build.yaml

name: Build
on:
  push:
    branches:
      - main
  pull_request:
    types: [ opened, synchronize, reopened ]
jobs:
  build:
    name: Build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
        with:
          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
        env:
          REPO: '${{ github.event.repository.name }}'
      - name: Login to Public ECR
        if: github.event_name != 'pull_request'
        uses: docker/login-action@v1
        with:
          registry: public.ecr.aws
          username: ${{ secrets.AWS_ACCESS_KEY_ID }}
          password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      - name: Build image
        run: |
          docker build -t ${{ github.event.repository.name }} .
      - name: Trivy - List all vulnerabilities
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: '${{ github.event.repository.name }}'
          format: 'table'
          ignore-unfixed: true
          vuln-type: 'os,library'
        env:
          TRIVY_SKIP_DB_UPDATE: true
          TRIVY_SKIP_JAVA_DB_UPDATE: true
      - name: Trivy - Stop on Severe Vulnerabilities
        uses: aquasecurity/trivy-action@master
        if: github.event_name == 'pull_request'
        with:
          image-ref: '${{ github.event.repository.name }}'
          format: 'table'
          ignore-unfixed: true
          trivyignores: .github/workflows/.trivyignore
          exit-code: '1'
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'
        env:
          TRIVY_SKIP_DB_UPDATE: true
          TRIVY_SKIP_JAVA_DB_UPDATE: true
      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v4
        with:
          images: public.ecr.aws/dissco/${{ github.event.repository.name }}
          tags: |
            type=sha
            type=raw,value=latest
      - name: Build and Push to ECR
        uses: docker/build-push-action@v3
        with:
          context: .
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
      - name: Set outputs
        id: vars
        run: echo "::set-output name=sha_short::$(git rev-parse --short HEAD)"
      - name: Push tag
        if: github.event_name != 'pull_request'
        uses: anothrNick/github-tag-action@1.36.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CUSTOM_TAG: sha-${{ steps.vars.outputs.sha_short }}