docker-publish-11.yml

name: CI-11

on:
  push:
    # Publish `main` as Docker `latest` image.
    branches:
      - main
      - feature/*

    # Publish `v1.2.3` tags as releases.
    tags:
      - v*

  # Run tests for any PRs.
  pull_request:

env:
  IMAGE_NAME: jenkins-agent-maven
  JDK_VERSION: 11

jobs:
  # Push image to GitHub Packages.
  # See also https://docs.docker.com/docker-hub/builds/
  push:
    # Ensure test job passes before pushing image.
    runs-on: ubuntu-latest
    if: github.event_name == 'push'

    steps:
      - uses: actions/checkout@v2

      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v1

      - name: Available platforms
        run: echo ${{ steps.buildx.outputs.platforms }}

      - name: Build image
        run: docker build . --file Dockerfile$JDK_VERSION --tag $IMAGE_NAME-$JDK_VERSION:${{ github.sha }}

      - name: Run Trivy vulnerability scanner and dump results
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: "${{ env.IMAGE_NAME }}-${{ env.JDK_VERSION }}:${{ github.sha }}"
          format: "table"
          vuln-type: "os,library"
          severity: "CRITICAL,HIGH"

      - name: Run Trivy vulnerability scanner (for sarif)
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: "${{ env.IMAGE_NAME }}-${{ env.JDK_VERSION }}:${{ github.sha }}"
          vuln-type: "os,library"
          severity: "CRITICAL,HIGH"
          format: "sarif"
          output: "trivy-results.sarif"

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v1
        with:
          sarif_file: "trivy-results.sarif"

      - name: Run Trivy vulnerability scanner (fail build if any)
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: "${{ env.IMAGE_NAME }}-${{ env.JDK_VERSION }}:${{ github.sha }}"
          exit-code: "1"
          vuln-type: "os,library"
          severity: "CRITICAL,HIGH"
          format: "sarif"
          output: "trivy-results.sarif"

      - name: Log into registry
        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin

      - name: Push image
        run: |
          IMAGE_ID=ghcr.io/${{ github.repository }}-$JDK_VERSION

          # Change all uppercase to lowercase
          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')

          # Strip git ref prefix from version
          VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')

          # Strip "v" prefix from tag name
          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')

          # Use Docker `latest` tag convention
          [ "$VERSION" == "main" ] && VERSION=latest

          echo IMAGE_ID=$IMAGE_ID
          echo VERSION=$VERSION

          docker tag $IMAGE_NAME-$JDK_VERSION:${{ github.sha }} $IMAGE_ID:$VERSION
          docker push $IMAGE_ID:$VERSION