docker-test.yml

name: Dockerfile

on:
  push:
    branches: [ main ]
    paths:
      - Dockerfile
  pull_request:
    paths:
      - Dockerfile
    types: [opened, synchronize]

jobs:
  build:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        stage: [
          "final",
          "initcontainer"
        ]
    outputs:
      image: ${{ steps.build.outputs.imageid }}
    steps:
      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3

      - name: Build Docker image
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
        id: build
        with:
          secrets: github_token=${{ secrets.GITHUB_TOKEN }}
          load: true
          build-args: CI=true
          cache-from: type=gha,scope=extapp-api
          cache-to: type=gha,mode=max,scope=extapp-api
          target: ${{ matrix.stage }}
          push: false

      - name: Export docker image as tar
        run: docker save -o ${{ steps.build.outputs.imageid }}.tar ${{ steps.build.outputs.imageid }}

      - name: Scan Docker image for CVEs
        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # 0.34.2
        with:
          input: ${{ steps.build.outputs.imageid }}.tar
          format: 'sarif'
          output: 'trivy-results.sarif'
          limit-severities-for-sarif: true
          ignore-unfixed: true
          severity: 'CRITICAL,HIGH'
          github-pat: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload scan results to GitHub Security
        uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3
        if: always() && hashFiles('trivy-results.sarif') != ''
        with:
          sarif_file: 'trivy-results.sarif'