docker-latest.yml

name: Docker Image CI - Latest

on:
  push:
    branches: [main]
  schedule:
    # Once daily at midnight
    - cron: "0 0 * * *"
  workflow_dispatch:

env:
  REGISTRY: obswebsocketcommunity
  ARTIFACT: docker

jobs:
  build-test-push:
    runs-on: ubuntu-latest
    services:
      registry:
        image: registry:2
        ports:
          - 5000:5000
    steps:
      # Checkout the Repo
      - uses: actions/checkout@v2

      # Set FINAL_TAG in GITHUB_ENV
      - name: Set Tag
        run: |
          echo FINAL_TAG=$(date +%s) >> $GITHUB_ENV

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v1
        with:
          driver-opts: network=host

      # Login to docker and push image
      - name: Login to Docker Hub
        uses: docker/login-action@v1
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      # Build and Test/Verify images
      - name: Build and push secured image to local registry
        uses: docker/build-push-action@v2
        with:
          context: .
          file: Dockerfile.secured
          push: true
          tags: localhost:5000/${{ env.ARTIFACT }}:latest

      - name: Build and push unsecured image to local registry
        uses: docker/build-push-action@v2
        with:
          context: .
          file: Dockerfile.unsecured
          push: true
          tags: localhost:5000/${{ env.ARTIFACT }}:latest-unsecured

      - name: Set up Python
        uses: actions/setup-python@v2
        with:
          python-version: 3.9

      - name: Verify the secured build
        run: |
          chmod +x verify_build.sh && ./verify_build.sh localhost:5000/${{ env.ARTIFACT }} latest

      - name: Verify the unsecured build
        run: |
          chmod +x verify_build.sh && ./verify_build.sh localhost:5000/${{ env.ARTIFACT }} latest-unsecured unsecured

      - name: Build and push secured image
        id: docker_build_secured
        uses: docker/build-push-action@v2
        with:
          context: .
          file: Dockerfile.secured
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ env.ARTIFACT }}:latest
            ${{ env.REGISTRY }}/${{ env.ARTIFACT }}:${{ env.FINAL_TAG }}

      - name: Build and push unsecured image
        id: docker_build_unsecured
        uses: docker/build-push-action@v2
        with:
          context: .
          file: Dockerfile.unsecured
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ env.ARTIFACT }}:latest-unsecured
            ${{ env.REGISTRY }}/${{ env.ARTIFACT }}:${{ env.FINAL_TAG }}-unsecured