docker-verify.yaml

name: Docker verify process

on:
  push:
    paths:
      - "Dockerfile-notebook"
      - "Dockerfile-ray-node"
      - "gateway/Dockerfile"
      - "repository/Dockerfile"
      - ".github/actions/docker-vscan/action.yaml"
      - ".github/scripts/dockerfile-security.rego"
      - ".github/workflows/docker-verify.yaml"

env:
  HADOLINT_DOCKER_IMAGE: hadolint/hadolint:v2.12.0
  OPENPOLICYAGENT_DOCKER_IMAGE: openpolicyagent/conftest:v0.43.1

jobs:
  lint:
    strategy:
      matrix:
        dockerfile:
          [
            "Dockerfile-notebook",
            "Dockerfile-ray-node",
            "./gateway/Dockerfile",
            "./repository/Dockerfile",
          ]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Run hadolint in ${{ matrix.dockerfile }}
        run: docker run --name hadolint --rm --interactive ${{ env.HADOLINT_DOCKER_IMAGE }} < ${{ matrix.dockerfile }}
  sast:
    strategy:
      matrix:
        dockerfile:
          [
            "Dockerfile-notebook",
            "Dockerfile-ray-node",
            "./gateway/Dockerfile",
            "./repository/Dockerfile",
          ]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Run conftest in ${{ matrix.dockerfile }}
        shell: bash
        run: |
          docker run \
          --name conftest \
          --rm --volume $GITHUB_WORKSPACE:/project ${{ env.OPENPOLICYAGENT_DOCKER_IMAGE }} \
          test --strict --parser dockerfile \
          --policy .github/scripts/dockerfile-security.rego \
          ${{ matrix.dockerfile }}
  vscan:
    strategy:
      matrix:
        image:
          [
            "quantum-serverless-gateway:latest",
            "quantum-serverless-notebook:latest-py38",
            "quantum-serverless-notebook:latest-py39",
            "quantum-serverless-notebook:latest-py310",
            "quantum-serverless-ray-node:latest-py38",
            "quantum-serverless-ray-node:latest-py39",
            "quantum-serverless-ray-node:latest-py310",
            "quantum-repository-server:latest",
          ]
        include:
          - image: "quantum-serverless-gateway:latest"
            dockerfile: "./gateway/Dockerfile"
            pyversion: "3.9"
          - image: "quantum-serverless-notebook:latest-py38"
            dockerfile: "Dockerfile-notebook"
            pyversion: "3.8"
          - image: "quantum-serverless-notebook:latest-py39"
            dockerfile: "Dockerfile-notebook"
            pyversion: "3.9"
          - image: "quantum-serverless-notebook:latest-py310"
            dockerfile: "Dockerfile-notebook"
            pyversion: "3.10"
          - image: "quantum-serverless-ray-node:latest-py38"
            dockerfile: "Dockerfile-ray-node"
            pyversion: "py38"
          - image: "quantum-serverless-ray-node:latest-py39"
            dockerfile: "Dockerfile-ray-node"
            pyversion: "py39"
          - image: "quantum-serverless-ray-node:latest-py310"
            dockerfile: "Dockerfile-ray-node"
            pyversion: "py310"
          - image: "quantum-repository-server:latest"
            dockerfile: "./gateway/Dockerfile"
            pyversion: "3.9"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Scan image ${{ matrix.image }}
        uses: ./.github/actions/docker-vscan
        with:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          dockerfile: ${{ matrix.dockerfile }}
          docker_image_name: ${{ matrix.image }}
          pyversion: ${{ matrix.pyversion }}