Merge pull request #747 from finos/github-action-docker-scanner #8

	name: Publish Docker image

	on:
	workflow_dispatch: {}
	push:
	branches:
	- 'main'
	- 'dev'
	paths:
	- 'code/src/**'
	- 'code/package.json'
	- 'code/Dockerfile'
	- '.github/workflows/publish-docker.yml'

	jobs:
	docker-scan:
	name: ${{ github.event.repository.name }}-docker-scan
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v3
	- uses: docker-practice/actions-setup-docker@321477a1e481dd60b05f9b489cf4b9be467aa15c
	- name: Build
	run: docker build -f Dockerfile -t user/app:latest .
	working-directory: code
	- name: Scan for vulnerabilities
	uses: crazy-max/ghaction-container-scan@dfa7e54dc32045120f06d0bc8d7724860f5db0ad
	with:
	image: user/app:latest
	severity_threshold: HIGH
	push-to-registry:
	name: Push Docker image to Docker Hub
	needs: docker-scan
	runs-on: ubuntu-latest
	# save forks from having issue trying to publish to Docker
	# without the correct credentials
	if: github.repository_owner == 'finos'
	outputs:
	digest: ${{ steps.build_publish.outputs.digest }}
	steps:
	- name: Check out the repo
	uses: actions/checkout@v3

	- name: Log in to Docker Hub
	uses: docker/[email protected]
	with:
	username: finos
	password: ${{ secrets.DOCKER_PASSWORD }}

	- name: Extract metadata (tags, labels) for Docker
	id: meta
	uses: docker/[email protected]
	with:
	images: finos/a11y-theme-builder
	tags: \|
	type=ref,event=branch
	type=sha
	- name: Build and push Docker image
	id: build_publish
	uses: docker/[email protected]
	with:
	context: code
	push: true
	tags: ${{ steps.meta.outputs.tags }}
	labels: ${{ steps.meta.outputs.labels }}

Provide feedback