push-to-docker-hub.yml

name: Build, scan and push to Docker Hub
# intended as shared workflow to be included in other repo workflows, 
# not triggered by direct pushes to this repo. ie. its an action library function

on:
  workflow_call:
    inputs:
      image_name:
        description: 'Override the default name for the Docker image.'
        default: ${{ github.repository }}
        required: false
        type: string
      version:
        description: 'Optional version tag for the Docker image.'
        required: false
        type: string
      context:
        description: 'Docker build context if different from the root of the repo.'
        required: false
        default: '.'
        type: string
    secrets:
      DOCKER_HUB_USERNAME:
        required: true
      DOCKER_HUB_ACCESS_TOKEN:
        required: true

env:
  TEST_TAG: ${{ inputs.image_name }}:${{ github.sha }}

jobs:
  push_to_docker_hub:
    name: Push Docker image to Docker Hub
    # This uses the default metadata-action configuration, see https://github.com/docker/metadata-action
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repo
        uses: actions/checkout@v2

      - name: Set up Docker metadata
        id: meta
        uses: docker/metadata-action@v3
        with:
          images: |
            ${{ inputs.image_name }}
            ghcr.io/${{ inputs.image_name }}

      - name: Log in to the GitHub Container registry
        uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Log in to Docker Hub
        if: github.event_name != 'pull_request'
        uses: docker/login-action@v1
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}

      - name: Build and export to Docker for testing
        uses: docker/build-push-action@v2
        with:
          context: ${{ inputs.context }}
          load: true
          tags: ${{ env.TEST_TAG }}

      - name: Run Trivy vulnerability scanner, logging to console
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: '${{ env.TEST_TAG }}'
          format: 'table'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'
          timeout: '30m'
  
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: '${{ env.TEST_TAG }}'
          format: 'sarif'
          output: 'trivy-results.sarif'
          #exit-code: '1' This seems to be causing problems at present, failing even when there are no problems
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'HIGH,CRITICAL'
          timeout: '30m'
          
      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results.sarif'

      - name: Build and push to Docker Hub
        uses: docker/build-push-action@v2
        with:
          context: ${{ inputs.context }}
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: VERSION=${{ inputs.version }}