main.yml

name: Docker Image CI
on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - '*'
env:
  REGISTRY: docker.io
  IMAGE_NAME: learnwithsagar
  SHA: ${{ github.event.pull_request.head.sha || github.event.after }}

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
        with:
          ref: ${{ env.SHA }}

      - name: Setup Docker buildx
        uses: docker/setup-buildx-action@v2.5.0
        with:
          driver-opts: |
            image=moby/buildkit:v0.10.6

      - name: Log into registry ${{ env.REGISTRY }}
        uses: docker/login-action@v2.1.0
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Build the Docker image
        run: docker build . --file ./dockerday01/Dockerfile --tag learnwithsagar/node-app:${{ github.sha }}
      
      - name: Docker Push
        run: docker push learnwithsagar/node-app:${{ github.sha }}

      - name: Docker Scout
        id: docker-scout
        if: ${{ github.event_name == 'pull_request' }}
        uses: docker/scout-action@dd36f5b0295baffa006aa6623371f226cc03e506
        with:
          command: cves
          image: learnwithsagar/node-app:${{ github.sha }}
          only-severities: critical,high
          exit-code: true