ci.yml

name: CI

on:
  push:
    branches:
      - 'release/**'
  pull_request:

jobs:
  ci:
    name: Build PHP Image

    runs-on: ubuntu-latest

    continue-on-error: false

    steps:
      -   name: "Checkout code"
          uses: actions/checkout@v3

      -   name: Lint Dockerfile
          uses: hadolint/hadolint-action@v3.0.0
          with:
            dockerfile: "Dockerfile"
            format: "tty"
            no-color: "true"
            output-file: "/dev/stdout"

      -   name: "Build Alpine"
          run: >
            ./build_images.sh temporary-build-image

      -   name: "PHP_VERSION Env"
          run: echo "PHP_VERSION=`docker run --pull=never --rm -t temporary-build-image-linux-amd64 php --version | head -n 1 | cut -f 2 -d ' '`" >> $GITHUB_ENV

      -   name: Tag also with php:${{ env.PHP_VERSION }}
          run: docker tag temporary-build-image-linux-amd64 php-${{ env.PHP_VERSION }}

      -   name: "Check Alpine -i"
          run: docker run --pull=never --rm -t php-${{ env.PHP_VERSION }} php -i

      -   name: "Check Alpine -v"
          run: docker run --pull=never --rm -t php-${{ env.PHP_VERSION }} php -v

      -   name: "Run Tests"
          run: tests/run_tests.sh
          env:
            DOCKER_REGISTRY_IMAGE: "temporary-build-image-linux-amd64"

      -   name: Run Alpine Trivy vulnerability scanner
          uses: aquasecurity/trivy-action@0.24.0
          env:
            TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
          with:
            image-ref: php-${{ env.PHP_VERSION }}
            format: 'table'
            exit-code: '0' # we don't break the build if vulnerabilities are included!
            ignore-unfixed: true
            vuln-type: 'os,library'
            severity: 'CRITICAL,HIGH'

      -   if: contains(github.ref, 'refs/heads/release/')
          name: Run Alpine Trivy vulnerability scanner and upload to github security tab
          uses: aquasecurity/trivy-action@0.24.0
          env:
            TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
          with:
            image-ref: php-${{ env.PHP_VERSION }}
            format: 'sarif'
            output: 'trivy-results.sarif'

      -   if: contains(github.ref, 'refs/heads/release/')
          name: Upload Sarif results to GitHub Security tab
          uses: github/codeql-action/upload-sarif@v2
          with:
            sarif_file: 'trivy-results.sarif'
#
      -   if: contains(github.ref, 'refs/heads/release/')
          name: Run Trivy in GitHub SBOM mode and submit results to Dependency Snapshots
          uses: aquasecurity/trivy-action@0.24.0
          env:
            TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
          with:
            format: 'github'
            output: 'dependency-results.sbom.json'
            image-ref: 'temporary-build-image-linux-amd64'
            github-pat: ${{ secrets.PAT }}
      -   if: contains(github.ref, 'refs/heads/release/')
          name: Login to DockerHub
          uses: docker/login-action@v2
          with:
            username: ${{ secrets.DOCKER_USERNAME }}
            password: ${{ secrets.DOCKER_PASSWORD }}

      -   if: contains(github.ref, 'refs/heads/release/')
          name: Login to Quay.io
          uses: docker/login-action@v2
          with:
            registry: quay.io
            username: ${{ secrets.QUAY_USERNAME }}
            password: ${{ secrets.QUAY_PASSWORD }}

      -   if: contains(github.ref, 'refs/heads/release/')
          name: Login to ghcr.io
          uses: docker/login-action@v2
          with:
            registry: ghcr.io
            username: ${{ github.actor }}
            password: ${{ secrets.GITHUB_TOKEN }}

      -   if: contains(github.ref, 'refs/heads/release/')
          name: "Build and Push Multi Arch PHP"
          env:
            GHCR_DOCKER_IMAGE_NAME: ghcr.io/endava/docker-php:${{ env.PHP_VERSION }}
            QUAY_DOCKER_IMAGE_NAME: quay.io/endava/php:${{ env.PHP_VERSION }}
          run: ./build_and_push_multi_arch_images.sh endava/php:${{ env.PHP_VERSION }}