docker-push.yml

---
name: docker-push
on:
  pull_request:
  push:
    branches:
      - main
  merge_group:
permissions:
  contents: read
  packages: write
jobs:
  docker-push:
    runs-on: ubuntu-latest
    env:
      DOCKER_BUILDKIT: 1
      COMPOSE_DOCKER_CLI_BUILD: 1
      REPOSITORY: ${{github.repository}}
    steps:
      - uses: actions/checkout@v4.1.7
      - uses: docker/login-action@v3.3.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/setup-qemu-action@v3.2.0
      - uses: docker/setup-buildx-action@v3.5.0
      - run: cp .env.example .env
      - if: github.event_name == 'pull_request'
        run: echo "TAG_NAME=${HEAD_REF//\//-}" >> "$GITHUB_ENV"
        env:
          HEAD_REF: ${{github.head_ref || github.event.merge_group.head_ref}}
      - name: Build and push (dev)
        uses: docker/bake-action@v5.5.0
        env:
          DOCKER_CONTENT_TRUST: 1
        with:
          push: true
          files: docker-compose.yml,dev.base.docker-compose.yml
      - name: Build and push (production)
        uses: docker/bake-action@v5.5.0
        env:
          DOCKER_CONTENT_TRUST: 1
        with:
          push: true
          files: docker-compose.yml
  update-dockle:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4.1.7
        if: github.event_name != 'pull_request' || github.event.action != 'closed'
        with:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.head.sha || github.event.merge_group.head_sha }}
      - uses: dev-hato/actions-update-dockle@v0.0.90
        with:
          github-token: ${{secrets.GITHUB_TOKEN}}
  dockle:
    runs-on: ubuntu-latest
    needs:
      - docker-push
      - update-dockle
    strategy:
      matrix:
        docker_compose_option: ["-f dev.base.docker-compose.yml", ""]
    env:
      DOCKER_CONTENT_TRUST: 1
      REPOSITORY: ${{github.repository}}
    steps:
      - uses: actions/checkout@v4.1.7
      - run: echo "TAG_NAME=${HEAD_REF//\//-}" >> "$GITHUB_ENV"
        env:
          HEAD_REF: ${{github.head_ref || github.event.merge_group.head_ref}}
        if: github.event_name == 'pull_request'
      - env:
          DOCKER_COMPOSE_OPTION: ${{matrix.docker_compose_option}}
        run: |
          cp .env.example .env
          dockle_version="$(cat .dockle-version)"
          curl -L -o dockle.deb "https://github.com/goodwithtech/dockle/releases/download/v${dockle_version}/dockle_${dockle_version}_Linux-64bit.deb"
          sudo dpkg -i dockle.deb
          # shellcheck disable=SC2086
          docker compose -f docker-compose.yml ${DOCKER_COMPOSE_OPTION} pull
          # shellcheck disable=SC2086
          docker compose -f docker-compose.yml ${DOCKER_COMPOSE_OPTION} up -d
          # shellcheck disable=SC2086
          for image_name in $(docker compose -f docker-compose.yml ${DOCKER_COMPOSE_OPTION} images | awk 'OFS=":" {print $2,$3}' | tail -n +2); do
            cmd="dockle --exit-code 1 "

            if [[ "${image_name}" =~ "app:" ]]; then
              cmd+="-i CIS-DI-0006 "
            elif [[ "${image_name}" =~ "db-dev" ]]; then
              cmd+="-ak key "
            fi

            cmd+="${image_name}"
            echo "> ${cmd}"
            eval "${cmd}"
          done
concurrency:
  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
  cancel-in-progress: true