name: Sample Orca Container Image Scan Workflow
on:
  # Scan for each push event on your protected branch. If you have a different branch configured, please adjust the configuration accordingly by replacing 'main'.
  push:
    branches: [ "main" ]
  # NOTE: To enable scanning for pull requests, uncomment the section below.
  #pull_request:
    #branches: [ "main" ]
  # NOTE: To schedule a daily scan at midnight, uncomment the section below.
  #schedule:
    #- cron: '0 0 * * *'
jobs:
  orca-container_scan:
    name: Orca Container Image Scan
    runs-on: ubuntu-latest
    env:
      PROJECT_KEY: <project key> # Set the desired project to run the cli scanning with
    steps:
      # Checkout your repository under $GITHUB_WORKSPACE, so your job can access it
      - name: Checkout Repository
        uses: actions/checkout@v4

      - name: Run Orca Container Image Scan
        uses: orcasecurity/shiftleft-container-image-action@v1
        with:
          api_token: ${{ secrets.ORCA_SECURITY_API_TOKEN }}
          project_key: ${{ env.PROJECT_KEY }}
          image: <image to scan>
          output:
            "results/"

name: Image Build, Scan and Upload Sarif

on: [pull_request]

jobs:
    build-cli:
      name: build-cli
      runs-on: ubuntu-latest
      permissions:
        security-events: write
      env: 
        IMAGE_NAME: <image name>
        PROJECT_KEY: <project key> # Set the desired project to run the cli scanning with
      
      steps:
      # checks-out your repository under $GitHub_WORKSPACE, so your workflow can access it.
      - name: Checkout
        uses: actions/checkout@v2
      
      # Build your docker image, that is going to be scanned in the next step
      - name: Docker Image Build
        run: docker build -t $IMAGE_NAME .
  

      - name: Run Orca Container Image Scan
        uses: orcasecurity/shiftleft-container-image-action@v1
        id: orcasecurity_container_image_scan
        with:
          api_token: ${{ secrets.ORCA_SECURITY_API_TOKEN }}
          project_key: ${{ env.PROJECT_KEY }}
          image: <image to scan>
          format: "sarif"
          output:
            "results/"
      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@v3
        if: ${{ always() && steps.orcasecurity_container_image_scan.outputs.exit_code != 1 }}
        with:
          sarif_file: results/image.sarif