docker-publish.yml

name: Docker

on:
  push:
    branches: [ "main" ]
    tags: [ "v*.*.*" ]
  workflow_dispatch:

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}   # may contain uppercase

jobs:
  build-test-push:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
      security-events: write
      id-token: write

    steps:
      
      - name: Legion Harden Runner
        uses: OpenSource-For-Freedom/Legion_runner@v1.0.51
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Normalize image name to lowercase
        id: repo
        run: |
          echo "name=$(echo '${{ env.IMAGE_NAME }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT

      - name: Install cosign (non-PR)
        if: github.event_name != 'pull_request'
        run: |
          set -euo pipefail
          COSIGN_VERSION="v2.2.4"
          ARCH=$(uname -m)
          case "$ARCH" in
            x86_64) COSIGN_ARCH=amd64 ;;
            aarch64) COSIGN_ARCH=arm64 ;;
            *) echo "Unsupported arch: $ARCH"; exit 1 ;;
          esac
          curl -fsSL "https://github.com/sigstore/cosign/releases/download/${COSIGN_VERSION}/cosign-linux-${COSIGN_ARCH}" -o /usr/local/bin/cosign
          chmod +x /usr/local/bin/cosign
          cosign version

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log into ${{ env.REGISTRY }}
        if: github.event_name != 'pull_request'
        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Compute next tag
        id: version
        shell: bash
        run: |
          set -euo pipefail
          git fetch --tags
          latest=$(git tag -l "v*.*.*" --sort=-v:refname | head -n1 || echo "")
          if [[ -z "${latest}" ]]; then
            next="v1.0.0"
          else
            version_part="${latest#v}"
            IFS='.' read -r major minor patch <<<"${version_part}" || {
              echo "ERROR: Failed to parse version: ${latest}"
              next="v1.0.0"
            }
            patch=$((patch + 1))
            next="v${major}.${minor}.${patch}"
          fi
          echo "next=${next}" >> "$GITHUB_OUTPUT"
          echo "Computed next version: ${next}"

      - name: Build image for tests (loaded locally)
        run: |
          echo "Building Docker image for testing..."
          for i in {1..3}; do
            if docker buildx build \
                --load \
                -t $REGISTRY/${{ steps.repo.outputs.name }}:ci-test \
                .; then
              echo "Docker build completed successfully"
              break
            fi
            if [ $i -eq 3 ]; then
              echo "ERROR: All Docker build attempts failed"
              exit 1
            fi
            echo "Retrying in 30 seconds..."
            sleep 30
          done

      - name: Push :ci-test image
        if: github.event_name != 'pull_request'
        run: |
          docker push $REGISTRY/${{ steps.repo.outputs.name }}:ci-test

      - name: Run hardening + smoke + STIG scan (root, entrypoint bypass)
        shell: bash
        env:
          IMAGE_CI: ghcr.io/${{ steps.repo.outputs.name }}:ci-test
          NAME: hardn-test-${{ github.run_id }}
        run: |
          set -euo pipefail
          docker create \
            --name "$NAME" \
            --user 0:0 \
            --entrypoint "" \
            "$IMAGE_CI" \
            /bin/bash -lc '
              set -euo pipefail
              apt-get update
              DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
                openscap-scanner ssg-debian
              rm -rf /var/lib/apt/lists/*
              [[ -x /usr/local/bin/deb.hardn.sh ]] && /usr/local/bin/deb.hardn.sh || true
              [[ -x /usr/local/bin/smoke_test.sh ]] && /usr/local/bin/smoke_test.sh || true
              CONTENT=$(ls /usr/share/xml/scap/ssg/content/ssg-debian*-ds.xml 2>/dev/null | sort -V | tail -n1 || true)
              if [[ -n "$CONTENT" ]]; then
                oscap xccdf eval \
                  --profile xccdf_org.ssgproject.content_profile_stig \
                  --report /tmp/stig_report.html \
                  --results /tmp/stig_results.xml \
                  "$CONTENT" || true
              else
                echo "<html><body><h1>STIG Scan Not Available</h1></body></html>" > /tmp/stig_report.html
                echo "<?xml version=\"1.0\"?><results><message>Not available</message></results>" > /tmp/stig_results.xml
              fi
            '
          docker start -a "$NAME"
          mkdir -p artifacts
          docker cp "$NAME":/tmp/stig_report.html artifacts/stig_report.html || true
          docker cp "$NAME":/tmp/stig_results.xml artifacts/stig_results.xml || true
          docker rm -f "$NAME" >/dev/null 2>&1 || true

      - name: Upload STIG artifacts
        uses: actions/upload-artifact@v7
        with:
          name: stig-scan-${{ steps.version.outputs.next }}
          path: artifacts/*

      - name: Docker metadata (tags/labels + annotations)
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ env.REGISTRY }}/${{ steps.repo.outputs.name }}
          tags: |
            type=raw,value=deb13
            type=raw,value=${{ steps.version.outputs.next }}
            type=sha
          labels: |
            org.opencontainers.image.title=HARDN-XDR (Debian, STIG/CISA)
            org.opencontainers.image.description=Multi-arch (amd64/arm64) hardened Debian 13 (Trixie) base with CIS-aligned defaults, non-root user, umask 027, baseline sysctl, FIPS-aligned TLS, file-integrity baseline, healthcheck, and read-only-rootfs friendly. Optional STIG tools (OpenSCAP+SSG) via WITH_STIG_TOOLS=1.
            org.opencontainers.image.vendor=HARDN-XDR Project
            org.opencontainers.image.licenses=Apache-2.0
            org.opencontainers.image.url=https://github.com/opensource-for-freedom/hardn_debian_docker_image
            org.opencontainers.image.source=https://github.com/opensource-for-freedom/hardn_debian_docker_image
          annotations: |
            org.opencontainers.image.description=Multi-arch (amd64/arm64) hardened Debian 13 (Trixie) base with CIS-aligned defaults, non-root user, umask 027, baseline sysctl, FIPS-aligned TLS, file-integrity baseline, healthcheck, and read-only-rootfs friendly. Optional STIG tools (OpenSCAP+SSG) via WITH_STIG_TOOLS=1.

      - name: Build and push Docker image (multi-arch)
        id: build-and-push
        uses: docker/build-push-action@v7
        with:
          context: .
          push: ${{ github.event_name != 'pull_request' }}
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          annotations: ${{ steps.meta.outputs.annotations }}
          provenance: false
          sbom: true
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Verify manifest
        if: github.event_name != 'pull_request'
        run: |
          docker buildx imagetools inspect $REGISTRY/${{ steps.repo.outputs.name }}:${{ steps.version.outputs.next }}

      - name: Sign the published Docker image (cosign keyless)
        if: ${{ github.event_name != 'pull_request' }}
        env:
          TAGS: ${{ steps.meta.outputs.tags }}
          DIGEST: ${{ steps.build-and-push.outputs.digest }}
        run: |
          echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

      - name: Generate SBOM (Syft)
        id: sbom
        uses: anchore/sbom-action@v0
        with:
          image: ${{ env.REGISTRY }}/${{ steps.repo.outputs.name }}@${{ steps.build-and-push.outputs.digest }}
          format: spdx-json
          artifact-name: sbom-spdx
          output-file: sbom.spdx.json

      - name: Upload SBOM artifact
        uses: actions/upload-artifact@v7
        with:
          name: sbom-spdx-${{ steps.version.outputs.next }}
          path: sbom.spdx.json

      - name: Create git tag
        if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
        run: |
          set -euo pipefail
          TAG_NAME="${{ steps.version.outputs.next }}"
          if git tag -l | grep -q "^${TAG_NAME}$"; then
            echo "::warning ::Tag ${TAG_NAME} already exists, skipping tag creation"
            exit 0
          fi
          echo "Creating and pushing tag: ${TAG_NAME}"
          git config --global user.name "github-actions[bot]"
          git config --global user.email "github-actions[bot]@users.noreply.github.com"
          git tag "${TAG_NAME}"
          git push origin "${TAG_NAME}"


      - name: Compose release notes (with header image)
        id: rel
        shell: bash
        run: |
          set -euo pipefail
          cat > release_body.md <<EOF
           ![HARDN-Docker](https://raw.githubusercontent.com/${{ github.repository }}/${{ steps.version.outputs.next }}/src/sources/C20B6DE6-87CA-4439-A74F-3CD2D4BF5A82.png)

           **HARDN-Docker ${{ steps.version.outputs.next }}** — Multi-arch (amd64/arm64) hardened Debian 13 (Trixie) base with CIS/STIG tooling.

           **Pull**
           \`\`\`bash
           docker pull ghcr.io/${{ steps.repo.outputs.name }}:${{ steps.version.outputs.next }}
           \`\`\`

           Full notes and docs in repo.
          EOF

      - name: Create GitHub Release
        if: github.ref == 'refs/heads/main'
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ steps.version.outputs.next }}
          body_path: release_body.md        
          generate_release_notes: false
          files: |
            artifacts/stig_report.html
            artifacts/stig_results.xml
            sbom.spdx.json
        continue-on-error: false 

      - name: Discord notification
        if: always()
        shell: bash
        env:
          WEBHOOK: ${{ secrets.DEV_UPDATES_DISCORD_WEBHOOK }}
        run: |
          STATUS="${{ job.status }}"
          VERSION="${{ steps.version.outputs.next }}"
          IMAGE_NAME="${{ steps.repo.outputs.name }}"
          MSG="https://github.com/${{ github.repository }}/releases/tag/${{ steps.version.outputs.next }}"
          GHCR_URL="ghcr.io/${IMAGE_NAME}:${{ steps.version.outputs.next }}"

          if command -v hardn-discord.sh >/dev/null 2>&1; then
            if [[ "$STATUS" == "success" ]]; then
              hardn-discord.sh "HARDN DOCKER RELEASED" "HARDN Docker ${VERSION} Published: $MSG" || true
            else
              hardn-discord.sh "HARDN DOCKER BUILD FAILED" "HARDN Docker build failed for ${VERSION} on branch ${{ github.ref_name }}" || true
            fi
          elif [[ -n "${WEBHOOK:-}" ]]; then
            COLOR=15105570  # Default gray
            [[ "$STATUS" == "success" ]] && COLOR=3066993 || true  # Green
            [[ "$STATUS" == "failure" ]] && COLOR=15158332 || true  # Red

            if [[ "$STATUS" == "success" ]]; then
              DESCRIPTION="**HARDN Docker Image Published**\\n**Image**: \`${GHCR_URL}\`\\n**Version**: \`${VERSION}\`\\n**Platforms**: \`linux/amd64, linux/arm64\`\\n**Status**: **${STATUS}** on branch \`${{ github.ref_name }}\`\\n\\n**Pull Command**:\\n\`docker pull ${GHCR_URL}\`"
            else
              DESCRIPTION="**HARDN Docker Build Failed**\\n**Version**: \`${VERSION}\`\\n**Status**: **${STATUS}** on branch \`${{ github.ref_name }}\`"
            fi

            curl -H "Content-Type: application/json" -X POST "$WEBHOOK" \
              -d "{\"embeds\":[{\"title\":\"HARDN DOCKER • ${{ github.repository }}\",\"description\":\"$DESCRIPTION\",\"color\":$COLOR,\"url\":\"$MSG\"}]}" || true
          fi