docker-image.yml

name: Docker Image CI

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build-and-push-image:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Log in to the Container registry
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

      - name: Build and push Docker image
        uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }} ${{ env.GITHUB_RUN_NUMBER }}
          labels: ${{ steps.meta.outputs.labels }}

# https://github.com/marketplace/actions/kics-github-action
      - name: run kics Scan
        uses: checkmarx/kics-github-action@v1.7.0
        with:
          path: '.'
          output_path: 'target'
          token: ${{ secrets.GITHUB_TOKEN }}
          ignore_on_exit: results
          enable_comments: true
          output_formats: 'json,sarif'
          exclude_results: '8e46ad83d3654b892e464ca2c35178ffeb36524854e012f3ffe2b20d279372d3,36b85e90377c6b62b6936e7b79019aff616e5d6190ff0221302c43d52dd423bb,7d7ec6bcba0a320550d74abf460f9f72624bfba44fa90cd8e25a9c3a785c3582,ca2086c5bbede56ff3b793a4f3288c119ded312ad7e287f601e9d7b9e9516a29'
      - name: display kics results
        run: |
          cat target/results.json

#      - name: Upload kics results to GitHub Security tab
#        uses: github/codeql-action/upload-sarif@v2
#        with:
#          sarif_file: 'target/results.sarif'

# https://github.com/marketplace/actions/aqua-security-trivy
      - name: Run Trivy vulnerability scanner - table
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: '${{ steps.meta.outputs.tags }}'
          format: 'table'

#      - name: Run Trivy vulnerability scanner - sarif
#        uses: aquasecurity/trivy-action@master
#        with:
#          image-ref: '${{ steps.meta.outputs.tags }}'
#          format: 'sarif'
#          output: 'target/trivy-results.sarif'

#      - name: Upload Trivy scan results to GitHub Security tab
#        uses: github/codeql-action/upload-sarif@v2
#        with:
#          sarif_file: 'target/trivy-results.sarif'