rpc-proxy-docker.yml

name: RPC Proxy - Docker build, scan and push

on:
   workflow_call:

permissions:
  contents: read
  packages: write
  checks: write
  actions: read

jobs:
  docker:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up QEMU
        if: ${{ github.event_name != 'pull_request' }}
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        if: ${{ github.event_name != 'pull_request' }}
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        if: ${{ github.event_name != 'pull_request' }}
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: vechain/sdk-rpc-proxy

      - name: Build and export to Docker
        uses: docker/build-push-action@v6
        with:
          context: .
          file: docker/rpc-proxy/Dockerfile
          load: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

      - name: Create .trivyignore file
        # "cross-spawn" is resolved as version 7.0.5 but Trivy keeps showing the error
        run: |
          echo "CVE-2024-21538" > .trivyignore
          echo "CVE-2024-13176" >> .trivyignore

      - name: Run Trivy Scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
          format: 'table'
          ignore-unfixed: true
          exit-code: '1'
          vuln-type: os,library
          severity: CRITICAL,HIGH,MEDIUM
          scanners: misconfig,vuln,secret
          trivyignores: .trivyignore
        env:
          # See https://github.com/aquasecurity/trivy/discussions/7538
          TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2

      - name: Build and push
        if: ${{ github.event_name != 'pull_request' }}
        uses: docker/build-push-action@v6
        with:
          context: .
          file: docker/rpc-proxy/Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          sbom: true
          provenance: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}