docker-build-push.yml

name: 'Docker image build and push to container registry'

on:
  workflow_call:
    inputs:
      container-registry:
        required: true
        type: string
      image-name:
        required: true
        type: string
    secrets:
      registry-username:
        required: true
      registry-access-token:
        required: true

defaults:
  run:
    shell: bash

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      security-events: write

    steps:
      - name: Checkout repository 🛎️
        uses: actions/checkout@v7

      - name: Log into registry ${{ inputs.container-registry }} 🔐
        uses: docker/login-action@v4.6.0
        with:
          registry: ${{ inputs.container-registry }}
          username: ${{ secrets.registry-username }}
          password: ${{ secrets.registry-access-token }}

      - name: Extract Docker metadata 🏷️
        id: meta
        uses: docker/metadata-action@v6.2.0
        with:
          images: ${{ inputs.container-registry }}/${{ inputs.image-name }}

      - name: Build and Push Docker image 🏗️
        uses: docker/build-push-action@v7.3.0
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

      - name: Scan image for vulnerabilities 📡
        uses: anchore/scan-action@v7.4.2
        id: scan
        with:
          image: ${{ inputs.container-registry }}/${{ inputs.image-name }}:latest
          fail-build: false
          only-fixed: true

      - name: Inspect SARIF report 🗄️
        run: cat ${{ steps.scan.outputs.sarif }}

      - name: Upload scan SARIF report 🚀
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: ${{ steps.scan.outputs.sarif }}