build-and-push-docker-image.yaml

name: Extend, build and push docker image

on:
  push:
    branches: 
      - 'main'
    paths: 
      - 'Dockerfile'
      - '.github/workflows/build-and-push-docker-image.yaml'
      - '*.py'
      - 'yaml-templates/*'
  schedule:
    - cron: '0 8 * * *'
  workflow_call:

jobs:
  
  build-and-push-image:
    runs-on: ubuntu-latest

    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
    
      - name: Docker login
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
    
      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/dfe-digital/automated-threat-models
    
      - name: Build and push image
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

  test-action:
    runs-on: ubuntu-latest
    needs: build-and-push-image

    permissions:
      contents: read
      packages: read

    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
    
      - name: Run threagile
        id: threagile-test-optional-args
        uses: pritchyspritch/run-threagile-action@v2
        with:
          optional_args: '--help'

      - name: Run threagile
        id: threagile
        uses: pritchyspritch/run-threagile-action@v2
        with:
          model_file: 'example-models/threagile-SSPHP-model.yaml'
          output_dir: 'test/location'

      # will fail as Azure data ingestion hasn't been automated yet
      - name: Run threagile
        id: dfe-threagile
        uses: pritchyspritch/run-threagile-action@v2
        with:
          dfe_threagile: 'true'
      
      - name: Upload Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: threat-model-output
          path: test/location