nginx-build-and-push-ghcr.yml

name: nginx-build-and-push-ghcr

on:
  push:
    branches:
      - main
      - development
    paths:
      - 'nginx/**'
      - 'Dockerfiles/nginx.Dockerfile'
      - 'shared/bin/*'
      - '!shared/bin/capa-build.sh'
      - '!shared/bin/common-init.sh'
      - '!shared/bin/extracted_files_http_server.py'
      - '!shared/bin/web-ui-asset-download.sh'
      - '!shared/bin/os-disk-config.py'
      - '!shared/bin/preseed_late_user_config.sh'
      - '!shared/bin/configure-interfaces.py'
      - '!shared/bin/zeek*'
      - '!shared/bin/suricata*'
      - '.trigger_workflow_build'
      - '_config.yml'
      - '_includes/**'
      - '_layouts/**'
      - 'docs/**'
      - 'Gemfile'
      - 'README.md'
  workflow_dispatch:
  repository_dispatch:

jobs:
  docker:
    runs-on: ubuntu-22.04
    permissions:
      actions: write
      packages: write
      contents: read
      security-events: write
    strategy:
      fail-fast: false
      matrix:
        platform:
          - linux/amd64
          - linux/arm64
    steps:
      -
        name: Cancel previous run in progress
        uses: styfle/cancel-workflow-action@0.12.1
        with:
          ignore_sha: true
          all_but_latest: true
          access_token: ${{ secrets.GITHUB_TOKEN }}
      -
        name: Checkout
        uses: actions/checkout@v4
      -
        name: Generate build timestamp
        shell: bash
        run: echo "btimestamp=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
        id: generate_build_timestamp
      -
        name: Extract branch name
        shell: bash
        run: echo "branch=$(echo ${GITHUB_REF#refs/heads/})" >> $GITHUB_OUTPUT
        id: extract_branch
      -
        name: Generate arch tag suffix
        shell: bash
        run: echo "archtag=$([[ "${{ matrix.platform }}" == 'linux/amd64' ]] && echo '' || ( echo -n '-' ; echo "${{ matrix.platform }}" | cut -d '/' -f 2) )" >> $GITHUB_OUTPUT
        id: arch_tag_suffix
      -
        name: Extract commit SHA
        shell: bash
        run: echo "sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
        id: extract_commit_sha
      -
        name: Extract Malcolm version
        shell: bash
        run: echo "mversion=$(grep -P "^\s+image:.*/malcolm/" docker-compose-dev.yml | awk '{print $2}' | cut -d':' -f2 | uniq -c | sort -nr | awk '{print $2}' | head -n 1)" >> $GITHUB_OUTPUT
        id: extract_malcolm_version
      -
        name: Set up QEMU
        id: setup-qemu
        uses: docker/setup-qemu-action@v3
        with:
          platforms: ${{ matrix.platform }}
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: |
            image=moby/buildkit:master
      -
        name: Log in to registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      -
        name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfiles/nginx.Dockerfile
          build-args: |
            TARGETPLATFORM=${{ matrix.platform }}
            MALCOLM_VERSION=${{ steps.extract_malcolm_version.outputs.mversion }}
            BUILD_DATE=${{ steps.generate_build_timestamp.outputs.btimestamp }}
            VCS_REVISION=${{ steps.extract_commit_sha.outputs.sha }}
            GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
          push: true
          provenance: false
          platforms: ${{ matrix.platform }}
          tags: ghcr.io/${{ github.repository_owner }}/malcolm/nginx-proxy:${{ steps.extract_branch.outputs.branch }}${{ steps.arch_tag_suffix.outputs.archtag }}
      -
        name: Run Trivy vulnerability scanner
        if: ${{ matrix.platform == 'linux/amd64' }}
        id: trivy-scan
        uses: aquasecurity/trivy-action@0.29.0
        env:
          TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db
        with:
          scan-type: 'image'
          scanners: 'vuln'
          image-ref: ghcr.io/${{ github.repository_owner }}/malcolm/nginx-proxy:${{ steps.extract_branch.outputs.branch }}${{ steps.arch_tag_suffix.outputs.archtag }}
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'HIGH,CRITICAL'
          vuln-type: 'os,library'
          hide-progress: true
          ignore-unfixed: true
          exit-code: '0'
      -
        name: Upload Trivy scan results to GitHub Security tab
        if: ${{ matrix.platform == 'linux/amd64' }}
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'