build.yml

on:
  push:
    branches:
      - master
  pull_request:

permissions:
  contents: read
  security-events: write # upload Sarif results

name: Build
jobs:
  build-amd64:
    runs-on:
      labels: runs-on,runner=4cpu-linux-x64,run-id=${{ github.run_id }}
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set the TAG value
      id: get-TAG
      run: |
        echo "$(make -s log | grep TAG)" >> "$GITHUB_ENV"
    - name: Build container image
      uses: docker/build-push-action@v6
      with:
        context: .
        push: false
        tags: rancher/hardened-calico:${{ env.TAG }}-amd64
        file: Dockerfile

    - name: Run Trivy vulnerability scanner
      uses: aquasecurity/trivy-action@0.24.0
      with:
        image-ref: rancher/hardened-calico:${{ env.TAG }}-amd64
        ignore-unfixed: true
        vuln-type: 'os,library'
        severity: 'CRITICAL,HIGH'
        format: 'sarif'
        output: 'trivy-results.sarif'
    - name: Upload Trivy scan results to GitHub Security tab
      uses: github/codeql-action/upload-sarif@v3
      if: always()
      with:
        sarif_file: 'trivy-results.sarif'

  build-arm64:
    runs-on:
      labels: runs-on,runner=4cpu-linux-arm64,run-id=${{ github.run_id }}
    steps:
    - name: Check out code
      uses: actions/checkout@v4

    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Set the TAG value
      id: get-TAG
      run: |
        echo "$(make -s log | grep TAG)" >> "$GITHUB_ENV"
    - name: Build container image
      uses: docker/build-push-action@v6
      with:
        context: .
        push: false
        tags: rancher/hardened-calico:${{ env.TAG }}-arm64
        file: Dockerfile
        outputs: type=docker
        platforms: linux/arm64