docker-publish.yml

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

# GitHub recommends pinning actions to a commit SHA.
# To get a newer version, you will need to update the SHA.
# You can also reference a tag or branch, but the action may change without warning.

name: Build & Publish

on:
  push:
    branches: ['release']

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  generate:
    runs-on: ubuntu-latest
    outputs:
      CALVER: ${{ steps.calculate-calver.outputs.calver }}
      REGISTRY: ${{ env.REGISTRY }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      
      - name: Compute outputs
        run: |
          echo "REGISTRY=${{ env.REGISTRY }}" >> $GITHUB_OUTPUT

      - name: Calculate Calver
        id: calculate-calver
        run: |
          calver=$(date +'%Y.%m.%d')
          echo "calver=$calver" >> $GITHUB_ENV
          echo "::set-output name=calver::$calver"
          
  build_test_images:
    runs-on: ubuntu-latest
    needs: generate
    strategy:
      fail-fast: false
      matrix:
        include:
          - dockerfile: Dockerfile.gatekeeper
            tags: |
              ${{ needs.generate.outputs.REGISTRY }}/keychainmdip/gatekeeper:release
          - dockerfile: Dockerfile.keymaster
            tags: |
              ${{ needs.generate.outputs.REGISTRY }}/keychainmdip/keymaster:release
          - dockerfile: Dockerfile.hyperswarm
            tags: |
              ${{ needs.generate.outputs.REGISTRY }}/keychainmdip/hyperswarm-mediator:release
          - dockerfile: Dockerfile.tess
            tags: |
              ${{ needs.generate.outputs.REGISTRY }}/keychainmdip/tess-mediator:release
    permissions:
      contents: read
      packages: write
    
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Log in to the Container registry
        uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            ${{ needs.generate.outputs.CALVER }}
            release

      - name: Build and push Docker images
        uses: docker/build-push-action@1a162644f9a7e87d8f4b053101d1d9a712edc18c
        with:
          context: .
          file: ${{ matrix.dockerfile }}
          push: true
          labels: ${{ steps.meta.outputs.labels }}
          tags: ${{ matrix.tags }}
      
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@0.20.0
        with:
          image-ref: ${{ matrix.tags }}
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL'