build-containers.yaml

name: "build containers"

on:
  workflow_dispatch:
  push:
    branches:
      - master
      - develop
  pull_request:
    branches:
      - develop
      - master
  release:
    types: [published]

jobs:
  build-containers:
    runs-on: ubuntu-20.04

    permissions:
      packages: write
      contents: read
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results

    steps:
      - uses: actions/checkout@v4

      - name: Docker meta fedn
        id: meta1
        uses: docker/metadata-action@v4
        with:
          images: |
            docker.pkg.github.com/${{ github.repository }}/fedn
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v2
        with:
          registry: docker.pkg.github.com
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      

      - name: Build and push
        uses: docker/build-push-action@v4
        with:
          push: true #"${{ github.event_name != 'pull_request' }}"
          tags: ${{ steps.meta1.outputs.tags }}
          labels: ${{ steps.meta1.outputs.labels }}
          file: Dockerfile
      
      # if push to master of release, run trivy scan on the image
      - name: Trivy scan
        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
        uses: aquasecurity/trivy-action@0.28.0
        env:
          TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db,aquasec/trivy-db,ghcr.io/aquasecurity/trivy-db
          TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db,aquasec/trivy-java-db,ghcr.io/aquasecurity/trivy-java-db
        with:
          image-ref: ghcr.io/${{ github.repository }}/fedn:master
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: HIGH,CRITICAL
          vuln-type: 'os,library'
          github-pat: ${{ secrets.GITHUB_TOKEN }}
      
      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
        with:
          sarif_file: 'trivy-results.sarif'