build-publish-image.yml

name: Create, Scan and Publish KAITO image
on:
  pull_request:
    branches:
      - main
      - release-**
    types: [ closed ]

permissions:
  contents: write
  packages: write

env:
  REGISTRY: ghcr.io
  GO_VERSION: '1.20'
  IMAGE_NAME: 'workspace'

jobs:
  export-registry:
    if: github.event.pull_request.merged == true && contains(github.event.pull_request.title, 'update manifest and helm charts')
    runs-on: ubuntu-20.04
    outputs:
      registry: ${{ steps.export.outputs.registry }}
    steps:
      - id: export
        run: |
          # registry must be in lowercase
          echo "registry=$(echo "${{ env.REGISTRY }}/${{ github.repository }}" | tr [:upper:] [:lower:])" >> $GITHUB_OUTPUT

  publish-images:
    if: github.event.pull_request.merged == true && contains(github.event.pull_request.title, 'update manifest and helm charts')
    needs:
      - export-registry
    env:
      REGISTRY: ${{ needs.export-registry.outputs.registry }}
    runs-on: ubuntu-20.04
    steps:
      - id: get-tag
        name: Get tag
        run: echo "IMG_TAG=$(echo ${{ github.event.pull_request.head.ref }} | tr -d release-)" >> $GITHUB_ENV
      - uses: actions/checkout@v4
        with:
          submodules: true
          fetch-depth: 0
          ref: ${{ env.IMG_TAG }}

      - name: Login to ${{ env.REGISTRY }}
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Set Image tag
        run: |
          ver=${{ env.IMG_TAG }}
          echo "IMG_TAG=${ver#"v"}" >> $GITHUB_ENV
      - name: Build image
        run: |
          OUTPUT_TYPE=type=registry make docker-build-kaito
        env:
          VERSION: ${{ env.IMG_TAG }}

      - name: Scan ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMG_TAG }}
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMG_TAG }}
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'
          timeout: '5m0s'
        env:
          TRIVY_USERNAME: ${{ github.actor }}
          TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}

      - name: 'Dispatch release tag'
        uses: peter-evans/repository-dispatch@v1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          event-type: release-tag
          client-payload: '{"isRelease": true,"registry": "$${{ env.REGISTRY }}","tag": "v${{ env.IMG_TAG }}"}'