docker.yml

# For details of what checks are run for PRs please refer below
# docs: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions

name: Docker CI

on:
  push:
    branches: ["main"]
  pull_request:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  REPORTS_DIR: CI_reports
  PYTHON_VERSION: "3.12"
  POETRY_VERSION: "1.8.1"

jobs:
  test:
    name: Build and test docker image
    runs-on: ubuntu-latest
    timeout-minutes: 30
    env:
      REPORTS_ARTIFACT: 'docker-image-bom'
      DOCKER_TAG: 'cdx-python-testing:${{ github.run_id }}.${{ github.run_number }}.${{ github.run_attempt }}'
    steps:
      - name: Checkout code
        # see https://github.com/actions/checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: setup reports-dir
        run: mkdir "$REPORTS_DIR"
      - name: Setup python ${{ env.PYTHON_VERSION }}
        # see https://github.com/actions/setup-python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          architecture: 'x64'
      - name: Setup poetry ${{ env.POETRY_VERSION }}
        # see https://github.com/marketplace/actions/setup-poetry
        uses: Gr1N/setup-poetry@v9
        with:
          poetry-version: ${{ env.POETRY_VERSION }}
      - name: bump version
        id: bump-version
        run: |
          VERSION="${{ github.run_id }}.${{ github.run_number }}.${{ github.run_attempt }}+testing"
          poetry version "$VERSION"
          echo "version=$VERSION" >> $GITHUB_OUTPUT
      - name: Poetry build
        run: poetry build
      - name: Artifact python dist
        if: |
          !failure() && !cancelled() &&
          steps.after-release.outputs.released
        # see https://github.com/actions/upload-artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.RUN_ARTIFACT_PYTHON_DIST }}
          path: ${{ env.DIST_SOURCE_DIR }}/
          if-no-files-found: warn
      - name: Build Docker image
        env:
          VERSION: ${{ steps.bump-version.outputs.version }}
        run: >
          docker build -f Dockerfile
          --label "org.opencontainers.image.source=${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}"
          --label "org.opencontainers.image.revision=${GITHUB_SHA}"
          --build-arg "VERSION=$VERSION"
          -t "$DOCKER_TAG"
          .
      - name: Build own SBoM (XML)
        run: >
          docker run --rm "$DOCKER_TAG"
          environment
          -vvv
          --output-format XML
          > "$REPORTS_DIR/docker-image.bom.xml"
      - name: Build own SBoM (JSON)
        run: >
          docker run --rm "$DOCKER_TAG"
          environment
          -vvv
          --output-format JSON
          > "$REPORTS_DIR/docker-image.bom.json"
      - name: Artifact reports
        if: ${{ ! cancelled() }}
        # see https://github.com/actions/upload-artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.REPORTS_ARTIFACT }}
          path: ${{ env.REPORTS_DIR }}
          if-no-files-found: error
      - name: Destroy Docker image
        # run regardless of outcome
        if: ${{ always() }}
        run: docker rmi -f "$DOCKER_TAG"