forgejo-root-build-push-ghcr.yml

---
name: forgejo-build-push-ghcr

on:
  push:
    branches:
      - 'master'
    paths:
      - 'forgejo/**'
      - '.github/workflows/forgejo-root-build-push-ghcr.yml'
  pull_request:
    paths:
      - 'forgejo/**'
      - '.github/workflows/forgejo-root-build-push-ghcr.yml'
  workflow_dispatch:
  repository_dispatch:
  schedule:
    - cron: '0 12 15 * *'

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ghcr.io/${{ github.repository_owner }}/forgejo
  IMAGE_TAG: root
  IMAGE_ARCH: amd64,arm64
  REPO_CONTEXT: ./forgejo
  REPO_CONTAINERFILE: ./forgejo/Dockerfile

jobs:
  buildah:
    runs-on: ubuntu-latest
    permissions:
      actions: write
      packages: write
      contents: read
      security-events: write
    steps:
      -
        name: Cancel previous run in progress
        id: cancel-previous-runs
        uses: styfle/cancel-workflow-action@0.11.0
        with:
          ignore_sha: true
          all_but_latest: true
          access_token: ${{ secrets.GITHUB_TOKEN }}
      -
        name: Checkout
        id: repo-checkout
        uses: actions/checkout@v3
      -
        name: Set up QEMU
        id: setup-qemu
        uses: docker/setup-qemu-action@v2
      -
        name: Log in to registry
        id: registry-login
        uses: redhat-actions/podman-login@v1
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      -
        name: Build
        id: build-image
        uses: redhat-actions/buildah-build@v2
        with:
          image: ${{ env.IMAGE_NAME }}
          tags: ${{ env.IMAGE_TAG }}
          context: ${{ env.REPO_CONTEXT }}
          containerfiles: ${{ env.REPO_CONTAINERFILE }}
          archs: ${{ env.IMAGE_ARCH }}
      -
        name: Run Trivy vulnerability scanner
        id: trivy-scan
        uses: aquasecurity/trivy-action@master
        env:
          TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db
        with:
          scan-type: 'image'
          image-ref: ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'HIGH,CRITICAL'
          vuln-type: 'os,library'
          hide-progress: true
          ignore-unfixed: true
          exit-code: '0'
      -
        name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        if: always()
        with:
          sarif_file: 'trivy-results.sarif'
      -
        name: Push
        id: push-to-ghcr
        uses: redhat-actions/push-to-registry@v2
        with:
          image: ${{ steps.build-image.outputs.image }}
          tags: ${{ steps.build-image.outputs.tags }}
          registry: ${{ env.REGISTRY }}