build-image-on-push.yml

name: Build and push containers
# "on push" includes merged pull requests

on:
  push:
    tags:
      - "v*.*.*"
      - "pre-v*.*.*"

jobs:
  init-vars:
    runs-on: ubuntu-latest
    outputs:
      git_tag_prefix: ${{ steps.extract_github_ref_prefix.outputs.git_tag_prefix }}
      image_tag_prefix: ${{ steps.set_image_tag_prefix.outputs.image_tag_prefix }}
      version: ${{ steps.extract_github_ref_version.outputs.version }}
    steps:
      - name: Validate github.ref format in case of others triggers used
        id: validate_github_ref
        run: |
          if [[ ! "${{ github.ref }}" =~ ^refs/tags/(pre-|)v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Invalid github.ref format"
            exit 1
          fi

      - name: Set git_tag_prefix to testing or release depending on git tag
        id: extract_github_ref_prefix
        run: echo "git_tag_prefix=$(echo ${{ github.ref }} | awk -F/ '{print $3}' | awk -F- '{print $1}')" >> $GITHUB_OUTPUT
      - name: Extract version from github.ref
        id: extract_github_ref_version
        run: echo "version=$(echo ${{ github.ref }} | awk -F/ '{print $3}' | awk -Fv '{print $2}')" >> $GITHUB_OUTPUT
      - name: Set set_image_tag_prefix to empty or "testing" depending on git tag prefix
        id: set_image_tag_prefix
        run: |
          if [[ "${{ steps.extract_github_ref_prefix.outputs.git_tag_prefix }}" == "pre-" ]]; then
            echo "image_tag_prefix=testing-" >> $GITHUB_OUTPUT
          elif [[ "${{ steps.extract_github_ref_prefix.outputs.git_tag_prefix }}" == "" ]]; then
            echo "image_tag_prefix=" >> $GITHUB_OUTPUT
          fi

  build-image-on-push:
    runs-on: ubuntu-latest
    needs:
      - init-vars
    permissions:
      contents: read
      packages: write
    steps:
      - name: Check out the repo
        uses: actions/checkout@v4

      # Initalized here to prevent a second repo checkout
      - name: Set short git commit SHA / needs repo checkout
        id: get_commit
        run: echo "short_sha=$(git rev-parse --short ${{ github.sha }})" >> $GITHUB_OUTPUT
      # Write version from github.ref to version file
      - name: Write version from github.ref to version file
        run: |
          echo "${{ needs.init-vars.outputs.version }}" > "version"
      - name: Set current time
        id: current_time
        run: echo "time=$(date --iso-8601=seconds)" >> $GITHUB_OUTPUT

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push image
        uses: docker/build-push-action@v5
        with:
          #context: ${{ needs.init-vars.outputs.component }}
          push: true
          tags: |
            seatable/restic-backup-verify:commit-${{ steps.get_commit.outputs.short_sha }}
            seatable/restic-backup-verify:${{ needs.init-vars.outputs.image_tag_prefix }}${{ needs.init-vars.outputs.version }}
          labels: |
            org.opencontainers.image.title=seatable/restic-backup
            org.opencontainers.image.version=${{ needs.init-vars.outputs.image_tag_prefix }}${{ needs.init-vars.outputs.version }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.created=${{ steps.current_time.outputs.time }}
            org.opencontainers.image.authors=SeaTable
            org.opencontainers.image.url=https://www.seatable.io/
            org.opencontainers.image.documentation=https://admin.seatable.io/
            org.opencontainers.image.vendor=SeaTable

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: "docker.io/seatable/restic-backup-verify:commit-${{ steps.get_commit.outputs.short_sha }}"
          format: "table"
          exit-code: "0"
          scanners: "vuln,misconfig"
          ignore-unfixed: true
          vuln-type: "os,library"
          severity: "CRITICAL,HIGH"
        env:
          TRIVY_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          TRIVY_PASSWORD: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Move image to non verify repository
        id: move_image
        run: |
          docker pull seatable/restic-backup-verify:commit-${{ steps.get_commit.outputs.short_sha }}
          docker tag seatable/restic-backup-verify:commit-${{ steps.get_commit.outputs.short_sha }} seatable/restic-backup:commit-${{ steps.get_commit.outputs.short_sha }}
          docker tag seatable/restic-backup:commit-${{ steps.get_commit.outputs.short_sha }} seatable/restic-backup:${{ needs.init-vars.outputs.image_tag_prefix }}${{ needs.init-vars.outputs.version }}
          docker push seatable/restic-backup:commit-${{ steps.get_commit.outputs.short_sha }}
          docker push seatable/restic-backup:${{ needs.init-vars.outputs.image_tag_prefix }}${{ needs.init-vars.outputs.version }}