docker-pr.yaml

name: Test ckan-pycsw images (PR)

on:
  pull_request:
    branches:
      - main
      - latest

env:
    REGISTRY: ghcr.io
    IMAGE_NAME: ${{ github.repository }}
    CONTEXT: .
    BRANCH: ${{ github.head_ref }}
    DOCKERFILE_PATH: /ckan-pycsw
    DOCKERFILE: Dockerfile
    HADOLINT_VERSION: 2.12.0

jobs:
  docker:
    name: runner/test-docker-pr:${{ github.head_ref }}
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Checkout
        uses: actions/checkout@v4

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v4
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          labels: |
            org.opencontainers.image.documentation=https://github.com/${{ github.repository }}/blob/${{ env.BRANCH }}/README.md
            org.opencontainers.image.version=${{ env.BRANCH }}

      - name: Build to test
        uses: docker/build-push-action@v5
        id: docker-push
        with:
            push: false
            tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.BRANCH }}
            labels: ${{ steps.meta.outputs.labels }}
            context: ${{ env.CONTEXT }}
            file: ${{ env.CONTEXT }}${{ env.DOCKERFILE_PATH }}/${{ env.DOCKERFILE }}

      - name: Linting Dockerfile and annotate code inline in the github PR viewer
        id: hadolint
        uses: jbergstroem/hadolint-gh-action@v1.11.0
        with:
          dockerfile: ${{ env.CONTEXT }}${{ env.DOCKERFILE_PATH }}/${{ env.DOCKERFILE }}
          version: ${{ env.HADOLINT_VERSION }}
          annotate: true
          error_level: -1

      - name: Run Trivy container image vulnerability scanner
        uses: aquasecurity/trivy-action@0.12.0
        with:
          image-ref:  ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.BRANCH }}
          format: sarif
          output: trivy-results.sarif
  
      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        if: always()
        with:
          sarif_file: trivy-results.sarif