call-docker-build.yaml

---
name: call-docker-build

on:
  push:
    branches:
      - 'main'
    paths:
      - 'Dockerfile'
      - '.github/workflows/call-docker-build.yaml'
      - 'docker-entrypoint.sh'
  pull_request:
    paths:
      - 'Dockerfile'
      - '.github/workflows/call-docker-build.yaml'
      - 'docker-entrypoint.sh'
  workflow_dispatch:
  repository_dispatch:
  schedule:
    # re-run montly to keep image fresh with upstream base images
    - cron: '0 12 15 * *'

env:
  REGISTRY: ghcr.io
  IMAGE_PLATFORMS: linux/amd64,linux/arm64
  REPO_CONTEXT: .
  REPO_CONTAINERFILE: ./Dockerfile

jobs:
  buildpushscan:
    runs-on: ubuntu-latest
    permissions:
      actions: write
      packages: write
      contents: read
      security-events: write
    steps:
      -
        name: Cancel previous run in progress
        id: cancel-previous-runs
        uses: styfle/cancel-workflow-action@0.11.0
        with:
          ignore_sha: true
          all_but_latest: true
          access_token: ${{ secrets.GITHUB_TOKEN }}
      -
        name: Checkout
        id: repo-checkout
        uses: actions/checkout@v3
      -
        name: Set up QEMU
        id: setup-qemu
        uses: docker/setup-qemu-action@v2
        with:
          platforms: amd64,arm64
      -
        name: Log in to registry
        id: registry-login
        uses: docker/login-action@v2
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      -
        name: Build jekyll image
        id: build-jekyll-image
        uses: docker/build-push-action@v3
        with:
          context: ${{ env.REPO_CONTEXT }}
          file: ${{ env.REPO_CONTAINERFILE }}
          push: true
          target: jekyll
          tags: ghcr.io/${{ github.repository_owner }}/jekyll:latest
          platforms: ${{ env.IMAGE_PLATFORMS }}
      -
        name: Build jekyll-serve image
        id: build-jekyll-serve-image
        uses: docker/build-push-action@v3
        with:
          context: ${{ env.REPO_CONTEXT }}
          file: ${{ env.REPO_CONTAINERFILE }}
          push: true
          target: jekyll-serve
          tags: ghcr.io/${{ github.repository_owner }}/jekyll-serve:latest
          platforms: ${{ env.IMAGE_PLATFORMS }}
      -
        name: Run Trivy vulnerability scanner
        id: trivy-scan
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'image'
          scanners: 'vuln'
          image-ref: ghcr.io/${{ github.repository_owner }}/jekyll:latest
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'HIGH,CRITICAL'
          vuln-type: 'os,library'
          hide-progress: true
          ignore-unfixed: true
          exit-code: '0'
      -
        name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        if: always()
        with:
          sarif_file: 'trivy-results.sarif'