main.yml

name: CI

on: [push]

jobs:
  sast_scan:
    name: Run bandit scan
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v2

    - name: Set up Python
      uses: actions/setup-python@v2
      with: 
        python-version: 3.8

    - name: Install bandir
      run: pip install bandit

    - name: Run bandit scan
      run: bandit -ll -ii -r . -f json -o bandit-report.json

    - name: Upload artifact
      uses: actions/upload-artifact@v3
      if: always()
      with:
        name: bandit-findings
        path: bandit-report.json

  image_scan:
    name: build image and run image scan
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v2

      - name: Install docker
        uses: docker-practice/actions-setup-docker@v1
        with:
          docker_version: '27.1.1'

      - name: Build docker image
        run: docker build -f Dockerfile -t muapp:latest .

      - name: Docker Scout
        uses: docker/scout-action@v1.13.0
        with:
          dockerhub-user: ${{ secrets.DOCKER_USER }}
          dockerhub-password: ${{ secrets.DOCKER_PASSWORD }}