cd-build-canary-unbound.yaml

name: CD Build Canary Distroless Unbound Docker Image

on:      
  schedule:
    - cron: '0 20 * * mon-fri'
    
jobs: 
  build: 
    runs-on: ubuntu-latest
    
    env:
      DOCKERHUB_SLUG: "madnuttah/unbound"   
      
    steps:
      - name: Checkout source
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      
      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v3
     
      - name: Login to Dockerhub
        if: github.event_name != 'pull_request'
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
              
      - name: Set buildvars
        id: SET_BUILDVARS
        run: |
          echo IMAGE_BUILD_DATE=$(date -u) >> $GITHUB_OUTPUT
          cat buildvars | grep OPENSSL_BUILDENV_VERSION >> $GITHUB_OUTPUT

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          platforms: linux/386,linux/arm/v6,linux/arm/v7,linux/arm64,linux/amd64
          builder: ${{ steps.buildx.outputs.name }}
          build-args: |
            IMAGE_BUILD_DATE=${{ steps.SET_BUILDVARS.outputs.IMAGE_BUILD_DATE }} 
            OPENSSL_BUILDENV_VERSION=${{ steps.SET_BUILDVARS.outputs.OPENSSL_BUILDENV_VERSION }}
          file: ./unbound/canary.Dockerfile   
          sbom: ${{ github.event_name != 'pull_request' }}
          provenance: ${{ github.event_name != 'pull_request' }}
          push: ${{ github.event_name != 'pull_request' }}      
          cache-from: type=gha
          cache-to: type=gha,mode=max          
          tags: |
            ${{ env.DOCKERHUB_SLUG }}:canary
            
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        if: ${{ github.event_name != 'pull_request' }}
        with:
          image-ref: ${{ env.DOCKERHUB_SLUG }}:canary          
          exit-code: '1'
          ignore-unfixed: false
          scan-type: image
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'
          format: 'table'