container_image.dev.yaml

name: Dev Container Build

on:
  push:
    branches:
      - "**"
  workflow_dispatch:
    inputs:
      image-tag:
        description: |
          Supply a tag to push the image to ghcr.io with the given tag.  Without a tag, the workflow will not push,
          but only build the image.
        type: string
        required: false

permissions:
  contents: read
  packages: write

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repo
        uses: actions/checkout@v7

      - name: Login to Github Registry ghcr.io
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: image-info
        id: image-info
        run: |
          image_tag="local"
          [[ ${{ github.ref }} = 'refs/heads/develop' ]] && image_tag="dev"
          [[ -n "${{ inputs.image-tag }}" ]] && image_tag="${{ inputs.image-tag }}"
          image_url="${{ github.repository }}/mage:${image_tag}"
          echo "using image url ${image_url}"
          echo "tag=${image_tag}" >> $GITHUB_OUTPUT
          echo "url=ghcr.io/${image_url}" >> $GITHUB_OUTPUT

      - name: Build Docker image
        run: |
          docker build \
          -t ${{ steps.image-info.outputs.url }} \
          --annotation "org.opencontainers.image.revision=${{ github.sha }}" .

      - name: Scan the docker image with Trivy
        uses: aquasecurity/trivy-action@v0.35.0 
        with:
          scan-type: 'image'
          image-ref: '${{ steps.image-info.outputs.url }}'
          ignore-unfixed: true
          format: 'table'
          output: 'trivy-image-report.txt'
          exit-code: '0'
          version: 'v0.69.3'

      - name: Upload Trivy report
        uses: actions/upload-artifact@v7
        with:
          name: trivy-container-security-report
          path: trivy-image-report.txt
          retention-days: 7

      - name: Push Image
        if: ${{ steps.image-info.outputs.tag != 'local' }}
        run: |
          docker push ${{ steps.image-info.outputs.url }}