add patch action first draft

Signed-off-by: r3drun3 <[email protected]>

.github/workflows/patch.yaml

@@ -0,0 +1,72 @@
+on: [push]
+
+jobs:
+    test:
+        runs-on: ubuntu-latest
+
+        strategy:
+          fail-fast: false
+          matrix:
+            # provide relevant list of images to scan on each run
+            images: ['docker.io/library/nginx:1.21.6', 'docker.io/openpolicyagent/opa:0.46.0']
+
+        steps:
+        - name: Set up Docker Buildx
+          uses: docker/setup-buildx-action@dedd61cf5d839122591f5027c89bf3ad27691d18
+
+        - name: Generate Trivy Report
+          uses: aquasecurity/trivy-action@69cbbc0cbbf6a2b0bab8dcf0e9f2d7ead08e87e4
+          with:
+            scan-type: 'image'
+            format: 'json'
+            output: 'report.json'
+            ignore-unfixed: true
+            vuln-type: 'os'
+            image-ref: ${{ matrix.images }}
+
+        - name: Check Vuln Count
+          id: vuln_count
+          run: |
+            report_file="report.json"
+            vuln_count=$(jq '.Results | length' "$report_file")
+            echo "vuln_count=$vuln_count" >> $GITHUB_OUTPUT
+
+        - name: Copa Action
+          if: steps.vuln_count.outputs.vuln_count != '0'
+          id: copa
+          uses: project-copacetic/[email protected]
+          with:
+            image: ${{ matrix.images }}
+            image-report: 'report.json'
+            patched-tag: 'patched'
+            buildkit-version: 'v0.11.6'
+            # optional, default is latest
+            copa-version: '0.3.0'
+
+        # - name: Login to Docker Hub
+        #   if: steps.copa.conclusion == 'success'
+        #   id: login
+        #   uses: docker/login-action@b4bedf8053341df3b5a9f9e0f2cf4e79e27360c6
+        #   with:
+        #     username: 'user'
+        #     password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+        # - name: Docker Push Patched Image
+        #   if: steps.login.conclusion == 'success'
+        #   run: |
+        #     docker push ${{ steps.copa.outputs.patched-image }}
+
+        - name: Save Patched Image Locally
+          if: steps.copa.conclusion == 'success'
+          run: |
+            original_image_name=$(echo "${{ matrix.images }}" | sed 's/\//_/g' | sed 's/:/_/')
+            docker save -o "${original_image_name}_patched.tar" ${{ steps.copa.outputs.patched-image }}
+            mv "${original_image_name}_patched.tar" patched/
+
+
+        - name: Upload Patched Image as Artifact
+          if: steps.copa.conclusion == 'success'
+          uses: actions/upload-artifact@v2
+          with:
+            name: patched-images
+            path: patched