ci-docker-image.yml

name: Docker Image CI
on: push
env:
  DOCKERHUB_USER: akospasztor
  DOCKER_IMAGE_NAME: akospasztor/docker-gcc-arm

jobs:
  build:
    strategy:
      matrix:
        version: [8-2019-q3, 9-2019-q4, 9-2020-q2, 10-2020-q4]
        os: [linux]
        include:
          - os: linux
            runner: ubuntu-latest
    runs-on: ${{ matrix.runner }}
    steps:
    - name: Checkout repository
      uses: actions/checkout@v4
    - name: Setup docker buildx
      id: buildx
      uses: docker/setup-buildx-action@v3
    - name: Cache docker layers
      uses: actions/cache@v4
      with:
        path: /tmp/.buildx-cache
        key: ${{ runner.os }}-buildx-${{ matrix.version }}-${{ github.sha }}
        restore-keys: |
          ${{ runner.os }}-buildx-${{ matrix.version }}-
          ${{ runner.os }}-buildx-
    - name: Docker metadata
      id: docker_meta
      uses: docker/metadata-action@v5
      with:
        images: ${{ env.DOCKER_IMAGE_NAME }}
        flavor: |
          prefix=${{ matrix.version }}-${{ matrix.os }}-
          latest=false
        tags: |
          type=raw,value=latest
          type=semver,pattern={{version}}
    - name: Login to dockerhub
      uses: docker/login-action@v3
      with:
        username: ${{ env.DOCKERHUB_USER }}
        password: ${{ secrets.DOCKERHUB_PAT }}
    - name: Build docker image
      id: docker_build
      uses: docker/build-push-action@v5
      with:
        context: ./${{ matrix.version }}/${{ matrix.os }}
        load: true
        push: false
        tags: ${{ steps.docker_meta.outputs.tags }}
        labels: ${{ steps.docker_meta.outputs.labels }}
        builder: ${{ steps.buildx.outputs.name }}
        cache-from: type=local,src=/tmp/.buildx-cache
        cache-to: type=local,dest=/tmp/.buildx-cache
    - name: Test docker image
      run: >
        docker run --rm -i --env GCC_VERSION=${{ matrix.version }}
        ${{ env.DOCKER_IMAGE_NAME }}:${{ steps.docker_meta.outputs.version }}
        < script/test-gcc-version.sh
    - name: Search for vulnerabilities with docker scout
      uses: docker/scout-action@v1
      with:
        command: cves
        image: ${{ env.DOCKER_IMAGE_NAME }}:${{ steps.docker_meta.outputs.version }}
        only-severities: critical, high
        only-fixed: true
        summary: true
    - name: Push docker image
      if: ${{ contains(github.ref, 'refs/tags/') }}
      uses: docker/build-push-action@v5
      with:
        context: ./${{ matrix.version }}/${{ matrix.os }}
        push: true
        tags: ${{ steps.docker_meta.outputs.tags }}
        labels: ${{ steps.docker_meta.outputs.labels }}
        builder: ${{ steps.buildx.outputs.name }}
        cache-from: type=local,src=/tmp/.buildx-cache
        cache-to: type=local,dest=/tmp/.buildx-cache