cd-build-canary-unbound.yaml

name: CD Build Canary Distroless Unbound Docker Image

on:      
  schedule:
    - cron: '0 19 * * mon-fri'
    
jobs: 
  build: 
    runs-on: ubuntu-latest
    
    env:
      DOCKERHUB_SLUG: "madnuttah/unbound"   
      
    steps:
      - name: Checkout source
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Is update available
        id: IS_UPDATE_AVAILABLE
        run: |
          UNBOUND_GIT_SHA="$(git ls-remote https://github.com/NLnetLabs/unbound.git | head -1 | cut -f 1)"
          UNBOUND_SHA="$(cat unbound_git_sha)"
          if [[ "$UNBOUND_SHA" = "$UNBOUND_GIT_SHA" ]]; then
          echo "No update found"
            exit 1
          else
            echo "Update found"
            echo UNBOUND_GIT_SHA="$UNBOUND_GIT_SHA" >> $GITHUB_OUTPUT         
          fi           
   
      - name: Import GPG key 
        id: IMPORT_GPG
        uses: crazy-max/ghaction-import-gpg@v6
        with:
          gpg_private_key: ${{ secrets.BOT_GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.BOT_GPG_PASSPHRASE }}
          git_user_signingkey: true
          git_commit_gpgsign: true
          git_push_gpgsign: false
          trust_level: 5

      - name: Push unbound_git_sha to repository
        env:
          GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
          GIT_AUTHOR_NAME: ${{ steps.IMPORT_GPG.outputs.name }}
          GIT_AUTHOR_EMAIL: ${{ steps.IMPORT_GPG.outputs.email }}
          GIT_COMMITTER_NAME: ${{ steps.IMPORT_GPG.outputs.name }}
          GIT_COMMITTER_EMAIL: ${{ steps.IMPORT_GPG.outputs.email }}
        run: |
          git remote set-url origin https://x-access-token:${{ secrets.BOT_GITHUB_TOKEN }}@github.com/${{ github.repository }}  
          echo ${{ steps.IS_UPDATE_AVAILABLE.outputs.UNBOUND_GIT_SHA }} > unbound_git_sha
          git add unbound_git_sha
          git commit unbound_git_sha -m "Updated unbound_git_sha"
          git push origin main
              
      - name: Set buildvars
        id: SET_BUILDVARS
        run: |
          echo IMAGE_BUILD_DATE=$(date -u) >> $GITHUB_OUTPUT
          echo UNBOUND_VERSION="$(curl -s https://raw.githubusercontent.com/NLnetLabs/unbound/master/configure | awk -F= '/^version=/ { print $2 }')" >> $GITHUB_OUTPUT
          echo OPENSSL_BUILDENV_VERSION="$(curl -s https://api.github.com/repos/madnuttah/openssl-buildenv/releases | jq '.[0] | .name' -r)" >> $GITHUB_OUTPUT
          
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      
      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v3
     
      - name: Login to Dockerhub
        if: github.event_name != 'pull_request'
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}          

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          platforms: linux/386,linux/arm/v6,linux/arm/v7,linux/arm64,linux/amd64
          builder: ${{ steps.buildx.outputs.name }}
          build-args: |
            IMAGE_BUILD_DATE=${{ steps.SET_BUILDVARS.outputs.IMAGE_BUILD_DATE }} 
            UNBOUND_VERSION=${{ steps.SET_BUILDVARS.outputs.UNBOUND_VERSION }} 
            OPENSSL_BUILDENV_VERSION=${{ steps.SET_BUILDVARS.outputs.OPENSSL_BUILDENV_VERSION }}
          file: ./unbound/canary.Dockerfile   
          sbom: ${{ github.event_name != 'pull_request' }}
          provenance: ${{ github.event_name != 'pull_request' }}
          push: ${{ github.event_name != 'pull_request' }}        
          tags: |
            ${{ env.DOCKERHUB_SLUG }}:canary
            
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        if: ${{ github.event_name != 'pull_request' }}
        with:
          image-ref: ${{ env.DOCKERHUB_SLUG }}:canary          
          exit-code: '1'
          ignore-unfixed: false
          scan-type: image
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'
          format: 'table'
          
      - name: Docker Scout CVEs
        uses: docker/scout-action@v1
        if: ${{ github.event_name != 'pull_request' }}
        with:
          command: cves
          image: ${{ env.DOCKERHUB_SLUG }}:canary 
          only-fixed: true
          only-severities: critical,high
          write-comment: true
          github-token: ${{ secrets.GITHUB_TOKEN }} 
          exit-code: false