master-ci.yml

# Run jobs on anything pushed or tagged on the master branch
# PyPi is not here, because we only want that on releases/tags
name: MasterCI

on:
  release:
    types: [published, prereleased, edited]
  push:
    branches:
      - master
  pull_request:

jobs:
  push-images:
    runs-on: ubuntu-latest
    permissions:
      packages: write
    env:
      IMAGE_DESCRIPTION: Building thousands of models with timeseries data to monitor systems
      IMAGE_LICENSE: AGPL-3.0
      IMAGE_HOME_URL: https://github.com/equinor/gordo
      DOCKER_REGISTRY: ghcr.io
    if: ${{ github.event_name != 'pull_request' || (!github.event.pull_request.draft && !github.event.pull_request.head.repo.fork)}}
    steps:
      - uses: actions/checkout@v1

      - name: Prepare variables
        id: prep
        run: |
          python3 scripts/github_docker.py -r equinor -i gordo-base

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v1

      - name: Login to CR
        uses: docker/login-action@v1
        if: ${{ steps.prep.outputs.login_cr }}
        with:
          registry: ${{ env.DOCKER_REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build base image
        uses: docker/build-push-action@v2
        with:
          context: .
          file: ./Dockerfile
          tags: ${{ steps.prep.outputs.base_image }}
          load: true

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@0.20.0
        with:
          image-ref: ${{ steps.prep.outputs.base_image }}
          format: 'table'
          exit-code: '10'
          ignore-unfixed: true
          hide-progress: true
          severity: 'HIGH,CRITICAL'
          timeout: 5m

      - name: Push gordo-base
        uses: docker/build-push-action@v2
        if: ${{ steps.prep.outputs.push_image }}
        with:
          push: true
          context: .
          file: ./Dockerfile
          tags: ${{ steps.prep.outputs.tags_gordo_base }}
          labels: |
            org.opencontainers.image.title=Gordo
            org.opencontainers.image.description=${{ env.IMAGE_DESCRIPTION }}
            org.opencontainers.image.source=${{ env.IMAGE_HOME_URL }}
            org.opencontainers.image.version=${{ steps.prep.outputs.version }}
            org.opencontainers.image.created=${{ steps.prep.outputs.created }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.licenses=${{ env.IMAGE_LICENSE }}