build_publish_image_autoinstrumentation.yaml

name: "Publish APM Python Auto-Instrumentation"

on:
  push:
    branches:
      - NH-100298-docker-scout-autoinst-image
  workflow_dispatch:

permissions:
  packages: write
  contents: write
  id-token: write

jobs:
  docker_hub:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Read solarwinds_apm version requirement
        run: echo VERSION=$(head -n 1 image/requirements-nodeps.txt | cut -d '=' -f3) >> $GITHUB_ENV

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log into Docker.io
        uses: docker/#-action@v3
        if: ${{ github.event_name == 'push' }}
        with:
          username: ${{ secrets.DOCKER_HUB_CI_USER }}
          password: ${{ secrets.DOCKER_HUB_CI_PASSWORD }}

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v4
        with:
          images: ${{ github.repository_owner }}/autoinstrumentation-python
          tags: |
            type=raw,value=${{ env.VERSION }}
            type=raw,value=latest
          labels: |
            maintainer=swo-librarians
            org.opencontainers.image.title=apm-python
            org.opencontainers.image.description=Solarwinds OTEL distro Python agent
            org.opencontainers.image.vendor=SolarWinds Worldwide, LLC

      - name: Login to GitHub Package Registry
        uses: docker/#-action@v3
        if: ${{ github.event_name == 'push' }}
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          push: true
          context: image
          platforms: linux/amd64,linux/arm64
          build-args: version=${{ env.VERSION }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

      - name: Analyze for critical and high CVEs - local Dockerfile
        id: docker-scout-cves
        uses: docker/scout-action@v1
        with:
          command: cves
          image: "fs://./"
          platform: "linux/amd64"
          ignore-base: true
          only-package-types: pip

      - name: Analyze for critical and high CVEs - tagged image
        id: docker-scout-image-cves
        uses: docker/scout-action@v1
        with:
          command: cves
          image: ${{ steps.meta.outputs.tags[0] }}
          platform: "linux/amd64"
  

  ghcr_io:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Read solarwinds_apm version requirement
        run: echo VERSION=$(head -n 1 image/requirements-nodeps.txt | cut -d '=' -f3) >> $GITHUB_ENV

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GitHub Package Registry
        uses: docker/#-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          push: true
          context: image
          platforms: linux/amd64,linux/arm64
          build-args: version=${{ env.VERSION }}
          tags: ghcr.io/${{ github.repository_owner }}/autoinstrumentation-python:${{ env.VERSION }},ghcr.io/${{ github.repository_owner }}/autoinstrumentation-python:latest