giropops-docker.yml

name: Build da imagem de container giropops-senhas

on:
  push:
    branches:
      - 'main'

jobs:
  build:
    name: Build da Imagem giropops-senhas
    runs-on: ubuntu-20.04
    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
      - name: Fazer checkout do código
        uses: actions/checkout@6d193bf28034eafb982f37bd894289fe649468fc

      - name: Configurar QEMU
        uses: docker/setup-qemu-action@v3.2.0

      - name: Instalar Cosign
        uses: sigstore/cosign-installer@v3.7.0

      - name: Configurar Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Fazer login no Docker Hub
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Extrair metadados (tags, labels) para Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: nataliagranato/linuxtips-giropops-senhas

      - name: Gerar nome único para a tag
        id: generate-tag
        run: |
            # Obtém os primeiros 5 dígitos do hash do commit e a data
            SHORT_HASH=$(git log -1 --pretty=format:%h | cut -c1-5)
            TIMESTAMP=$(date +%Y%m%d%H%M%S)
            echo "tag=${SHORT_HASH}-${TIMESTAMP}" >> $GITHUB_ENV
            echo "::set-output name=tag::${SHORT_HASH}-${TIMESTAMP}"
        
      - name: Construir e enviar a imagem Docker
        uses: docker/build-push-action@v6
        id: build-and-push
        with:
          context: ./src
          file: ./src/Dockerfile
          push: true
          tags: nataliagranato/linuxtips-giropops-senhas:${{ steps.generate-tag.outputs.tag }}
          labels: ${{ steps.meta.outputs.labels }}
          platforms: linux/amd64,linux/arm64

      - name: Aqua Security Trivy
        uses: aquasecurity/trivy-action@0.28.0
        with:
            image-ref: nataliagranato/linuxtips-giropops-senhas:${{ steps.generate-tag.outputs.tag }}
            format: 'sarif'
            severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL'
            output: 'trivy-results.sarif'
        
      - name: Fazer upload dos resultados do Trivy para a aba de Segurança do GitHub
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
            sarif_file: 'trivy-results.sarif'

      - name: Assinar imagem com uma chave
        run: |
          images=""
          for tag in ${TAGS}; do
            images+="${tag}@${DIGEST} "
          done
          cosign sign --yes --key env://COSIGN_PRIVATE_KEY $images
        env:
          TAGS: ${{ steps.meta.outputs.tags }}
          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
          DIGEST: ${{ steps.build-and-push.outputs.digest }}