07-add-cve-scanning-adv.yaml

---
name: 07 Build and Scan + Report

on:
  push:
    branches:
      - main
  pull_request:

jobs:
  build-image:
    name: Build Images
    runs-on: ubuntu-latest

#NEW: (START) ##########################################################
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
#NEW: (END) ############################################################

    steps:

#NEW: (START) ##########################################################
      - name: Checkout git repo
        uses: actions/checkout@v4
#NEW: (END) ############################################################

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and export to Docker
        uses: docker/build-push-action@v6
        with:
          push: false
          load: true # Export to Docker Engine rather than pushing to a registry
          tags: ${{ github.run_id }}
          target: test
          cache-from: type=gha
          cache-to: type=gha,mode=max
          platforms: linux/amd64

      - name: Run Trivy for all CVEs (non-blocking)
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ github.run_id }}
          format: table 
          exit-code: 0

#NEW: (START) ##########################################################
      - name: Run Trivy for HIGH,CRITICAL CVEs and report (blocking)
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ github.run_id }}
          exit-code: 1
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'HIGH,CRITICAL'
          format: 'sarif'
          output: 'trivy-results.sarif'
      
      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: 'trivy-results.sarif'
#NEW: (END) ############################################################

      - name: Docker Metadata for Final Image Build
        id: docker_meta
        uses: docker/metadata-action@v5
        with:
          images: bretfisher/docker-ci-automation
          flavor: |
            latest=false
          tags: |
            type=raw,value=07
          # comment these out on all but 04-add-metadata.yaml to avoid overwriting image tags
          # type=raw,value=latest,enable=${{ endsWith(github.ref, github.event.repository.default_branch) }}
          # type=ref,event=pr
          # type=ref,event=branch
          # type=semver,pattern={{version}}
      
      - name: Docker Build and Push to Docker Hub
        uses: docker/build-push-action@v6
        with:
          push: true
          tags: ${{ steps.docker_meta.outputs.tags }}
          labels: ${{ steps.docker_meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          # comma seperated list of what OS and architechtures to build for (in parallel)
          # default is linux/amd64 (the OS of the runner) but you can add more
          # adding linux/arm64 is recommended for Apple Silicon, Raspberry Pi, AWS Graviton, etc.
          # linux/arm/v7 is for 32-bit ARM devices like Raspberry Pi 2/3
          platforms: linux/amd64,linux/arm64