docker.image.yml

name: Docker Image CI

on:
  push:
    branches:
      - $default-branch
      - development
      - master
    tags:
      - '*.*.*-*'
  # Run tests for any PRs
  pull_request:
  schedule:
    - cron: '43 10 * * 4'

env:
  IMAGE_NAME: infcloud

jobs:
  codespell:
    name: codespell
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v2
      - name: Codespell
        uses: codespell-project/actions-codespell@master
        with:
          skip: .git
          check_filenames: true
          check_hidden: true
  super-linter:
    name: super-linter
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v2
      - name: Lint Code Base
        uses: github/super-linter@v4.7.3
        env:
          DEFAULT_BRANCH: master
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  shiftleft:
    name: shiftleft
    runs-on: ubuntu-latest
    steps:
      - name: Perform ShiftLeft Scan
        uses: ShiftLeftSecurity/scan-action@master
        env:
          WORKSPACE: ""
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SCAN_AUTO_BUILD: true
        with:
          output: reports
          # Scan auto-detects the languages in your project. To override uncomment the below variable and set the type
          # type: credscan,java
          # type: python
      - name: Upload report
        uses: github/codeql-action/upload-sarif@v1
        with:
          sarif_file: reports
  build:
    needs:
      - codespell
      - super-linter
      - shiftleft
    runs-on: ubuntu-latest
    services:
      registry:
        image: registry:2
        ports:
          - 5000:5000
    steps:
      - uses: actions/checkout@v2
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v1
        with:
          platforms: linux/amd64
      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v1
        with:
          driver-opts: network=host
      - name: Build the Docker image
        id: docker_test
        uses: docker/build-push-action@v2
        with:
          builder: ${{ steps.buildx.outputs.name }}
          push: true
          tags: localhost:5000/foobar/${{ env.IMAGE_NAME }}
          context: .
          file: ./Dockerfile
          platforms: linux/amd64
          build-args: |
            BUILD_DATE="$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
            BUILD_VERSION="$(git describe --tags)"
            VCS_REF="$(git rev-parse --short HEAD)"
            VCS_URL="$(git config --get remote.origin.url)"
            VCS_BRANCH="$(git rev-parse --abbrev-ref HEAD)"
      - name: Inspect the Docker image
        run: |
          docker buildx imagetools inspect localhost:5000/foobar/${{ env.IMAGE_NAME }}
      - name: Compose up
        run: docker-compose -f .github/docker-compose.yml up -d
      - name: Check running containers
        run: docker ps -a
      - name: Check logs
        run: docker-compose -f .github/docker-compose.yml logs
      - name: Test the Docker image
        run: if ! [ "$(docker ps -a | grep "${IMAGE_NAME}" | head -1 | grep -c "${IMAGE_NAME}")" = "1" ]; then exit 1; fi
      - name: Compose down
        run: docker-compose -f .github/docker-compose.yml down
      - name: Scan image with Container Scan
        uses: Azure/container-scan@v0
        env:
          DOCKER_CONTENT_TRUST: 1
        with:
          image-name: localhost:5000/foobar/${{ env.IMAGE_NAME }}
          severity-threshold: HIGH
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: localhost:5000/foobar/${{ env.IMAGE_NAME }}
          format: 'template'
          template: '@/contrib/sarif.tpl'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'
      - name: Run the Anchore scan action itself with GitHub Advanced Security code scanning integration enabled
        uses: anchore/scan-action@main
        with:
          image: localhost:5000/foobar/${{ env.IMAGE_NAME }}
          acs-report-enable: true
      - name: Move reports
        run: mkdir -p sarif-reports && cp ./*results.sarif ./sarif-reports/
      - name: Upload Reports
        uses: github/codeql-action/upload-sarif@v1
        with:
          sarif_file: 'sarif-reports'