Refactor image build to use a matrix build, add security scanning

.github/workflows/build_docker_images.yml

@@ -34,67 +34,24 @@ on:
     tags: [v*]
 
 jobs:
-  create_frontend_docker_image:
+  create_docker_images:
     runs-on: ubuntu-latest
-    env:
-      REGISTRY: ghcr.io
-      IMAGE_NAME: sartography/spiffworkflow-frontend
-      BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Check out the repository
-        uses: actions/checkout@v4
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Log in to the Container registry
-        uses: docker/[email protected]
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+    strategy:
+      matrix:
+        include:
+          - image_name: sartography/spiffworkflow-frontend
+            context: spiffworkflow-frontend
+            description: "Frontend component of SpiffWorkflow, a software development platform for building, running, and monitoring executable diagrams"
+          - image_name: sartography/spiffworkflow-backend
+            context: spiffworkflow-backend
+            description: "Backend component of SpiffWorkflow, a software development platform for building, running, and monitoring executable diagrams"
+          - image_name: sartography/connector-proxy-demo
+            context: connector-proxy-demo
+            description: "spiffworkflow-connector-proxy-demo"
 
-      - name: Get current date
-        id: date
-        run: echo "date=$(date -u +'%Y-%m-%d_%H-%M-%S')" >> "$GITHUB_OUTPUT"
-      - name: Get short commit sha
-        id: commit_sha
-        run: echo "sha_short=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
-      - name: Extract metadata (tags, labels) for Docker
-        id: meta
-        uses: docker/[email protected]
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          labels: |
-            org.opencontainers.image.description=Frontend component of SpiffWorkflow, a software development platform for building, running, and monitoring executable diagrams
-            org.opencontainers.image.version=${{ env.BRANCH_NAME }}-${{ steps.date.outputs.date }}-${{ steps.commit_sha.outputs.sha_short }}
-          tags: |
-            type=ref,event=branch,branch=main,suffix=-latest
-            type=ref,event=branch,suffix=-${{ steps.date.outputs.date }}-${{ steps.commit_sha.outputs.sha_short }}
-            type=ref,event=tag,enable=true,format={{version}}
-            type=ref,event=tag,enable=true,format=latest
-
-      - name: Write app version info
-        working-directory: spiffworkflow-frontend
-        run: echo "$DOCKER_METADATA_OUTPUT_JSON" | jq '.labels' > version_info.json
-      - name: Build and push Frontend Docker image
-        uses: docker/[email protected]
-        with:
-          # this action doesn't seem to respect working-directory so set context
-          context: spiffworkflow-frontend
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          platforms: linux/amd64,linux/arm64
-      - run: echo 'TAGS' >> "$GITHUB_STEP_SUMMARY"
-      - run: echo 'TAGS ${{ steps.meta.outputs.tags }}' >> "$GITHUB_STEP_SUMMARY"
-
-  create_backend_docker_image:
-    runs-on: ubuntu-latest
     env:
       REGISTRY: ghcr.io
-      IMAGE_NAME: sartography/spiffworkflow-backend
+      IMAGE_NAME: ${{ matrix.image_name }}
       BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
     permissions:
       contents: read
@@ -123,7 +80,7 @@ jobs:
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           labels: |
-            org.opencontainers.image.description=Backend component of SpiffWorkflow, a software development platform for building, running, and monitoring executable diagrams
+            org.opencontainers.image.description=${{ matrix.description }}
             org.opencontainers.image.version=${{ env.BRANCH_NAME }}-${{ steps.date.outputs.date }}-${{ steps.commit_sha.outputs.sha_short }}
           tags: |
             type=ref,event=branch,branch=main,suffix=-latest
@@ -132,67 +89,13 @@ jobs:
             type=ref,event=tag,enable=true,format=latest
 
       - name: Write app version info
-        working-directory: spiffworkflow-backend
+        working-directory: ${{ matrix.context }}
         run: echo "$DOCKER_METADATA_OUTPUT_JSON" | jq '.labels' > version_info.json
-      - name: Build and push Backend Docker image
-        uses: docker/[email protected]
-        with:
-          # this action doesn't seem to respect working-directory so set context
-          context: spiffworkflow-backend
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          platforms: linux/amd64,linux/arm64
-      - name: Adding markdown
-        run: echo 'TAGS ${{ steps.meta.outputs.tags }}' >> "$GITHUB_STEP_SUMMARY"
-
-  create_demo_proxy_docker_image:
-    runs-on: ubuntu-latest
-    env:
-      REGISTRY: ghcr.io
-      IMAGE_NAME: sartography/connector-proxy-demo
-      BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
-
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Check out the repository
-        uses: actions/checkout@v4
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Log in to the Container registry
-        uses: docker/[email protected]
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Get current date
-        id: date
-        run: echo "date=$(date -u +'%Y-%m-%d_%H-%M-%S')" >> "$GITHUB_OUTPUT"
-      - name: Get short commit sha
-        id: commit_sha
-        run: echo "sha_short=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
-      - name: Extract metadata (tags, labels) for Docker
-        id: meta
-        uses: docker/[email protected]
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          labels: |
-            org.opencontainers.image.description=spiffworkflow-connector-proxy-demo
-            org.opencontainers.image.version=${{ env.BRANCH_NAME }}-${{ steps.date.outputs.date }}-${{ steps.commit_sha.outputs.sha_short }}
-          tags: |
-            type=ref,event=branch,branch=main,suffix=-latest
-            type=ref,event=branch,suffix=-${{ steps.date.outputs.date }}-${{ steps.commit_sha.outputs.sha_short }}
-            type=ref,event=tag,enable=true,format={{version}}
-            type=ref,event=tag,enable=true,format=latest
 
-      - name: Build and push the connector proxy
+      - name: Build and push Docker image
         uses: docker/[email protected]
         with:
-          # this action doesn't seem to respect working-directory so set context
-          context: connector-proxy-demo
+          context: ${{ matrix.context }}
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
@@ -203,12 +106,7 @@ jobs:
   quickstart-guide-test:
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v')
-    needs:
-      [
-        create_frontend_docker_image,
-        create_backend_docker_image,
-        create_demo_proxy_docker_image,
-      ]
+    needs: [create_docker_images]
     steps:
       - name: Checkout
         uses: actions/checkout@v4