docker-publish.yml

name: Update image

on:
  workflow_dispatch: {}
  schedule:
    - cron:  '0 0 * * 0'

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}


jobs:
  build:

    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      security-events: write
      actions: read

    steps:
      - name: Checkout repository
        id: checkout
        uses: actions/checkout@v3
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v2
      - name: Setup Docker buildx
        id: buildx
        uses: docker/setup-buildx-action@v2
      - name: Available platforms
        id: platforms
        run: echo ${{ steps.buildx.outputs.platforms }}
      - name: Log into registry ${{ env.REGISTRY }}
        id: login
        uses: docker/login-action@v2
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GH_TOKEN }}
      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v4
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          flavor: |
            latest=true
          tags: |
            type=schedule,pattern={{date 'YYYYMMDD'}}
            type=raw,value=latest,enable={{is_default_branch}}
      - name: Build and Push
        id: build-and-push
        uses: docker/bake-action@v2
        with:
          files: |
            ./.github/workflows/docker-bake.hcl
            ${{ steps.meta.outputs.bake-file }}
          targets: build
          push: true
      - name: Run Trivy vulnerability scanner
        id: trivy
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}'
          format: 'sarif'
          output: 'trivy-results.sarif'
          ignore-unfixed: true
        env:
          TRIVY_USERNAME: ${{ github.actor }}
          TRIVY_PASSWORD: ${{ secrets.GH_TOKEN }}
      - name: Upload Trivy scan results to GitHub Security tab
        id: sarif
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results.sarif'