publish-docker.yml

name: Publish Docker image

on:
  workflow_dispatch: {}
  push:
    branches:
      - 'main'
      - 'dev'
    paths:
      - 'code/src/**'
      - 'code/package.json'
      - 'code/Dockerfile'
      - '.github/workflows/publish-docker.yml'

jobs:
  docker-scan:
    name: ${{ github.event.repository.name }}-docker-scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: docker-practice/actions-setup-docker@ccc771627519a0dc44b99c63f3ccf5fab1b1b9b8
      - name: Build
        run: docker build -f Dockerfile -t user/app:latest .
        working-directory: code
      #- name: Scan for vulnerabilities
      #  uses: crazy-max/ghaction-container-scan@dfa7e54dc32045120f06d0bc8d7724860f5db0ad
      #  with:
      #    image: user/app:latest
      #    severity_threshold: HIGH
  push-to-registry:
    name: Push Docker image to Docker Hub
    needs: docker-scan
    runs-on: ubuntu-latest
    # save forks from having issue trying to publish to Docker
    #  without the correct credentials
    if: github.repository_owner == 'finos'
    outputs:
      digest: ${{ steps.build_publish.outputs.digest }}
    steps:
      - name: Check out the repo
        uses: actions/checkout@v4
      
      - name: Log in to Docker Hub
        uses: docker/login-action@v3.0.0
        with:
          username: finos
          password: ${{ secrets.DOCKER_PASSWORD }}
      
      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v5.5.1
        with:
          images: finos/a11y-theme-builder
          tags: |
            type=ref,event=branch
            type=sha
      - name: Build and push Docker image
        id: build_publish
        uses: docker/build-push-action@v5.1.0
        with:
          context: code
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}