docker-image.yaml

name: Publish build-deploy-image

on:
  push:
    branches:
      - 'main'
      - 'build-image'
    tags:
      - 'v*.*.*'
  pull_request:
    branches:
      - 'main'

jobs:
  docker:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        goversion:
        - 1.21
    steps:
      -
        name: Checkout PR
        uses: actions/checkout@v4
        if: ${{ github.event_name == 'pull_request' }}
        with:
          fetch-depth: "0"
          ref: ${{ github.event.pull_request.head.sha }}
      -
        name: Checkout Branch or Tag
        uses: actions/checkout@v4
        if: ${{ github.event_name != 'pull_request' }}
        with:
          fetch-depth: "0"
      -
        name: Set version for non-tag build
        if: "!startsWith(github.ref, 'refs/tags/')"
        id: version_non-tag_build
        run: |
          VERSION=$(echo $(git describe --abbrev=0 --tags)+$(git rev-parse --short=8 HEAD))
          DOCKER_TAG=$(echo $(git describe --abbrev=0 --tags)-$(git rev-parse --short=8 HEAD))
          BUILD=$(date +%FT%T%z)
          echo "VERSION=$VERSION" >> $GITHUB_ENV
          echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
          echo "BUILD=$BUILD" >> $GITHUB_ENV
          echo "build-deploy-tool $VERSION (built: $BUILD / go ${{ matrix.goversion }})"
      -
        name: Set version for tag build
        if: "startsWith(github.ref, 'refs/tags/')"
        id: version_tag_build
        run: |
          VERSION=$(echo $(git describe --abbrev=0 --tags))
          BUILD=$(date +%FT%T%z)
          echo "VERSION=$VERSION" >> $GITHUB_ENV
          echo "DOCKER_TAG=$VERSION" >> $GITHUB_ENV
          echo "BUILD=$BUILD" >> $GITHUB_ENV
          echo "build-deploy-tool $VERSION (built: $BUILD / go ${{ matrix.goversion }})"
      -
        name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          # list of Docker images to use as base name for tags
          images: |
            ${{ github.repository_owner }}/build-deploy-image
            ghcr.io/${{ github.repository_owner }}/build-deploy-image
          tags: |
            # set edge tag for default branch
            type=edge,enable={{is_default_branch}}
            # set tag+build for default branch
            type=raw,value=${{ env.DOCKER_TAG}},enable={{is_default_branch}}
            # tag event
            type=ref,event=tag
            # pull request event
            type=ref,event=pr
            # pull request event
            type=ref,event=branch
      -
        name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          buildkitd-flags: --debug
      -
        name: Login to DockerHub
        uses: docker/login-action@v3 
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      -
        name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      -
        name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          # platforms: linux/amd64,linux/arm64
          platforms: linux/amd64
          build-args: |
            "VERSION=${{ env.VERSION }}"
            "BUILD=${{ env.BUILD }}"
            "GO_VER=${{ matrix.goversion }}"
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
      - 
        name: Docker Scout
        id: docker-scout
        uses: docker/scout-action@v0.23.4
        with:
          command: cves,recommendations,compare
          image: ${{ steps.meta.outputs.tags }}
          to-latest: true
          ignore-base: false
          ignore-unchanged: true
          only-fixed: true
          organization: ${{ github.repository_owner }}