Merge pull request #3 from naveedious/develop #32
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Push Docker Image | |
| on: | |
| push: | |
| branches: [ "main" ] | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true | |
| jobs: | |
| build-and-push: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| actions: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - name: Log in to GitHub Container Registry | |
| uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Get build tag | |
| id: date | |
| run: echo "tag=$(date +'%Y%m%d').${{ github.run_number }}" >> $GITHUB_OUTPUT | |
| # Build is skipped if Trivy exits with code 1 | |
| - name: Build and push Docker image | |
| uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 | |
| with: | |
| context: . | |
| push: true | |
| tags: | | |
| ghcr.io/${{ github.repository_owner }}/episodeguard:latest | |
| ghcr.io/${{ github.repository_owner }}/episodeguard:${{ steps.date.outputs.tag }} | |
| build-args: | | |
| BUILD_DATE=${{ steps.date.outputs.tag }} | |
| VERSION=${{ steps.date.outputs.tag }} | |
| REVISION=${{ github.sha }} | |
| - name: Run Trivy image scan | |
| uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0 | |
| with: | |
| scan-type: 'image' | |
| image-ref: 'ghcr.io/${{ github.repository_owner }}/episodeguard:${{ steps.date.outputs.tag }}' | |
| format: 'table' | |
| severity: 'HIGH,CRITICAL' | |
| exit-code: '1' # Fails the pipeline if findings match severity criteria | |
| ignore-unfixed: true # Excludes flaws with no vendor patch yet | |
| trivyignores: './.trivyignore' | |
| - name: Delete old package versions (keep last 3) | |
| uses: actions/delete-package-versions@e5bc658cc4c965c472efe991f8beea3981499c55 # v5 | |
| with: | |
| package-name: episodeguard | |
| package-type: container | |
| min-versions-to-keep: 3 | |
| ignore-versions: latest |