push_latest_image.yaml

name: Push images of new releases to Docker Hub

on:
    push:
        tags:
           - '*'

## GITHUB_TOKEN authentication
permissions:
  contents: write

jobs:
    buildandpush:
        runs-on: ubuntu-latest
        steps:
            # https://github.com/CycodeLabs/cimon-action
            - name: Cimon supply chain attack protection
              uses: cycodelabs/cimon-action@v0
              with:
                client-id: ${{ secrets.CIMON_CLIENT_ID }}
                secret: ${{ secrets.CIMON_SECRET }}
                prevent: true
                allowed-hosts: >
                  codeload.github.com
                  dl-cdn.alpinelinux.org
                  docker.io
                  ghcr.io
                  index.docker.io
                  nginx.org
                  packagist.org
                  pkg-containers.githubusercontent.com
                  production.cloudflare.docker.com
                  registry.yarnpkg.com
                  repo.yarnpkg.com

            - name: Checkout elabimg repo
              uses: actions/checkout@v3

            # https://github.com/marketplace/actions/docker-setup-buildx
            - name: Set up Docker Buildx
              uses: docker/setup-buildx-action@v2

            # https://github.com/docker/setup-qemu-action#usage
            - name: Set up QEMU
              uses: docker/setup-qemu-action@v2

            # https://github.com/docker/login-action#docker-hub
            - name: Login to Docker Hub
              uses: docker/login-action@v2
              with:
                username: ${{ secrets.DOCKER_HUB_USERNAME }}
                password: ${{ secrets.DOCKER_HUB_TOKEN }}

            # https://github.com/docker/build-push-action#multi-platform-image
            # https://docs.docker.com/build/ci/github-actions/cache/
            - name: Build latest release for all platforms and push to Docker Hub
              uses: docker/build-push-action@v4
              with:
                context: .
                platforms: linux/arm64,linux/amd64
                push: true
                cache-from: type=gha
                cache-to: type=gha,mode=max
                build-args: |
                    ELABFTW_VERSION=${{ github.ref_name }}
                tags: |
                    elabftw/elabimg:latest
                    elabftw/elabimg:${{ github.ref_name }}

            # VULN SCAN
            - name: Run Trivy vulnerability scanner
              uses: aquasecurity/trivy-action@master
              with:
                image-ref: elabftw/elabimg:${{ github.ref_name }}
                format: 'table'
                exit-code: '1'
                ignore-unfixed: true
                vuln-type: 'os,library'
                severity: 'CRITICAL,HIGH'

            - name: Run Trivy in GitHub SBOM mode and submit results to Dependency Graph
              uses: aquasecurity/trivy-action@master
              with:
                scan-type: 'fs'
                format: 'github'
                output: 'dependency-results.sbom.json'
                image-ref: '.'
                github-pat: ${{ secrets.GITHUB_TOKEN }}

            # build the IRD branch
            - name: Build IRD image
              uses: docker/build-push-action@v4
              with:
                context: .
                cache-from: type=gha
                cache-to: type=gha,mode=max
                platforms: linux/amd64
                push: true
                build-args: |
                    ELABFTW_VERSION=ird
                tags: |
                    elabftw/elabimg:ird-${{ github.ref_name }}