docker-build-test.yaml

#This action test builds EMHASS Docker images, in each architecture.
name: "Test Building Docker Image"

on:
  push:
    branches: [master,testing]
  pull_request:
    branches: [master,testing]
  workflow_dispatch:

permissions:
  actions: read
  security-events: write
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        platform:
          [
            { target_arch: amd64, os_version: debian },
            { target_arch: aarch64, os_version: debian },
          ]
    steps:
      - name: Checkout the repository
        uses: actions/checkout@v4
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: ${{ matrix.platform.buildx }}
          build-args: |
            TARGETARCH=${{ matrix.platform.target_arch }}
            os_version=${{ matrix.platform.os_version }}
          load: true
      - name: Test Image #Assume Docker fail with FileNotFound secrets_emhass.yaml error
        run: docker run --rm -it ${{ steps.build.outputs.imageid }} | grep -q secrets_emhass.yaml && echo 0 || echo 1
  #     # Google OSV-Scanner
  #     # Extract Debian and Python packadge list stored in Image
  #     - name: Export Debian package list
  #       run: mkdir OSV && docker run --rm --entrypoint '/bin/cat' ${{ steps.build.outputs.imageid }} /var/lib/dpkg/status >> ./OSV/${{ matrix.platform.target_arch }}.status
  #     - name: Export Python package list
  #       run: docker run --rm --entrypoint '/bin/cat' ${{ steps.build.outputs.imageid }} uv.lock >> ./OSV/${{ matrix.platform.target_arch }}.lock
  #     - name: Upload package list as digest
  #       uses: actions/upload-artifact@v4
  #       with:
  #         name: ${{ matrix.platform.target_arch }}-packages
  #         path: ./OSV/*
  #         if-no-files-found: error
  #         retention-days: 1

  # osv-scan:
  #   needs:
  #     - build
  #   strategy:
  #     fail-fast: false
  #     matrix:
  #       platform:
  #         [
  #           { target_arch: amd64 },
  #           { target_arch: aarch64 }
  #         ]
  #   # Check Docker image debian and python packages list for known vulnerabilities
  #   uses: "geoderp/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v0.0.1"
  #   with:
  #     download-artifact: "${{ matrix.platform.target_arch }}-packages"
  #     matrix-property: "${{ matrix.platform.target_arch }}-"
  #     fail-on-vuln: false
  #     scan-args: |-
  #       --lockfile=dpkg-status:./${{ matrix.platform.target_arch }}.status
  #       --lockfile=poetry.lock:./${{matrix.platform.target_arch }}.lock
  #   permissions:
  #     security-events: write
  #     contents: read
  #     actions: read