container-build-apache.yaml

---
name: Create and publish a apache image

permissions:
  actions: read
  contents: read
  id-token: write
  packages: write
  pull-requests: write
  security-events: write

on:
  pull_request:
    paths:
      - .github/workflows/container-build-apache.yaml
      - ContainerFiles/apache
  schedule:
    - cron: '0 0 * * 0'  # Run Weekly at midnight UTC
  workflow_dispatch:
    inputs:
      apache-mod-wsgi-version:
        description: 'Version of Apache mod_wsgi to use'
        required: true
        default: "master"
        type: choice
        options:
          - "master"
          - "5.0.2"

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}/apache
  # NOTE(cloudnull): This is used to parse the workflow_dispatch inputs, sadly the inputs are not available in the
  #                  workflow_dispatch event, so they're being stored in the environment variables. This is a
  #                  workaround until there's a better way to handle this.
  mod_wsgi: >
    ["5.0.2"]
jobs:
  init:
    runs-on: ubuntu-latest
    outputs:
      apache-mod-wsgi-version: ${{ steps.generate-matrix.outputs.mod_wsgi }}
    steps:
      - name: generate-matrix
        id: generate-matrix
        run: |
          if [ "${{ github.event_name == 'workflow_dispatch' }}" = "true" ]; then
            mod_wsgi="$(echo '${{ github.event.inputs.apache-mod-wsgi-version }}' | jq -R '[select(length>0)]' | jq -c '.')"
          fi
          echo "mod_wsgi=${mod_wsgi:-${{ env.mod_wsgi }}}" >> $GITHUB_OUTPUT
  build-and-push-image:
    needs:
      - init
    strategy:
      matrix:
        apache-mod-wsgi-version: ${{ fromJSON(needs.init.outputs.apache-mod-wsgi-version) }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Dynamically set MY_DATE environment variable
        run: echo "MY_DATE=$(date +%s)" >> $GITHUB_ENV
      - name: Normalize image repository name
        run: echo "IMAGE_NAME=$(echo "${IMAGE_NAME}" | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV
      - name: Dynamically set environment variables
        run: |
          VERSION=$(echo -n "${{ matrix.apache-mod-wsgi-version }}" | awk -F'/' '{($2=="" ? x=$1 : x=$2); print x}')
          echo "OS_VERSION_PARSE=${VERSION}" >> $GITHUB_ENV
          NAME=$(echo -n "${{ env.IMAGE_NAME }}" | awk -F'/' '{print $NF}')
          echo "CATEGORY_NAME=${VERSION}-${NAME}" >> $GITHUB_ENV
      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
      - name: Build and push Docker image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ContainerFiles/apache
          push: false
          load: true
          cache-from: type=gha
          cache-to: type=gha,mode=max
          tags: |
            ${{ env.IMAGE_NAME }}:local
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            MOD_WSGI_VERSION=${{ matrix.apache-mod-wsgi-version }}
            CACHEBUST=${{ github.sha }}
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@0.35.0  # using latest trivy scanner
        if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }}
        with:
          image-ref: '${{ env.IMAGE_NAME }}:local'
          format: 'sarif'
          output: 'trivy-results.sarif'
          ignore-unfixed: true
          severity: 'CRITICAL,HIGH'
      - name: Upload Trivy scan results to GitHub Security tab
        continue-on-error: true
        if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }}
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'
          category: "${{ env.CATEGORY_NAME }}"
      - name: Run Trivy scanner
        uses: aquasecurity/trivy-action@0.35.0  # using latest trivy scanner
        if: ${{ github.event_name == 'pull_request' }}
        with:
          image-ref: '${{ env.IMAGE_NAME }}:local'
          output: trivy.txt
          ignore-unfixed: true
          severity: 'CRITICAL,HIGH'
      - name: Create trivy output file in markdown format
        if: ${{ github.event_name == 'pull_request' }}
        run: |
          if [[ -s trivy.txt ]]; then
              echo "### Security Output" > trivy-output.txt
              echo '```terraform' >> trivy-output.txt
              cat trivy.txt >> trivy-output.txt
              echo '```' >> trivy-output.txt
          fi
      - name: Publish Trivy Output to Summary
        if: ${{ github.event_name == 'pull_request' }}
        run: |
          if [[ -s trivy-output.txt ]]; then
            {
              cat trivy-output.txt
            } >> $GITHUB_STEP_SUMMARY
          fi
      - name: Build and push Docker image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ContainerFiles/apache
          push: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.MY_DATE }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            MOD_WSGI_VERSION=${{ matrix.apache-mod-wsgi-version }}
            CACHEBUST=${{ github.sha }}