name: ci

permissions:
  contents: read

on:
  push:
    branches:
      - 'main'
    tags:
      - 'v*'
  pull_request:

  build:
    uses: docker/github-builder/.github/workflows/build.yml@v1
    permissions:
      contents: read # to fetch the repository content
      id-token: write # for signing attestation(s) with GitHub OIDC Token
    with:
      output: image
      push: ${{ github.event_name != 'pull_request' }}
      meta-images: name/app
    secrets:
      registry-auths: |
        - registry: docker.io
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

  scan:
    runs-on: ubuntu-24.04
    if: ${{ github.event_name != 'pull_request' }}
    needs:
      - build
    steps:
      -
        name: Login to registry
        uses: docker/login-action@v4
        with:
          registry: docker.io
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      -
        name: Scan for vulnerabilities
        uses: crazy-max/ghaction-container-scan@v4
        with:
          image: ${{ fromJSON(needs.build.outputs.image-names)[0] }}@${{ needs.build.outputs.image-digest }}