test_update_linux_amd64.yml

name: Build and test oc.user images linux/amd64, linux/arm64

on:
  push:
  
env: 
  imagetag: ${{ github.head_ref || github.ref_name || 'dev' }}
    
jobs:
  build_matrix: 
    strategy:
      matrix:
        target_mode: [default, hardening]
    # The type of runner that the job will run on
    # runs-on: ubuntu-latest
    runs-on: self-hosted
    steps: 
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: ${{ github.ref_name }}
          submodules: true

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to DockerHub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_TOKEN }}
        
      - name: Run Buildx oc.user
        run: |
          ./mkversion.sh ${{ matrix.target_mode }}
     
      - name: Build test image abcdesktopio/oc.user:test.${{ env.imagetag }}
        uses: docker/build-push-action@v4
        with:
          context: .
          file: ./Dockerfile.ubuntu
          platforms: linux/amd64
          push: true
          build-args: |
            TARGET_MODE=${{ matrix.target_mode }}
            ABCDESKTOP_LOCALACCOUNT_DIR=/etc/localaccount
            TAG=22.04
            BASE_IMAGE_RELEASE=22.04
            BASE_IMAGE=ubuntu
          tags: abcdesktopio/oc.user.${{ matrix.target_mode }}:test.${{ env.imagetag }}

      - name: Run and test docker image abcdesktopio/oc.user.${{ matrix.target_mode }}:test.${{ env.imagetag }}
        run: |
          TARGET_MODE=${{ matrix.target_mode }} ./make-test.sh abcdesktopio/oc.user.${{ matrix.target_mode }}:test.${{ env.imagetag }}
    
      - name: Build and push image oc.user.${{ matrix.target_mode }}:${{ env.imagetag }}
        uses: docker/build-push-action@v4
        with:
          context: .
          file: ./Dockerfile.ubuntu
          platforms: linux/amd64, linux/arm64
          push: true
          build-args: |
            TARGET_MODE=${{ matrix.target_mode }}
            ABCDESKTOP_LOCALACCOUNT_DIR=/etc/localaccount
            TAG=22.04
            BASE_IMAGE_RELEASE=22.04
            BASE_IMAGE=ubuntu
          tags: abcdesktopio/oc.user.${{ matrix.target_mode }}:${{ env.imagetag }}
      
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: abcdesktopio/oc.user.${{ matrix.target_mode }}:${{ env.imagetag }}
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'