chainguard.yml

name: Build e Distribuição de Pacotes com Melange e APKO

on:
  push:
    branches:
      - 'main'

permissions:
  contents: read

jobs:
  build:
    name: Build e Distribuição de Pacotes
    runs-on: ubuntu-20.04
    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
    # Checkout do código
    - name: Harden Runner
      uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
      with:
        egress-policy: audit

    - name: Checkout code
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

    # Configurar Docker Buildx
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0

    # Instalar Melange
    - name: Install Melange
      run: |
        wget https://github.com/chainguard-dev/melange/releases/download/v0.11.2/melange_0.11.2_linux_386.tar.gz
        tar -xzf melange_0.11.2_linux_386.tar.gz
        cd melange_0.11.2_linux_386
        sudo mv melange /usr/local/bin/
        melange version

    # Instalar APKO
    - name: Install APKO
      run: |
        wget https://github.com/chainguard-dev/apko/releases/download/v0.14.7/apko_0.14.7_linux_386.tar.gz
        tar -xzf apko_0.14.7_linux_386.tar.gz
        cd apko_0.14.7_linux_386
        sudo mv apko /usr/local/bin/
        apko version

    # Instalar Cosign
    - name: Instalar Cosign
      uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0

    # Gerar chaves com Melange
    - name: Generate keys with Melange
      run: |
        cd chainguard
        melange keygen

    # Construir pacotes com Melange
    - name: Build packages with Melange
      run: |
        cd chainguard
        melange build melange.yaml --runner docker --signing-key melange.rsa --arch amd64

    # Construir imagem de container com APKO
    - name: Build container image with APKO
      run: |
        cd chainguard
        apko build apko.yaml senhas senhas.tar -k melange.rsa.pub --arch amd64

    # Login no DockerHub
    - name: Login to DockerHub
      uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
      with:
        username: ${{ secrets.DOCKER_USERNAME }}
        password: ${{ secrets.DOCKER_PASSWORD }}

    # Load da imagem Docker
    - name: Load Docker image
      run: |
        cd chainguard
        docker load < senhas.tar
        docker images
    
    # Extrair metadados (tags, labels) para Docker
    - name: Extrair metadados (tags, labels) para Docker
      id: meta
      uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5.6.1
      with:
          images: nataliagranato/senhas

    # Gerar nome único para a tag
    - name: Gerar nome único para a tag
      id: generate-tag
      run: |
            # Obtém os primeiros 5 dígitos do hash do commit e a data
            SHORT_HASH=$(git log -1 --pretty=format:%h | cut -c1-5)
            TIMESTAMP=$(date +%Y%m%d%H%M%S)
            echo "tag=${SHORT_HASH}-${TIMESTAMP}" >> $GITHUB_ENV
            echo "::set-output name=tag::${SHORT_HASH}-${TIMESTAMP}"

    # Fazer push da imagem Docker
    - name: Push Docker image
      id: push-docker-image
      run: |   
        docker tag senhas:latest-amd64 ${{ secrets.DOCKER_USERNAME }}/senhas:${{ steps.generate-tag.outputs.tag }}
        docker push ${{ secrets.DOCKER_USERNAME }}/senhas:${{ steps.generate-tag.outputs.tag }}
    
    # Scan de segurança com Aqua Security Trivy    
    - name: Aqua Security Trivy
      uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # 0.29.0
      with:
            image-ref: nataliagranato/senhas:${{ steps.generate-tag.outputs.tag }}
            format: 'sarif'
            severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL'
            output: 'trivy-results.sarif'
    
    # Envio dos resultados do Trivy para a aba de Segurança do GitHub
    - name: Fazer upload dos resultados do Trivy para a aba de Segurança do GitHub
      uses: github/codeql-action/upload-sarif@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
      if: always()
      with:
            sarif_file: 'trivy-results.sarif'