release.yml

on:
  workflow_run:
    workflows: ["Docker build"]
    branches: [main]
    types:
      - completed

name: Release
jobs:
  build:
    name: Docker build and push
    if: >
      ${{ github.event.workflow_run.conclusion == 'success' }}
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
      with:
        fetch-depth: 0
    - name: Bump version and push tag
      uses: anothrNick/github-tag-action@master
      id: version
      env:
        GITHUB_TOKEN: ${{ github.token }}
        WITH_V: true
        DEFAULT_BUMP: patch
    - name: Set up Docker Buildx
      id: buildx
      uses: docker/setup-buildx-action@master
    - name: Login to DockerHub
      uses: docker/login-action@v2
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ github.token }}
    - name: Build and push Docker images
      uses: docker/build-push-action@v3
      with:
        builder: ${{ steps.buildx.outputs.name }}
        push: true
        context: .
        labels: |
          org.opencontainers.image.source=https://github.com/${{ github.repository }}
          org.opencontainers.image.version=${{ steps.version.outputs.tag || github.sha }}
          org.opencontainers.image.revision=${{ github.sha }}
        tags: |
          ghcr.io/${{ github.repository }}:latest
          ghcr.io/${{ github.repository }}:${{ steps.version.outputs.tag || github.sha }}
    - name: Anchore Container Vulnerability Scan
      uses: anchore/scan-action@v3
      id: scan
      with:
        image: ghcr.io/${{ github.repository }}:${{ steps.version.outputs.tag || github.sha }}
        acs-report-enable: true
        fail-build: false
    - name: Upload Anchore Container Vulnerability Scan SARIF report
      uses: github/codeql-action/upload-sarif@v2
      with:
        sarif_file: ${{ steps.scan.outputs.sarif }}