Update actions

.github/workflows/docker-main.yaml

@@ -0,0 +1,74 @@
+name: Build and push ckan-pycsw image from main push
+
+on:
+  push:
+    branches:
+      - main
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+  TAG: ghcr.io/${{ github.repository }}:${{ github.ref_name }}
+  CONTEXT: .
+  BRANCH: ${{ github.ref_name }}
+  DOCKERFILE_PATH: /ckan-pycsw
+  DOCKERFILE: Dockerfile
+
+jobs:
+  docker:
+    name: runner/build-docker-push:${{ github.ref_name }}
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push'
+
+    steps:
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Check out code
+        uses: actions/checkout@v4
+
+      - name: Login to registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@v4
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          labels: |
+            org.opencontainers.image.documentation=https://github.com/${{ github.repository }}/blob/${{ env.BRANCH }}/README.md
+            org.opencontainers.image.version=${{ env.BRANCH }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          push: true
+          tags: ${{ env.TAG }}
+          labels: ${{ steps.meta.outputs.labels }}
+          context: ${{ env.CONTEXT }}
+          file: ${{ env.CONTEXT }}${{ env.DOCKERFILE_PATH }}/${{ env.DOCKERFILE }}
+
+      - name: Linting Dockerfile with hadolint in GH Actions
+        uses: hadolint/[email protected]
+        with:
+          dockerfile: ${{ env.CONTEXT }}${{ env.DOCKERFILE_PATH }}/${{ env.DOCKERFILE }}
+
+      - name: Run Trivy container image vulnerability scanner
+        uses: aquasecurity/[email protected]
+        with:
+          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.BRANCH }}
+          format: sarif
+          output: trivy-results.sarif
+
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v2
+        if: always()
+        with:
+          sarif_file: trivy-results.sarif

.github/workflows/docker.yaml

@@ -1,9 +1,6 @@
 name: Build and push ckan-pycsw image
 
 on:
-  push:
-    branches:
-      - main
   pull_request:
     types:
       - closed
@@ -14,23 +11,18 @@ on:
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
+  TAG: ghcr.io/${{ github.repository }}:${{ github.head_ref }}
   CONTEXT: .
   BRANCH: ${{ github.head_ref }}
   DOCKERFILE_PATH: /ckan-pycsw
   DOCKERFILE: Dockerfile
-  HADOLINT_VERSION: 2.12.0
 
 jobs:
   docker:
     name: runner/build-docker-push:${{ github.head_ref }}
     runs-on: ubuntu-latest
     if: github.event.pull_request.merged == true
-    strategy:
-      matrix:
-        include:
-          - image: ghcr.io/${{ github.repository }}
-            tag: ghcr.io/${{ github.repository }}:${{ github.head_ref }}
-            dockerfile: ./ckan-pycsw/Dockerfile
+
     steps:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
@@ -52,7 +44,7 @@ jobs:
         id: meta
         uses: docker/metadata-action@v4
         with:
-          images: ${{ matrix.image }}
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           labels: |
             org.opencontainers.image.documentation=https://github.com/${{ github.repository }}/blob/${{ env.BRANCH }}/README.md
             org.opencontainers.image.version=${{ env.BRANCH }}
@@ -61,20 +53,20 @@ jobs:
         uses: docker/build-push-action@v5
         with:
           push: true
-          tags: ${{ matrix.tag }}
+          tags: ${{ env.TAG }}
           labels: ${{ steps.meta.outputs.labels }}
           context: ${{ env.CONTEXT }}
-          file: ${{ matrix.dockerfile }}
+          file: ${{ env.CONTEXT }}${{ env.DOCKERFILE_PATH }}/${{ env.DOCKERFILE }}
 
       - name: Linting Dockerfile with hadolint in GH Actions
         uses: hadolint/[email protected]
         with:
-          dockerfile: ${{ matrix.dockerfile }}
+          dockerfile: ${{ env.CONTEXT }}${{ env.DOCKERFILE_PATH }}/${{ env.DOCKERFILE }}
 
       - name: Run Trivy container image vulnerability scanner
         uses: aquasecurity/[email protected]
         with:
-          image-ref: ${{ matrix.tag }}
+          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.BRANCH }}
           format: sarif
           output: trivy-results.sarif