docker-hub-parachain.yml

name: Publish features parachain to Docker Hub

on:
  workflow_dispatch:
  push:
    tags:
    - '*'
  pull_request:
    branches: [ main ]

jobs:
  hadolint:
    runs-on: ubuntu-20.04
    name: "Hadolint"
    steps:
      - uses: actions/checkout@v3
      - uses: hadolint/hadolint-action@v3.1.0
        with:
          dockerfile: "./Dockerfile"

  publish:
    needs: hadolint
    name: Publish
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v2

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v3
        with:
          flavor: |
            latest=true
          images: |
            zeitgeistpm/zeitgeist-node-parachain
          tags: |
            type=semver,pattern={{version}}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v1

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v1

      - name: Login to DockerHub
        uses: docker/login-action@v1 
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}

      - name: Build and push
        uses: docker/build-push-action@v2
        with:
          build-args: |
            PROFILE=production
            FEATURES=parachain
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
      
      - name: Trivy Scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'zeitgeistpm/zeitgeist-node-parachain:latest'
          format: 'sarif'
          output: 'zeitgeist-node-parachain-report.sarif'
          severity: 'HIGH,CRITICAL'