docker.yaml

name: Docker
on:
  push:
    branches:
      - master
      # For testing docker building if needed
      - build/*

    tags:
      - v*
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [ master ]

env:
  IMAGE_NAME: thanos-remote-read

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v2

      - name: Build image
        run: docker build -t image .
        
      - name: Sanitize repo slug
        uses: actions/github-script@v4
        id: github_id
        with:
          result-encoding: string
          script: return 'docker.pkg.github.com/${{ github.repository }}/${{ env.IMAGE_NAME }}'.toLowerCase()

      - name: Log into registry
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" | docker login docker.pkg.github.com -u ${{ github.actor }} --password-stdin
          echo "${{ secrets.DOCKER_PASSWORD }}" | docker login -u ${{ secrets.DOCKER_USERNAME }} --password-stdin

      - name: Push image
        run: |
          GITHUB_ID="${{ steps.github_id.outputs.result }}"
          DOCKERHUB_ID="gresearchdev/$IMAGE_NAME"

          # Change all uppercase to lowercase for github
          GITHUB_ID=$(echo $GITHUB_ID | tr '[A-Z]' '[a-z]')

          # Strip git ref prefix from version
          VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')

          # Use Docker `latest` tag convention
          [ "$VERSION" == "master" ] && VERSION=latest
          echo VERSION=$VERSION

          set -x

          # GitHub push
          docker tag image $GITHUB_ID:$VERSION
          docker push $GITHUB_ID:$VERSION

          # DockerHub push for releases
          if [[ $VERSION != latest ]]; then
            docker tag image $DOCKERHUB_ID:$VERSION
            docker push $DOCKERHUB_ID:$VERSION
            # Also mark release as latest on DockerHub
            docker tag image $DOCKERHUB_ID:latest
            docker push $DOCKERHUB_ID:latest
          fi
          

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@2a2157eb22c08c9a1fac99263430307b8d1bc7a2
        with:
          image-ref: '${{ steps.github_id.outputs.result }}:${{ github.sha }}'
          format: 'template'
          template: '@/contrib/sarif.tpl'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v1
        with:
          sarif_file: 'trivy-results.sarif'