docker-release.yml

name: Docker CI Release

on:
  pull_request:
    branches: main
  push:
    branches: main
    tags:
      - v*

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      -
        name: "Git: Checkout"
        uses: actions/checkout@v4
      -
        name: "Docker: Setup QEMU"
        id: qemu
        uses: docker/setup-qemu-action@v3
      -
        name: "Docker: Setup Buildx"
        id: buildx
        uses: docker/setup-buildx-action@v3.3.0
      -
        name: "Docker: Available Platforms"
        run: echo ${{ steps.buildx.outputs.platforms }}
      -
        name: "Env: Prepare"
        id: prepare
        run: |
          PLATFORMS=linux/amd64,linux/arm64,linux/arm/v7

          REPONAME=$(basename $GITHUB_REPOSITORY)
          DOCKER_IMAGE=padhihomelab/${REPONAME#docker_}

          VERSION=testing
          if [[ $GITHUB_REF == refs/tags/* ]]; then
            VERSION=${GITHUB_REF#refs/tags/v}
            VERSION=${VERSION#_}
          fi

          TAGS="${DOCKER_IMAGE}:${VERSION}"
          if [[ $VERSION =~ ^(((([0-9]{1,3}\.){,3}[0-9]{1,4})|(git\..*))_){,4}((([0-9]{1,3}\.){,3}[0-9]{1,4})|(git\..*))(-p[0-9]{1,2})?$ ]]; then
            TAGS="$TAGS,${DOCKER_IMAGE}:latest"
          fi

          echo ::set-output name=args::VERSION=${VERSION} \
                                       --build-arg BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ') \
                                       --build-arg VCS_REF=${GITHUB_SHA::8}
          echo ::set-output name=image::${DOCKER_IMAGE}
          echo ::set-output name=platforms::${PLATFORMS}
          echo ::set-output name=tags::${TAGS}
          echo ::set-output name=version::${VERSION}
      -
        name: "Docker: Buildx Build"
        uses: docker/build-push-action@v5.4.0
        with:
          platforms: ${{ steps.prepare.outputs.platforms }}
          push: false
          tags: ${{ steps.prepare.outputs.tags }}
          build-args: ${{ steps.prepare.outputs.args }}
      -
        name: "Docker: Load Image"
        uses: docker/build-push-action@v5.4.0
        with:
          load: true
          push: false
          tags: ${{ steps.prepare.outputs.tags }}
          build-args: ${{ steps.prepare.outputs.args }}
      -
        name: "Anchore Scan: Run"
        id: scan
        uses: anchore/scan-action@v3
        with:
          image: "${{ steps.prepare.outputs.image }}:${{ steps.prepare.outputs.version }}"
          acs-report-enable: true
          fail-build: false
          severity-cutoff: "critical"
      -
        name: "Anchore Scan: Report"
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ steps.scan.outputs.sarif }}
      -
        name: "Docker Hub: Login"
        if: success() && github.event_name != 'pull_request'
        uses: docker/login-action@v3.2.0 
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
      -
        name: "Docker: Buildx Push"
        if: success() && github.event_name != 'pull_request'
        uses: docker/build-push-action@v5.4.0
        with:
          platforms: ${{ steps.prepare.outputs.platforms }}
          push: true
          tags: ${{ steps.prepare.outputs.tags }}
          build-args: ${{ steps.prepare.outputs.args }}
      -
        name: "Docker Hub: Update description"
        if: success() && github.event_name != 'pull_request'
        uses: peter-evans/dockerhub-description@v4
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }}
          DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
          DOCKERHUB_REPOSITORY: ${{ steps.prepare.outputs.image }}
      -
        name: "Clean up"
        if: always()
        run: |
          rm -f ${HOME}/.docker/config.json