build.yml

name: Continuous Delivery

on:
  push:
    tags:
      - v*
  workflow_dispatch:

defaults:
  run:
    shell: 'bash -Eeuo pipefail -x {0}'

env:
  IMAGE_STAGING: ghcr.io/cloudnative-pg/pgbouncer-testing
  IMAGE_RELEASE: ghcr.io/cloudnative-pg/pgbouncer

permissions:
  contents: write
  packages: write
  security-events: write

jobs:
  build-and-publish:
    runs-on: ubuntu-22.04
    steps:
      -
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      -
        name: Detect platforms
        run: |
          platforms="linux/amd64,linux/arm64"
          echo "PLATFORMS=${platforms}" >> $GITHUB_ENV
      -
        name: Set up QEMU
        uses: docker/setup-qemu-action@v3
        with:
          platforms: ${{ env.PLATFORMS }}
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      -
        name: Log in to the GitHub Container registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      -
        name: Set image repository
        run: |
          if [[ "${GITHUB_REF}" =~ refs/tags/v(.*) ]]; then
            echo "IMAGES=${{ env.IMAGE_RELEASE }},${{ env.IMAGE_STAGING }}" >> $GITHUB_ENV
          else
            echo "IMAGES=${{ env.IMAGE_STAGING }}" >> $GITHUB_ENV
          fi
      -
        name: Gather image info
        run: |
          pgbouncer_version=$(jq -r '.PGBOUNCER_VERSION' .versions.json)
          release_version=$(jq -r '.IMAGE_RELEASE_VERSION' .versions.json)
          debian_version=$(jq -r '.DEBIAN_VERSION' .versions.json)
          echo "PGBOUNCER_VERSION=${pgbouncer_version}" >> $GITHUB_ENV
          echo "RELEASE_VERSION=${release_version}" >> $GITHUB_ENV
          echo "DEBIAN_VERSION=${debian_version}" >> $GITHUB_ENV
      -
        name: Docker meta
        id: docker-meta
        uses: docker/metadata-action@v5
        with:
          # list of Docker images to use as base name for tags
          images: "${{ env.IMAGES }}"
          # generate Docker tags based on the following events/attributes
          tags: |
            type=match,pattern=v(.*),group=1
            type=match,pattern=v(.*)-\d+,group=1
            type=ref,event=branch
          labels: |
            org.opencontainers.image.version=${{ env.PGBOUNCER_VERSION }}
            org.opencontainers.image.revision=${{ env.RELEASE_VERSION }}
            org.opencontainers.image.licenses=PostgreSQL
      -
        name: Build and load
        uses: docker/build-push-action@v5
        with:
          context: .
          push: false
          load: true
          tags: ${{ steps.docker-meta.outputs.tags }}
          labels: ${{ steps.docker-meta.outputs.labels }}
      -
        name: Dockle scan
        uses: erzz/dockle-action@v1
        with:
          image: "${{ env.IMAGE_STAGING }}:${{ env.PGBOUNCER_VERSION }}"
          exit-code: '1'
          failure-threshold: WARN
          accept-keywords: key
      -
        name: Run Snyk to check Docker image for vulnerabilities
        uses: snyk/actions/docker@master
        continue-on-error: true
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          image: "${{ env.IMAGE_STAGING }}:${{ env.PGBOUNCER_VERSION }}"
          args: --severity-threshold=high --file=${{ matrix.file }}
      -
        name: Upload result to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: snyk.sarif
      -
        name: Build and push
        uses: docker/build-push-action@v5
        with:
          platforms: ${{ env.PLATFORMS }}
          context: .
          push: true
          tags: ${{ steps.docker-meta.outputs.tags }}
          labels: ${{ steps.docker-meta.outputs.labels }}