action.yaml

inputs:
  IMAGE_REPOSITORY:
    required: true
  BUILD_CONTEXT:
    required: true
  BUILD_TARGET:
    description: "Sets the target stage to build"
    required: false
  IMAGE_NAME:
    required: true
  REGISTRY_JSON_KEY:
    required: true
  SECURITY_SCAN:
    type: "boolean"
    default: "true"
  BUILD_ARGS:
    description: All build args
    required: false
  SKIP_CHECKOUT:
    description: "Allows to skip checkout to generate Dockerfile manually"
    type: "boolean"
    default: "false"

runs:
  using: "composite"
  steps:
  - name: Check inputs
    shell: bash
    run: |
      if [ -z "${{inputs.IMAGE_REPOSITORY}}" ]; then echo "inputs.IMAGE_REPOSITORY is missing"; exit=1; fi
      if [ -z "${{inputs.BUILD_CONTEXT}}" ]; then echo "inputs.BUILD_CONTEXT is missing"; exit=1; fi
      if [ -z "${{inputs.IMAGE_NAME}}" ]; then echo "inputs.IMAGE_NAME is missing"; exit=1; fi
      if [ -z "${{inputs.REGISTRY_JSON_KEY}}" ]; then echo "inputs.REGISTRY_JSON_KEY is missing"; exit=1; fi
      if [ -n "$exit" ]; then exit 1; fi

  - name: Checkout code
    if: inputs.SKIP_CHECKOUT == 'false'
    uses: actions/checkout@v3.5.2

  - name: Docker meta
    id: meta
    uses: docker/metadata-action@v3
    with:
      images: ${{ inputs.IMAGE_REPOSITORY }}/${{inputs.IMAGE_NAME}}
      tags: |
        type=ref,event=branch
        type=ref,event=pr
        type=ref,event=tag
        type=semver,pattern={{version}}
        type=semver,pattern={{major}}.{{minor}}
        type=sha

  - name: Set up Docker Buildx
    id: buildx
    uses: docker/setup-buildx-action@v3.0.0

  - name: Login to registry
    uses: docker/login-action@v1
    with:
      registry: ${{ inputs.IMAGE_REPOSITORY }}
      username: _json_key
      password: ${{ inputs.REGISTRY_JSON_KEY }}

  # Only if SECURITY_SCAN :
  # build and pull result
  # scan
  - name: Build image localy first
    if: inputs.SECURITY_SCAN == 'true'
    uses: docker/build-push-action@v5.0.0
    id: docker_build
    with:
      context: ${{inputs.BUILD_CONTEXT}}
      tags: local
      pull: true
      build-args: ${{ inputs.BUILD_ARGS }}
      target: ${{ inputs.BUILD_TARGET }}
      load: true
      cache-from: |
        type=gha,scope=${{github.ref}}
        type=gha,scope=refs/heads/main
      cache-to: |
        type=gha,scope=${{github.ref}},mode=max

  - name: create empty .trivyignore if file is missing
    if: inputs.SECURITY_SCAN == 'true'
    shell: bash
    run: touch .trivyignore

  - name: Run Trivy vulnerability scanner
    if: inputs.SECURITY_SCAN == 'true'
    uses: aquasecurity/trivy-action@master
    with:
      image-ref: local
      format: "table"
      exit-code: "1"
      ignore-unfixed: true
      vuln-type: "os,library"
      severity: "CRITICAL,HIGH"
      trivyignores: .trivyignore

  # if SECURITY_SCAN was done, image is already build, else we build it now
  - name: Build image and push to registry
    uses: docker/build-push-action@v5.0.0
    id: docker_build_push
    with:
      context: ${{inputs.BUILD_CONTEXT}}
      tags: ${{ steps.meta.outputs.tags }}
      target: ${{ inputs.BUILD_TARGET }}
      push: true
      cache-from: |
        type=gha,scope=${{github.ref}}
        type=gha,scope=refs/heads/main
      cache-to: |
        type=gha,scope=${{github.ref}},mode=max

  - name: Image digest
    shell: bash
    run: echo ${{ steps.docker_build_push.outputs.digest }}