cve-patch-images.yaml

name: CVE patch

on:
  workflow_dispatch:
    inputs:
      images:
        description: 'Images to patch'
        type: string
        required: true

  repository_dispatch:
    types: [ patch-images ]

permissions:
  packages: write

jobs:

  patch_images:

    runs-on:
      - self-hosted
      - large

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_READ_ONLY_USERNAME }}
          password: ${{ secrets.DOCKERHUB_READ_ONLY_PASSWORD }}

      - name: Save images
        id: save-images
        run: |
          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            {
              echo 'images<<EOF'
              echo "${{ inputs.images }}"
              echo 'EOF'
            } >> "$GITHUB_OUTPUT"
          else
            {
              echo 'images<<EOF'
              echo "${{ github.event.client_payload.images }}"
              echo 'EOF'
            } >> "$GITHUB_OUTPUT"
          fi

      - name: Patch images
        id: patch-images
        uses: ./.github/actions/copacetic-action
        with:
          images: ${{ steps.save-images.outputs.images }}
          github-token: ${{ secrets.GITHUB_TOKEN }}
          timeout: 2h
          report-cves: true