build-images.yaml

name: Build and Push Docker Images

on:
  push:
    branches:
      - 'main'
      - 'develop'
    tags:
      - '*'
  pull_request:
    branches:
      - 'main'
      - 'develop'

env:
  AGENT_IMAGE_NAME: humitifier
  AGENT_DOCKERFILE_PATH: ./agent/Dockerfile
  AGENT_CONTEXT_PATH: ./agent
  SERVER_IMAGE_NAME: humitifier-server
  SERVER_DOCKERFILE_PATH: ./humitifier-server/Dockerfile
  SERVER_CONTEXT_PATH: ./humitifier-server

jobs:
  build-and-push-agent:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ghcr.io/centrefordigitalhumanities/humitifier/${{ env.AGENT_IMAGE_NAME }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=pep440,pattern={{version}}
            type=pep440,pattern={{major}}.{{minor}}

      - name: Build and push main image
        id: build
        uses: docker/build-push-action@v6
        with:
          context: ${{ env.AGENT_CONTEXT_PATH }}
          file: ${{ env.AGENT_DOCKERFILE_PATH }}
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

      - name: Save Docker image to cache
        run: |
          docker save ${{ steps.build.outputs.imageid }} | gzip > agent_image.tar.gz

      - name: Upload Docker image to cache
        uses: actions/cache@v4
        with:
          path: agent_image.tar.gz
          key: ${{ runner.os }}-agent-image-${{ github.sha }}



  build-and-push-server:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ghcr.io/centrefordigitalhumanities/humitifier/${{ env.SERVER_IMAGE_NAME }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=pep440,pattern={{version}}
            type=pep440,pattern={{major}}.{{minor}}

      - name: Build and push main image
        uses: docker/build-push-action@v6
        with:
          context: ${{ env.SERVER_CONTEXT_PATH }}
          file: ${{ env.SERVER_DOCKERFILE_PATH }}
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}


  scan-agent:
    needs: build-and-push-agent
    runs-on: ubuntu-latest
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
    steps:
      - name: Download Docker image from cache
        uses: actions/cache@v4
        with:
          path: agent_image.tar.gz
          key: ${{ runner.os }}-agent-image-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-agent-image-

      - name: Load Docker image
        run: |
          gunzip -c agent_image.tar.gz | docker load
          docker ps -a

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ghcr.io/centrefordigitalhumanities/humitifier/${{ env.AGENT_IMAGE_NAME }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=pep440,pattern={{version}}
      - name: Run the Anchore Grype scan action
        uses: anchore/scan-action@v5
        id: scan
        with:
          image: ghcr.io/centrefordigitalhumanities/humitifier/${{ env.AGENT_IMAGE_NAME }}:${{ steps.meta.outputs.version }}
          fail-build: ${{ github.event_name == 'pull_request' }}
          severity-cutoff: critical
      - name: Upload vulnerability report
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ steps.scan.outputs.sarif }}

  scan-server:
    needs: build-and-push-server
    runs-on: ubuntu-latest
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
    steps:
      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ghcr.io/centrefordigitalhumanities/humitifier/${{ env.SERVER_IMAGE_NAME }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=pep440,pattern={{version}}
      - name: Run the Anchore Grype scan action
        uses: anchore/scan-action@v5
        id: scan
        with:
          image: ghcr.io/centrefordigitalhumanities/humitifier/${{ env.SERVER_IMAGE_NAME }}:${{ steps.meta.outputs.version }}
          fail-build: ${{ github.event_name == 'pull_request' }}
          severity-cutoff: critical
      - name: Upload vulnerability report
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ steps.scan.outputs.sarif }}