docker-hub-parachain.yml

name: Publish features parachain to Docker Hub

on:
  workflow_dispatch:
  push:
   tags:
      - v[0-9]+.[0-9]+.[0-9]+*

jobs:
  hadolint:
    runs-on: [self-hosted, zeitgeist-runner]
    name: "Hadolint"
    steps:
      - uses: actions/checkout@v3
      - uses: hadolint/hadolint-action@v3.1.0
        with:
          dockerfile: "./Dockerfile"

  publish:
    needs: hadolint
    name: Publish
    runs-on: [self-hosted, zeitgeist-runner]
    steps:
      - uses: actions/checkout@v3
      - name: Checkout repository
        id: vars
        run: echo "tag=${GITHUB_REF#refs/*/}" >> $GITHUB_OUTPUT

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v3
        with:
          flavor: |
            latest=true
          images: |
            zeitgeistpm/zeitgeist-node-parachain
          tags: |
            type=semver,pattern={{version}}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v1

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v1

      - name: Login to DockerHub
        uses: docker/login-action@v1 
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}

      - name: Build and push
        uses: docker/build-push-action@v3.2.0
        with:
          build-args: |
            PROFILE=production
            FEATURES=parachain
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
      
      - name: Trivy Scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'zeitgeistpm/zeitgeist-node-parachain:latest'
          format: 'sarif'
          output: 'zeitgeist-node-parachain-report.sarif'
          severity: 'HIGH,CRITICAL'
            
      - name: Update image version of the existing Zeitgeist network spec
        uses: "OnFinality-io/action-onf-release@v1"
        with:
          onf-access-key: ${{ secrets.ONF_ACCESS_KEY }}
          onf-secret-key: ${{ secrets.ONF_SECRET_KEY }}
          onf-workspace-id: ${{ secrets.ONF_WORKSPACE_ID }}
          onf-network-key: ${{ secrets.ONF_NETWORK_KEY_ZG }}
          onf-sub-command: image
          onf-action: add
          image-version: ${{ steps.vars.outputs.tag }}
          
      - name: Update image version of the existing Battery Station network spec
        uses: "OnFinality-io/action-onf-release@v1"
        with:
          onf-access-key: ${{ secrets.ONF_ACCESS_KEY }}
          onf-secret-key: ${{ secrets.ONF_SECRET_KEY }}
          onf-workspace-id: ${{ secrets.ONF_WORKSPACE_ID }}
          onf-network-key: ${{ secrets.ONF_NETWORK_KEY_BS }}
          onf-sub-command: image
          onf-action: add
          image-version: ${{ steps.vars.outputs.tag }}