build.yaml

name: Image Build

on:
  push:
    branches:
      - '**'
    tags:
      - 'v*.*.*'
  pull_request:
    branches:
      - 'master'

jobs:
  Build:
    runs-on: ubuntu-20.04
    steps:
    - uses: actions/checkout@v2
    - name: Docker meta for KubeSphere
      id: meta
      if: github.repository_owner == 'kubesphere'
      uses: docker/metadata-action@v3
      with:
        images: |
          kubespheredev/s2irun
          ghcr.io/${{ github.repository_owner }}/s2irun
        tags: |
          type=schedule
          type=ref,event=branch
          type=ref,event=pr
          type=semver,pattern={{raw}}
          type=sha
    - name: Docker meta for Contributors
      id: metaContributors
      if: github.repository_owner != 'kubesphere'
      uses: docker/metadata-action@v3
      with:
        images: |
          ghcr.io/${{ github.repository_owner }}/s2irun
        tags: |
          type=schedule
          type=ref,event=branch
          type=ref,event=pr
          type=semver,pattern={{raw}}
          type=sha
    - name: Set up QEMU
      uses: docker/setup-qemu-action@v1
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v1
    - name: Login to DockerHub
      if: github.event_name != 'pull_request'
      uses: docker/login-action@v1
      with:
        username: ${{ secrets.DOCKER_HUB_USER }}
        password: ${{ secrets.DOCKER_HUB_SECRETS }}
    - name: Login to GHCR
      if: github.event_name != 'pull_request'
      uses: docker/login-action@v1
      with:
        registry: ghcr.io
        username: ${{ github.repository_owner }}
        password: ${{ secrets.GHCR_TOKEN }}
    - name: Build env
      id: build_env
      run: |
        if [ "${{ github.event_name }}" == "pull_request" ]
        then
            echo "::set-output name=platforms::linux/amd64"
            echo "::set-output name=push::false"
            echo "::set-output name=load::true"
        else
            echo "::set-output name=platforms::linux/amd64,linux/arm64"
            echo "::set-output name=push::true"
            echo "::set-output name=load::false"
        fi
        echo "::set-output name=short_sha::${GITHUB_SHA::7}"
    - name: Build and push Docker images
      uses: docker/build-push-action@v2.4.0
      if: github.repository_owner == 'kubesphere'
      with:
        context: .
        file: Dockerfile
        tags: ${{ steps.meta.outputs.tags }}
        push: ${{ steps.build_env.outputs.push }}
        load: ${{ steps.build_env.outputs.load }}
        labels: ${{ steps.meta.outputs.labels }}
        platforms: ${{ steps.build_env.outputs.platforms }}
    - name: Build and push Docker images for Contributors
      uses: docker/build-push-action@v2.4.0
      if: github.repository_owner != 'kubesphere'
      with:
        context: .
        file: Dockerfile
        tags: ${{ steps.metaContributors.outputs.tags }}
        push: ${{ steps.build_env.outputs.push }}
        load: ${{ steps.build_env.outputs.load }}
        labels: ${{ steps.metaContributors.outputs.labels }}
        platforms: ${{ steps.build_env.outputs.platforms }}
    - name: Run Trivy vulnerability scanner
      uses: aquasecurity/trivy-action@0.2.0
      if: github.event_name == 'pull_request'
      with:
        image-ref: 'ghcr.io/${{ github.repository_owner }}/s2irun:sha-${{ steps.build_env.outputs.short_sha }}'
        format: 'table'
        exit-code: '1'
        ignore-unfixed: true
        vuln-type: 'os,library'
        severity: 'CRITICAL,HIGH'