common-hosted-form-service/.github/workflows/clamav-image-build.yaml at main · bcgov/common-hosted-form-service · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
name: ClamAV Image Build

on:
  workflow_dispatch:
    inputs:
      ref:
        description: github checkout ref id
        required: true
        type: string
        default: main
      image_name:
        description: Image Name
        required: true
        type: string
        default: chefs-clamav

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v5
        with:
          ref: ${{ inputs.ref }}

      - name: Set variables
        shell: bash
        run: |
          echo "SHA=sha-$(git rev-parse --short HEAD)" >> $GITHUB_ENV
          echo "IMAGE_REVISION=$(git rev-parse HEAD)" >> $GITHUB_ENV
          echo "IMAGE_VERSION=main" >> $GITHUB_ENV
          if [[ "${{ inputs.ref }}" != '' ]]; then
            git fetch origin ${{ inputs.ref }}
            echo "SHA=sha-$(git rev-parse --short HEAD)" >> $GITHUB_ENV
            echo "IMAGE_REVISION=$(git rev-parse HEAD)" >> $GITHUB_ENV
            echo "IMAGE_VERSION=ref-${{ inputs.ref }}" >> $GITHUB_ENV
          fi

      - name: Parse Input Values
        shell: bash
        run: |
          echo "GH_USERNAME=$(tr '[:upper:]' '[:lower:]' <<< '${{ github.repository_owner }}')" >> $GITHUB_ENV

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2  # SHA for v4
        with:
          registry: ghcr.io
          username: ${{ env.GH_USERNAME }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Prepare Container Metadata tags
        id: meta
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf
        with:
          images: |
            ghcr.io/${{ env.GH_USERNAME }}/${{ inputs.image_name }}
          # Always updates the 'latest' tag
          flavor: |
            latest=true
          # Creates tags based off of branch names and semver tags
          tags: |
            type=raw,value=${{ env.IMAGE_VERSION }}
            type=raw,value=${{ env.SHA }}
          labels: |
            org.opencontainers.image.description=Clam AV for CHEFS
            org.opencontainers.image.licenses=Apache-2.0
            org.opencontainers.image.revision=${{ env.IMAGE_REVISION }}
            org.opencontainers.image.source=https://github.com/bcgov/common-hosted-form-service/clamav
            org.opencontainers.image.title=${{ inputs.image_name }}
            org.opencontainers.image.version=${{ env.IMAGE_VERSION }}
          annotations: |
            org.opencontainers.image.description=Clam AV for CHEFS
            org.opencontainers.image.licenses=Apache-2.0
            org.opencontainers.image.revision=${{ env.IMAGE_REVISION }}
            org.opencontainers.image.source=https://github.com/bcgov/common-hosted-form-service/clamav
            org.opencontainers.image.title=${{ inputs.image_name }}
            org.opencontainers.image.version=${{ env.IMAGE_VERSION }}

      - name: Build and Push to Container Registry
        id: builder
        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
        with:
          context: ./clamav
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

      - name: Inspect Docker Image
        shell: bash
        run: |
          docker image inspect ghcr.io/${{ env.GH_USERNAME }}/${{ inputs.image_name }}:latest
          docker image inspect ghcr.io/${{ env.GH_USERNAME }}/${{ inputs.image_name }}:sha-$(git rev-parse --short HEAD)
          docker image inspect ghcr.io/${{ env.GH_USERNAME }}/${{ inputs.image_name }}:ref-${{ inputs.ref }}