build.yml

# Copyright 2018-2020 The OpenEBS Authors. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
name: build

on:
  push:
    branches:
      - 'main'

jobs:
  images:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - image: linux-utils
          - image: alpine-sh
          - image: alpine-bash
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set Image Org
        # sets the default IMAGE_ORG to openebs
        run: |
          [ -z "${{ secrets.IMAGE_ORG }}" ] && IMAGE_ORG=openebs || IMAGE_ORG=${{ secrets.IMAGE_ORG}}
          echo "IMAGE_ORG=${IMAGE_ORG}" >> $GITHUB_ENV

      - name: Set CI Tag
        run: |
          BRANCH="${GITHUB_REF##*/}"
          CI_TAG=${BRANCH#v}-ci
          if [ ${BRANCH} = "main" ]; then
            CI_TAG="ci"
          fi
          echo "TAG=${CI_TAG}" >> $GITHUB_ENV

      - name: Set Build Date
        id: date
        run: |
          echo "DATE=$(date -u +'%Y-%m-%dT%H:%M:%S%Z')" >> $GITHUB_OUTPUT

      - name: Docker meta
        id: docker_meta
        uses: docker/metadata-action@v4
        with:
          # add each registry to which the image needs to be pushed here
          images: |
            ${{ env.IMAGE_ORG }}/${{ matrix.image }}
            quay.io/${{ env.IMAGE_ORG }}/${{ matrix.image }}
            ghcr.io/${{ env.IMAGE_ORG }}/${{ matrix.image }}
          tags: |
            type=raw,value=latest,enable=false
            type=raw,value=${{ env.TAG }}

      - name: Print Tags
        run: |
          echo "${{ steps.docker_meta.outputs.tags }}"

      - name: Setup QEMU
        uses: docker/setup-qemu-action@v3
        with:
          platforms: all

      - name: Setup Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v3
        with:
          version: v0.13.1

      - name: Login to DockerHub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Login to Quay
        uses: docker/login-action@v3
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_TOKEN }}

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build & Push Image
        uses: docker/build-push-action@v5
        with:
          file: ./dockerfiles/${{ matrix.image }}/Dockerfile
          push: true
          platforms: linux/amd64, linux/arm64, linux/arm/v7, linux/ppc64le
          tags: |
            ${{ steps.docker_meta.outputs.tags }}
          build-args: |
            DBUILD_DATE=${{ steps.date.outputs.DATE }}
            DBUILD_REPO_URL=https://github.com/openebs/linux-utils
            DBUILD_SITE_URL=https://openebs.io

  trivy:
    runs-on: ubuntu-latest
    needs: ['images']
    strategy:
      fail-fast: false
      matrix:
        include:
          - image: linux-utils
          - image: alpine-sh
          - image: alpine-bash
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          # the tag will be always ci since only main branch is present
          # in this repository
          image-ref: 'openebs/${{ matrix.image }}:ci'
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          severity: 'CRITICAL,HIGH'