container.yml

name: Container

# on:
#   release:
#     types: [published]

on:
  push:
    branches:
      - main
    tags:
      - '**'

env:
  IMAGE_NAME: pycryptobot
  DOCKER_FILE: Dockerfile
  DOCKER_BUILDKIT: 1
  # PLATFORM: linux/arm/v6,linux/arm/v7,linux/arm64,linux/amd64  <--  build fails with: docker build . --platform "linux/arm/v7"
  PLATFORM: linux/arm64,linux/amd64

jobs:
  # Build and push image to GitHub Packages.
  # See also https://docs.docker.com/docker-hub/builds/
  push:
    runs-on: ubuntu-latest
    if: github.event_name == 'push'

    steps:
      - uses: actions/checkout@v2

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v1

      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v1

      - name: Cache Docker layers
        uses: actions/cache@v2
        id: cache
        with:
          path: /tmp/.buildx-cache
          key: ${{ runner.os }}-buildx-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-buildx-
      - name: Log into registry
        run: echo "${{ secrets.PACKAGE_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin

      - name: Create Tags
        id: tags
        run: |
          IMAGE_ID=ghcr.io/${{ github.repository }}/$IMAGE_NAME
          # Change all uppercase to lowercase
          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
          # Strip git ref prefix from version
          VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
          # Use Docker `latest` tag convention
          [ "$VERSION" == "main" ] && VERSION=latest
          echo IMAGE_ID=$IMAGE_ID
          echo VERSION=$VERSION
          echo "::set-output name=IMAGE_ID::$IMAGE_ID"
          echo "::set-output name=VERSION::$VERSION"
      - name: Generate Docker Metadata
        id: meta
        uses: docker/metadata-action@v3
        with:
          images: ${{ steps.tags.outputs.IMAGE_ID }}

      - name: Build and Push Image
        uses: docker/build-push-action@v2
        with:
          build-args: REPO=${{ github.repository }}
          context: .
          cache-from: type=local,src=/tmp/.buildx-cache
          cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
          file: ${{ env.DOCKER_FILE }}
          platforms: ${{ env.PLATFORM }}
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

      - name: Inspect Image
        run: |
          # Inspect Image
          docker buildx imagetools inspect ${{ steps.tags.outputs.IMAGE_ID }}:${{ steps.tags.outputs.VERSION }}
      # Temp fix stops cache growing too big
      # https://github.com/docker/build-push-action/issues/252
      # https://github.com/moby/buildkit/issues/1896
      - name: Move cache
        run: |
          rm -rf /tmp/.buildx-cache
          mv /tmp/.buildx-cache-new /tmp/.buildx-cache
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: "${{ steps.tags.outputs.IMAGE_ID }}:${{ steps.tags.outputs.VERSION }}"
          format: "sarif"
          output: "trivy-results.sarif"
          ignore-unfixed: true
          exit-code: 0
          scan-type: "image"
          vuln-type: "os,library"
          severity: "CRITICAL,HIGH"

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v1
        with:
          sarif_file: 'trivy-results.sarif'