docker-publish.yml

#
# Copyright © 2021 Bedag Informatik AG
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#  This is a basic workflow to help you get started with Actions
#
name: docker-publish
on:
  schedule:
  - cron: "0 0 * * SUN"
  push:
    branches:
      - main
jobs:
  build-publish:
    if: github.ref == 'refs/heads/main' && ! contains(github.event.head_commit.message, 'ci skip')
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v2
      - name: image-build-action
        uses: bedag/image-build-action@main
        with:
          push: true
          docker_username: ${{ secrets.DOCKERHUB_USERNAME }}
          docker_password: ${{ secrets.DOCKERHUB_TOKEN}}
  security-scan:
    if: github.ref == 'refs/heads/main' && ! contains(github.event.head_commit.message, 'ci skip')
    needs: build-publish
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v2
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: bedag/squid
          format: 'template'
          template: '@/contrib/sarif.tpl'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'
      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v1
        with:
          sarif_file: 'trivy-results.sarif'