build-branch.yml

name: build container image when branches are pushed

on:
  push:
    branches: ["*"]

jobs:
  build:
    strategy:
      matrix:
        runs-on:
          - "ubuntu-latest"
    runs-on: ${{ matrix.runs-on }}
    timeout-minutes: 10
    if: github.event.pusher.name != 'dreamkast-cloudnativedays'
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v3

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-west-2

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ steps.login-ecr.outputs.registry }}/dreamkast-ecs
          tags: |
            type=sha,prefix=,format=long
            type=ref,event=branch

      - name: Prepare-tag
        id: tags
        run: |
          arch=""
          # https://docs.github.com/en/actions/learn-github-actions/contexts#runner-context
          case "${{ runner.arch }}" in
            "X64" ) arch="amd64" ;;
            "ARM64" ) arch="arm64" ;;
          esac
          echo "tag=${{ github.sha }}-${arch}" >> $GITHUB_OUTPUT

      - name: Build
        id: docker_build
        uses: docker/build-push-action@v6
        with:
          context: ./
          file: ./Dockerfile
          push: true
          tags: ${{ steps.login-ecr.outputs.registry }}/dreamkast-ecs:${{ steps.tags.outputs.tag }}
          provenance: false
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  merge-images:
    runs-on: "ubuntu-latest"
    timeout-minutes: 10
    needs: ["build"]
    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-west-2

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Create a New Image
        run: |
          image_tag_sha="${{ steps.login-ecr.outputs.registry }}/dreamkast-ecs:${{ github.sha }}"
          docker buildx imagetools create \
            --tag ${image_tag_sha} \
            ${image_tag_sha}-amd64

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: '${{ steps.login-ecr.outputs.registry }}/dreamkast-ecs:${{ github.sha }}'
          format: 'table'
          exit-code: '0'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'