ci.yml

on:
  push:
    branches:
      - master
    paths:
      - "Dockerfile"
      - "docker-entrypoint.sh"
      - "config/**"
      - "test/**"
  pull_request:
    paths:
      - "Dockerfile"
      - "docker-entrypoint.sh"
      - "config/**"
      - "test/**"
  workflow_dispatch:

name: CI

env:
  IMAGE_NAME: ${{ github.repository }}

jobs:
  test:
    name: Test Docker image
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Generate cache references
        uses: int128/docker-build-cache-config-action@v1
        id: cache
        with:
          image: ghcr.io/${{ github.repository }}/cache-test
      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v2
      - name: Login to Github Container Registry
        uses: docker/login-action@v1
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build container locally
        if: steps.cache.outputs.cache-to != 0
        run: |
          docker buildx build -t test \
            --output type=docker \
            --cache-from ${{ steps.cache.outputs.cache-from }} \
            --cache-to ${{ steps.cache.outputs.cache-to }} .
      - name: Build container locally
        if: steps.cache.outputs.cache-to == 0
        run: |
          docker buildx build -t test \
            --output type=docker \
            --cache-from ${{ steps.cache.outputs.cache-from }} .
      - name: Run container test
        run: |
          docker run \
          -v "$(pwd)/test:/workspace" \
          --entrypoint /bin/bash \
          test -c 'cd /workspace && ./test.sh'
  push:
    name: Push Docker image
    runs-on: ubuntu-latest
    needs: [test]
    steps:
      - name: Set up QEMU for multi-arch builds
        uses: docker/setup-qemu-action@master
        with:
          platforms: all
      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@master
      - name: Login to Github Container Registry
        uses: docker/login-action@v1
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Login to DockerHub
        uses: docker/login-action@v1
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Extract metadata for Docker
        id: meta
        uses: docker/metadata-action@v3
        with:
          images: |
            ghcr.io/${{ env.IMAGE_NAME }}
            ${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha
      - name: Generate cache references
        uses: int128/docker-build-cache-config-action@v1
        id: cache
        with:
          image: ghcr.io/${{ github.repository }}/cache
      - name: Build and push
        id: build-and-push
        uses: docker/build-push-action@v2
        with:
          builder: ${{ steps.buildx.outputs.name }}
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: ${{ steps.cache.outputs.cache-from }}
          cache-to: ${{ steps.cache.outputs.cache-to }}
          push: true
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ghcr.io/${{ env.IMAGE_NAME }}@${{ steps.build-and-push.outputs.digest }}
          format: "sarif"
          ignore-unfixed: true
          severity: "CRITICAL,HIGH"
          output: "trivy-results.sarif"
      - name: Upload Trivy scan results
        uses: github/codeql-action/upload-sarif@v1
        with:
          sarif_file: "trivy-results.sarif"