build.yml

name: Build

on:
  push:
    branches: ["main"]
  pull_request:

jobs:
  build:
    name: Build ${{ matrix.service }}
    runs-on: ubuntu-latest
    strategy:
      matrix:
        service:
          - correctedforecaster
          - healthz
          - jsonfrontend
          - moxfrontend
          - rawdataforecaster
          - xmlfrontend
    steps:
      - uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build
        run: docker buildx build --platform linux/amd64,linux/arm64 -f ${{ matrix.service }}/build/package/Dockerfile .

  vulncheck:
    name: Vulnerability check
    needs: [build]
    runs-on: ubuntu-latest
    container:
      # Build/push the devcontainer image via the devcontainer.yml workflow when it changes.
      image: ghcr.io/${{ github.repository }}/devcontainer:latest
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v4
      - run: govulncheck ./...

  # trivy-scan:
  #   name: Trivy Dockerfile scan
  #   needs: [build]
  #   runs-on: ubuntu-latest
  #   container:
  #     image: aquasec/trivy
  #   steps:
  #     - uses: actions/checkout@v4
  #     - name: Scan all Dockerfiles
  #       run: |
  #         for dockerfile in */build/package/Dockerfile; do
  #           echo "Scanning $dockerfile"
  #           trivy fs --exit-code 1 --severity MEDIUM,HIGH,CRITICAL \
  #             --scanners vuln,secret,license,misconfig "$dockerfile"
  #         done