release.yml

name: goreleaser

on:
  push:
    tags:
      - '*'

jobs:
  build-and-push-docker-image:
    runs-on: ubuntu-latest
    name: Docker Build, Tag, Push
    steps:
    -
      name: Checkout
      uses: actions/checkout@v4

    -
      name: Log in to ghcr
      uses: docker/login-action@v3
      with:
        registry: ghcr.io
        username: ${{ github.repository_owner }}
        password: ${{ github.token }}

    -
      name: Login to DockerHub
      uses: docker/login-action@v3
      with:
        username: ${{ secrets.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_TOKEN }}

    -
      if: startsWith(github.ref, 'refs/heads/master')
      run: echo "TAG=latest" >> $GITHUB_ENV

    -
      if: startsWith(github.ref, 'refs/tags')
      run: echo "TAG=$(git describe --tags)" >> $GITHUB_ENV

    -
      name: build image
      uses: docker/build-push-action@v5
      with:
        context: ./docker
        file: ./docker/Dockerfile
        build-args: TAG=${{ env.TAG }}
        push: false
        tags: |
          ${{ github.repository }}:latest
          ${{ github.repository }}:${{ env.TAG }}
          ghcr.io/${{ github.repository }}:latest
          ghcr.io/${{ github.repository }}:${{ env.TAG }}

    - name: trivy image scan
      uses: aquasecurity/trivy-action@0.13.1
      with:
        image-ref: ${{ github.repository }}:latest
        exit-code: 0
        severity: UNKNOWN,LOW,MEDIUM

    -
      name: push image
      uses: docker/build-push-action@v5
      with:
        context: ./docker
        file: ./docker/Dockerfile
        build-args: TAG=${{ env.TAG }}
        push: true
        tags: |
          ${{ github.repository }}:latest
          ${{ github.repository }}:${{ env.TAG }}
          ghcr.io/${{ github.repository }}:latest
          ghcr.io/${{ github.repository }}:${{ env.TAG }}