ci_bake.yml

name: Docker

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

on:
  push:
    branches: [ "main" ]
    # Publish semver tags as releases.
    tags: [ 'v*.*.*' ]
  pull_request:
    branches: [ "main" ]

env:
  # Use docker.io for Docker Hub if empty
  REGISTRY: docker.io
  DOCKER_USERNAME: argentinaluiz
  # github.repository as <account>/<repo>
  IMAGE_NAME: argentinaluiz/docker-ci-test
  SHA: ${{ github.event.pull_request.head.sha || github.event.after }}
  COMPARE_TAG: latest

jobs:
  ci:

    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      # This is used to complete the identity challenge
      # with sigstore/fulcio when running outside of PRs.
      id-token: write
      pull-requests: write
      security-events: write
      actions: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      # Install the cosign tool except on PR
      # https://github.com/sigstore/cosign-installer
      - name: Install cosign
        if: github.event_name != 'pull_request'
        uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0
        with:
          cosign-release: 'v2.2.4'

      # Set up BuildKit Docker container builder to be able to build
      # multi-platform images and export cache
      # https://github.com/docker/setup-buildx-action
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0

      # Login against a Docker registry except on PR
      # https://github.com/docker/login-action
      - name: Log into registry ${{ env.REGISTRY }}
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ env.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_TOKEN }}

      # Extract metadata (tags, labels) for Docker
      # https://github.com/docker/metadata-action
      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          labels: |
            org.opencontainers.image.revision=${{ env.SHA }}
          tags: |
            type=edge,branch=$repo.default_branch
            type=semver,pattern=v{{version}}
            type=sha,prefix=,suffix=,format=short

      # Build and push Docker image with Buildx (don't push on PR)
      # https://github.com/docker/build-push-action
      - name: Build CI
        id: build-ci
        uses: docker/bake-action@v6
        env:
          github_token: ${{ secrets.GITHUB_TOKEN }}
        with:
          push: false
          load: true
          targets: ci
          set: |
            ci.cache-from=type=gha
            ci.cache-to=type=gha,mode=max
            ci.tags=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:ci
          # tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:ci
          # cache-from: type=gha
          # cache-to: type=gha,mode=max
          # # tem como usar secrets como valor, env e files
          # #github_token=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
          # secrets: |
          #   github_token=${{ secrets.MY_GITHUB_TOKEN }}
          
      
      - name: Up containers
        run: docker compose -f ./nestjs-project/compose.ci.yaml up -d --build
      
      - name: Run tests
        run: echo "Running tests..."
      
      - name: Build for analysis
        id: build-for-analysis
        if: ${{ github.event_name == 'pull_request' }}
        uses: docker/bake-action@v6
        env:
          github_token: ${{ secrets.GITHUB_TOKEN }}
        with:
          push: false
          load: true
          targets: prod
          files: |
            ./docker-bake.hcl
            cwd://${{ steps.meta.outputs.bake-file }}
          set: |
            prod.cache-from=type=gha
            prod.cache-to=type=gha,mode=max
            prod.tags=${{ steps.meta.outputs.tags }}
      
      # - name: Analyze for critical and high CVEs
      #   id: docker-scout-cves
      #   uses: docker/scout-action@v1
      #   with:
      #     command: cves
      #     image: ${{ steps.meta.outputs.tags }}
      #     only-severities: critical,high
      #     summary: true
      #     exit-code: true
      #     only-fixed: true
      
      # - name: Analyze for all CVEs
      #   id: docker-scout-all-cves
      #   uses: docker/scout-action@v1
      #   with:
      #     command: cves
      #     image: ${{ steps.meta.outputs.tags }}
      #     summary: true
      #     sarif-file: sarif.output.json

      # - name: Upload SARIF result
      #   id: upload-sarif
      #   if: ${{ github.event_name != 'pull_request' }}
      #   uses: github/codeql-action/upload-sarif@v3
      #   with:
      #     sarif_file: sarif.output.json

      # # - name: Check if ":latest" tag exists
      # #   if: github.event_name == 'pull_request'
      # #   id: check-latest-exists
      # #   continue-on-error: true
      # #   run: |
      # #     docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
      
      # # - name: Docker Scout
      # #   id: docker-scout
      # #   if: ${{ github.event_name == 'pull_request' }}
      # #   uses: docker/scout-action@v1
      # #   with:
      # #     command: compare
      # #     image: ${{ steps.meta.outputs.tags }}
      # #     to: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.COMPARE_TAG }}
      # #     write-comment: true
      # #     ignore-unchanged: true
      # #     only-severities: critical,high
      # #     github-token: ${{ secrets.GITHUB_TOKEN }}
      
      - name: Build final
        id: build-final
        uses: docker/bake-action@v6
        env:
          github_token: ${{ secrets.GITHUB_TOKEN }}
        with:
          push: ${{ github.event_name != 'pull_request' }}
          provenance: mode=max
          sbom: true
          targets: prod
          files: |
            ./docker-bake.hcl
            cwd://${{ steps.meta.outputs.bake-file }}
          set: |
            prod.cache-from=type=gha
            prod.cache-to=type=gha,mode=max
            prod.tags=${{ steps.meta.outputs.tags }}
            
          
      
      

      # # Sign the resulting Docker image digest except on PRs.
      # # This will only write to the public Rekor transparency log when the Docker
      # # repository is public to avoid leaking data.  If you would like to publish
      # # transparency data even for private images, pass --force to cosign below.
      # # https://github.com/sigstore/cosign
      # - name: Sign the published Docker image
      #   if: ${{ github.event_name != 'pull_request' }}
      #   env:
      #     # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
      #     TAGS: ${{ steps.meta.outputs.tags }}
      #     DIGEST: ${{ steps.build-final.outputs.digest }}
      #   # This step uses the identity token to provision an ephemeral certificate
      #   # against the sigstore community Fulcio instance.
      #   run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}