build_and_push.yaml

name: build and deploy

on:
  pull_request:
    branches:
      - main
  schedule:
    # run every 10 hours
    - cron: '0 */10 * * *'

jobs:
  build-image:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repo
        uses: actions/checkout@v2
      - name: build docker image
        run: |
            docker build . -t k8s-opa
            docker save k8s-opa > k8s-opa.tar
      - name: upload image for scanning
        uses: actions/upload-artifact@v3
        with:
          name: k8s-opa.tar
          path: k8s-opa.tar
          retention-days: 1

  scan-image:
    needs: [build-image]
    runs-on: ubuntu-latest
    container:
      image: aquasec/trivy
    steps:
      - name: download image tar
        uses: actions/download-artifact@v3
        with:
          name: k8s-opa.tar
          path: ./
      - name: scan image for vulnerabilities
        run: |
            trivy image --input k8s-opa.tar --ignore-unfixed -s CRITICAL -s HIGH

  push-image:
    needs: [scan-image]
    runs-on: ubuntu-latest
    env:
      REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
      REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
    steps:
      - name: download image tar
        uses: actions/download-artifact@v3
        with:
          name: k8s-opa.tar
          path: ./
      - name: tag and push image
        run: |
            docker load -i k8s-opa.tar
            docker tag k8s-opa ttl.sh/k8s-opa
            docker push ttl.sh/k8s-opa
            echo $REGISTRY_TOKEN | docker login -u $REGISTRY_USER --password-stdin
            docker tag k8s-opa airkewld/k8s-opa
            docker push airkewld/k8s-opa

  test-bad-demo:
    needs: [push-image]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repo
        uses: actions/checkout@v2
      - name: test bad demo manifest
        run: |
            docker run -v $(pwd):/tmp ttl.sh/k8s-opa /tmp/demo/bad-k8s.yaml

  test-good-demo:
    needs: [push-image]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repo
        uses: actions/checkout@v2
      - name: test good demo manifest
        run: |
            docker run -v $(pwd):/tmp ttl.sh/k8s-opa /tmp/demo/good-k8s.yaml