docker-build-and-push-workflow.yml

name: "Docker build and push"

on:
  workflow_call:
    inputs:
      docker-image-repo:
        description: Docker image repository
        type: string
        required: true
      publish:
        description: Publish(push) to image repository
        type: boolean
        default: false
      version:
        type: string
        required: false
        description: Semvers string. If empty, the ref/tag will be used (if on.tag trigger).
        default: ''
      latest-tag:
        type: boolean
        required: false
        description: Add latest flavor
        default: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/') }}
      upload-sarif-to-security:
        type: boolean
        required: false
        description: Upload Sarif reports to Github Security dashboard
        default: false

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - 
      name: Checkout
      uses: actions/checkout@v3
    - 
      name: Extract Docker metadata
      id: meta
      uses: docker/metadata-action@v4
      with:
        images: ${{ inputs.docker-image-repo }}
        tags: |
          type=semver,pattern={{version}},value=${{ inputs.version }}
          type=semver,pattern={{major}}.{{minor}},value=${{ inputs.version }}
          type=semver,pattern={{major}},value=${{ inputs.version }}
          type=ref,event=branch,suffix=-{{ sha }}
          type=ref,event=pr
          type=raw,value=latest,enable=${{ inputs.latest-tag }}
        flavor: |
          latest=false
    - 
      name: Set up QEMU
      uses: docker/setup-qemu-action@v2
    - 
      name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v2
    - 
      name: Build and export Docker image
      uses: docker/build-push-action@v3
      with:
        context: .
        platforms: linux/amd64
        outputs: type=docker,dest=/tmp/docker.tar
        push: false
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        cache-from: type=gha
        cache-to: type=gha,mode=max
    - 
      name: "Upload Docker tar"
      uses: actions/upload-artifact@v2
      with:
        name: docker
        path: /tmp/docker.tar
        retention-days: 1
    outputs:
      docker-meta-tags: ${{ steps.meta.outputs.tags }}
      docker-meta-labels: ${{ steps.meta.outputs.labels }}

  checkov-linter:
    runs-on: ubuntu-latest
    steps:
    - 
      name: Checkout
      uses: actions/checkout@v3
    - 
      name: Lint Dockerfile with Checkov
      id: checkov
      uses: bridgecrewio/checkov-action@master
      with:
        directory: .
        framework: dockerfile
        check: 'LOW,MEDIUM,HIGH,CRITICAL'
        quiet: false
        soft_fail: true
        output_format: sarif 
        download_external_modules: true
        output_file_path: reports/checkov-results.sarif
    - 
      name: "Upload Sarif report as artifact"
      uses: actions/upload-artifact@v2
      with:
        name: checkov-results
        path: reports/checkov-results.sarif
    - 
      name: Upload to GitHub Security
      uses: github/codeql-action/upload-sarif@v2
      if: ${{ inputs.upload-sarif-to-security }}
      with:
        sarif_file: 'reports/checkov-results.sarif'

  # trivy-vulnerability-scan:
  #   runs-on: ubuntu-latest
  #   needs: build
  #   steps:
  #   -  
  #     name: "Download Docker tar"
  #     uses: actions/download-artifact@v2
  #     with:
  #       name: docker
  #       path: .
  #   # - 
  #   #   name: "Load Docker tar"
  #   #   run: |
  #   #     docker image ls -a
  #   #     docker load --input docker.tar
  #   #     docker image ls -a
  #   - 
  #     name: Run Trivy vulnerability scanner
  #     uses: aquasecurity/trivy-action@master
  #     env:
  #       RIVY_OFFLINE_SCAN: true
  #     with:
  #       input: 'docker.tar'
  #       format: 'sarif'
  #       output: 'trivy-results.sarif'
  #       exit-code: '0'
  #       ignore-unfixed: true
  #       vuln-type: 'os,library'
  #       severity: 'CRITICAL'
  #       hide-progress: false
  #   - 
  #     name: "Upload Sarif report as artifact"
  #     uses: actions/upload-artifact@v2
  #     with:
  #       name: trivy-results
  #       path: trivy-results.sarif
  #   - 
  #     name: Upload to GitHub Security
  #     uses: github/codeql-action/upload-sarif@v2
  #     if: ${{ inputs.upload-sarif-to-security }}
  #     with:
  #       sarif_file: 'trivy-results.sarif'

  run-till-healthy:
    runs-on: ubuntu-latest
    needs: build
    steps:
    -  
      name: "Download Docker tar"
      uses: actions/download-artifact@v2
      with:
        name: docker
        path: /tmp
    - 
      name: "Load Docker tar"
      run: |
        docker load --input /tmp/docker.tar
        docker image ls -a
    - 
      name: Test Docker image
      run: |
        set -x
        if [ ${{ inputs.latest-tag }} == true ]
          then
            docker image inspect ${{ inputs.docker-image-repo }}:latest
            docker run --rm -p 8080:8080 -e dtap.stage=LOC --name=test -d ${{ inputs.docker-image-repo }}:latest
          else
            docker image inspect ${{ needs.build.outputs.docker-meta-tags }}
            docker run --rm -p 8080:8080 -e dtap.stage=LOC --name=test -d ${{ needs.build.outputs.docker-meta-tags }}
        fi

        sleep 30

        RETRY_COUNT=0
        HEALTH=$(docker inspect --format='{{json .State.Health.Status}}' test)
        until [ "$HEALTH" = '"healthy"' ]
        do
          if [ $RETRY_COUNT -gt 15 ]
            then
                docker inspect test
                docker logs test
                exit 1
          fi

          let RETRY_COUNT+=1
          HEALTH=$(docker inspect --format='{{json .State.Health.Status}}' test)
          sleep 15
        done

        docker inspect test
        docker logs test
      timeout-minutes: 5