bookorbit/.github/workflows/container-image.yml

name: Container Image
run-name: >-
  ${{ github.event_name == 'workflow_run' && format('Image - {0} ({1})', github.event.workflow_run.head_commit.message, github.event.workflow_run.head_branch) || github.event_name == 'pull_request' && format('Image check - PR #{0}', github.event.pull_request.number) || format('Image - {0}', github.ref_name) }}

on:
  pull_request:
    branches: [main]
  # Break-glass: bypasses CI/E2E gate. Use only when CI is broken and a hotfix image is urgently needed.
  workflow_dispatch:
  workflow_run:
    workflows: ["CI"]
    types: [completed]
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || github.sha }}
  cancel-in-progress: true

permissions:
  actions: read
  contents: read

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  image:
    name: ${{ github.event_name == 'pull_request' && 'Build and Scan Image' || 'Build and Push Image' }}
    if: >
      github.event_name == 'pull_request' ||
      github.event_name == 'workflow_dispatch' ||
      (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push')
    runs-on: ubuntu-latest
    timeout-minutes: 45
    permissions:
      contents: read
      packages: write
    steps:
      - name: Resolve source and image tags
        id: vars
        shell: bash
        env:
          EVENT_NAME: ${{ github.event_name }}
          GH_REF: ${{ github.ref }}
          GH_REF_NAME: ${{ github.ref_name }}
          GH_SHA: ${{ github.sha }}
          WORKFLOW_RUN_HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
        run: |
          if [[ "$EVENT_NAME" == "workflow_dispatch" && "$GH_REF" != "refs/heads/main" ]]; then
            echo "workflow_dispatch is only supported from main."
            exit 1
          fi

          if [[ "$EVENT_NAME" == "workflow_run" ]]; then
            SHA="$WORKFLOW_RUN_HEAD_SHA"
          else
            SHA="$GH_SHA"
          fi

          SHORT_SHA="${SHA:0:12}"
          IMAGE="$REGISTRY/$IMAGE_NAME"

          echo "checkout_ref=${SHA}" >> "$GITHUB_OUTPUT"
          echo "image=${IMAGE}" >> "$GITHUB_OUTPUT"
          echo "scan_tag=${IMAGE}:sha-${SHORT_SHA}" >> "$GITHUB_OUTPUT"

          if [[ "$EVENT_NAME" == "pull_request" ]]; then
            echo "should_push=false" >> "$GITHUB_OUTPUT"
            echo "tags<<EOF" >> "$GITHUB_OUTPUT"
            echo "${IMAGE}:sha-${SHORT_SHA}" >> "$GITHUB_OUTPUT"
            echo "EOF" >> "$GITHUB_OUTPUT"
          else
            echo "should_push=true" >> "$GITHUB_OUTPUT"
            echo "tags<<EOF" >> "$GITHUB_OUTPUT"
            echo "${IMAGE}:${GH_REF_NAME}" >> "$GITHUB_OUTPUT"
            echo "${IMAGE}:sha-${SHORT_SHA}" >> "$GITHUB_OUTPUT"
            echo "EOF" >> "$GITHUB_OUTPUT"
          fi

      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ steps.vars.outputs.checkout_ref }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Build image
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
          file: ./Dockerfile
          push: false
          load: true
          tags: ${{ steps.vars.outputs.tags }}
          platforms: linux/amd64
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Scan image with Trivy
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          image-ref: ${{ steps.vars.outputs.scan_tag }}
          format: table
          vuln-type: os,library
          severity: CRITICAL,HIGH
          ignore-unfixed: true
          exit-code: "1"

      - name: Log in to GHCR
        if: steps.vars.outputs.should_push == 'true'
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Push image
        if: steps.vars.outputs.should_push == 'true'
        shell: bash
        run: |
          while IFS= read -r tag; do
            [ -n "$tag" ] || continue
            docker push "$tag"
          done <<'EOF'
          ${{ steps.vars.outputs.tags }}
          EOF