pipeline.yaml

name: operator pipeline

on:
  push:
    paths:
      - 'api/**.go'
      - 'config/**.go'
      - 'controllers/**.go'
      - '**.go'
      - 'Dockerfile'


jobs:
  
  buildDocker:
    runs-on: ubuntu-latest
    env:
      APP_NAME: adcs-issuer

    steps:
    - uses: actions/checkout@v2
      name: Checkout
      with:

        ref: dev
      
    - name: Docker meta
      id: meta
      uses: docker/metadata-action@v4

      with:
      # list of Docker images to use as base name for tags
        images: |
          djkormo/adcs-issuer
        # generate Docker tags based on the following events/attributes
        tags: |
          type=schedule
          type=ref,event=branch
          type=ref,event=pr
          type=semver,pattern={{version}}
          type=semver,pattern={{major}}.{{minor}}
          type=semver,pattern={{major}}
          type=sha
          
    - name: Login to DockerHub
      if: github.event_name != 'pull_request'

      uses: docker/login-action@v2 

      with:
        username: ${{ secrets.DOCKER_USERNAME }}
        password: ${{ secrets.DOCKER_PASSWORD }}
        
    - name: Build and push

      uses: docker/build-push-action@v3

      with:
        context: .
        push: ${{ github.event_name != 'pull_request' }}
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
      

    - name: Run Trivy vulnerability scanner
      uses: aquasecurity/trivy-action@master
      with:

        image-ref: djkormo/adcs-issuer:dev

        format: 'table'
        exit-code: '1'
        ignore-unfixed: true
        vuln-type: 'os,library'
        severity: 'CRITICAL,HIGH'