docker-image.yml

name: Build Docker Image CI

on:
  workflow_dispatch:

env:
  IMAGE_NAME: python-api

jobs:
  build:
    name: Build and Push Image
    runs-on: ubuntu-20.04
    permissions:
      packages: write
      contents: read
    outputs:
      IMAGE_ID: ${{ steps.push.outputs.IMAGE_ID }}
      VERSION: ${{ steps.push.outputs.VERSION }}

    steps:
      - uses: actions/checkout@v4
      - name: Build image
        run: docker build . --file Dockerfile --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
      - name: Log in to registry
        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin

      - name: Push image
        id: push
        run: |
          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')

          VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')


          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')

          [ "$VERSION" == "master" ] && VERSION=latest
          echo "IMAGE_ID=$IMAGE_ID" >> $GITHUB_OUTPUT
          echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
          echo image $IMAGE_ID:$VERSION
          docker push $IMAGE_ID:$VERSION
          
  secyrity:
    name: Security Check
    needs: build
    runs-on: ubuntu-20.04
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
    steps:
      - run: echo image_id $IMAGE_ID:$VERSION
        env:
          IMAGE_ID: ${{ needs.build.outputs.IMAGE_ID }}
          VERSION: ${{ needs.build.outputs.VERSION }}
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe
        with:
          image-ref: '${{ needs.build.outputs.IMAGE_ID }}:${{ needs.build.outputs.VERSION }}'
          format: 'template'
          template: '@/contrib/sarif.tpl'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results.sarif'