ci.yml

name: CI

on:
  push:
    branches:
      - main
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+*"
  pull_request:
    branches:
      - main

env:
  platforms: linux/amd64,linux/arm64

jobs:
  build:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        image: ["3.17", "3.19", "3.20"]
        openssl_version: ["3.0.9"]
      fail-fast: false
    steps:
      - name: Checkout Repository
        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6

      - name: Docker Buildx
        uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb # v3.3.0

      - name: Setup QEMU
        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
        with:
          platforms: arm64
        if: github.event_name != 'pull_request'

      - name: Login to GitHub Container Registry
        uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
        if: ${{ github.event_name != 'pull_request' }}

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
        with:
          images: |
            name=ghcr.io/nginxinc/alpine-fips
          tags: |
            type=edge
            type=ref,event=pr,suffix=-alpine${{ matrix.image }}
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{version}},suffix=-alpine${{ matrix.image }}
        env:
          DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index

      - name: Build Docker image
        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
        id: build-push
        with:
          file: Dockerfile
          context: "."
          cache-from: type=gha,scope=alpine${{ matrix.image }}
          cache-to: type=gha,scope=alpine${{ matrix.image }},mode=max
          tags: ${{ steps.meta.outputs.tags }}
          load: ${{ github.event_name == 'pull_request' }}
          push: ${{ github.event_name != 'pull_request' }}
          platforms: ${{ github.event_name != 'pull_request' && env.platforms || '' }}
          annotations: ${{ github.event_name != 'pull_request' && steps.meta.outputs.annotations || '' }}
          target: alpine
          pull: true
          sbom: ${{ github.event_name != 'pull_request' }}
          provenance: ${{ github.event_name != 'pull_request' }}
          build-args: | 
            BUILD_OS=alpine:${{ matrix.image }}
            OPENSSL_VERSION=${{ matrix.openssl_version }}

      - name: Run Grype vulnerability scanner
        uses: anchore/scan-action@3343887d815d7b07465f6fdcd395bd66508d486a # v3.6.4
        continue-on-error: true
        id: scan
        with:
          image: ghcr.io/nginxinc/alpine-fips:${{ steps.meta.outputs.version }}
          only-fixed: true
          add-cpes-if-none: true

      - name: Upload Anchore scan SARIF report
        uses: github/codeql-action/upload-sarif@2e230e8fe0ad3a14a340ad0815ddb96d599d2aff # v3.25.8
        with:
          sarif_file: ${{ steps.scan.outputs.sarif }}

      - name: Create/Update Draft
        uses: lucacome/draft-release@8a63d32c79a171ae6048e614a8988f0ac3ed56d4 # v1.1.0
        with:
          minor-label: "enhancement"
          major-label: "change"
          publish: ${{ startsWith(github.ref, 'refs/tags/') }}
          collapse-after: 20
        if: ${{ github.event_name != 'pull_request' }}