build.yml

# Copyright 2018-2020 The OpenEBS Authors. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
name: build

on: ['push']

jobs:
  linux-utils:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v2

      - name: Set Image Org
        # sets the default IMAGE_ORG to openebs
        run: |
          [ -z "${{ secrets.IMAGE_ORG }}" ] && IMAGE_ORG=openebs || IMAGE_ORG=${{ secrets.IMAGE_ORG}}
          echo "IMAGE_ORG=${IMAGE_ORG}" >> $GITHUB_ENV

      - name: Set CI Tag
        run: |
          BRANCH="${GITHUB_REF##*/}"
          CI_TAG=${BRANCH#v}-ci
          if [ ${BRANCH} = "main" ]; then
            CI_TAG="ci"
          fi
          echo "TAG=${CI_TAG}" >> $GITHUB_ENV

      - name: Set Build Date
        id: date
        run: |
          echo "::set-output name=DATE::$(date -u +'%Y-%m-%dT%H:%M:%S%Z')"

      - name: Docker meta
        id: docker_meta
        uses: crazy-max/ghaction-docker-meta@v1
        with:
          # add each registry to which the image needs to be pushed here
          images: |
            ${{ env.IMAGE_ORG }}/linux-utils
            quay.io/${{ env.IMAGE_ORG }}/linux-utils
            ghcr.io/${{ env.IMAGE_ORG }}/linux-utils
          tag-latest: false
          tag-custom-only: true
          tag-custom: |
            ${{ env.TAG }}

      - name: Print Tags
        run: |
          echo "${{ steps.docker_meta.outputs.tags }}"

      - name: Setup QEMU
        uses: docker/setup-qemu-action@v1
        with:
          platforms: all

      - name: Setup Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v1
        with:
          version: v0.5.1

      - name: Login to DockerHub
        uses: docker/login-action@v1
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Login to Quay
        uses: docker/login-action@v1
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_TOKEN }}

      - name: Login to GHCR
        uses: docker/login-action@v1
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build & Push Image
        uses: docker/build-push-action@v2
        with:
          file: ./Dockerfile
          push: true
          platforms: linux/amd64, linux/arm64, linux/arm/v7, linux/ppc64le
          tags: |
            ${{ steps.docker_meta.outputs.tags }}
          build-args: |
            DBUILD_DATE=${{ steps.date.outputs.DATE }}
            DBUILD_REPO_URL=https://github.com/openebs/linux-utils
            DBUILD_SITE_URL=https://openebs.io
        
  trivy:
    runs-on: ubuntu-latest
    needs: ['linux-utils']
    steps:
      - name: Checkout code
        uses: actions/checkout@v2
        
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          # the tag will be always ci since only main branch is present
          # in this repository
          image-ref: 'openebs/linux-utils:ci'
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          severity: 'CRITICAL,HIGH'