First pass at a build Docker image gh action (#22)

Author: ciroque

.github/workflows/build-and-sign-image.yml

@@ -0,0 +1,71 @@
+# This workflow will build and push a signed Docker image
+
+name: Build and sign image
+
+on:
+  # THIS BLOCK IS FOR TESTING
+  branch_protection_rule:
+    types:
+      - created
+
+# THIS BLOCK IS THE ACTUAL DESIRED EVENT TRIGGER
+#  pull_request:
+#    branches:
+#      - "*" # Run on all branches
+#    types:
+#      - closed   ## This needs to be uncommented after testing
+
+env:
+  REGISTRY: hub.docker.com
+  IMAGE_NAME: "ciroque/nginx-k8s-loadbalancer" # ${{ github.repository }}
+
+jobs:
+  build_and_sign_image:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+
+      steps:
+        - name: Checkout
+          uses: actions/checkout@v3
+
+        - name: Install cosign
+          if: github.event_name != 'pull_request'
+          uses: sigstore/cosign-installer@f3c664df7af409cb4873aa5068053ba9d61a57b6 #v2.6.0
+          with:
+            cosign-release: 'v1.13.1'
+
+        - name: Docker Buildx
+          uses: docker/setup-buildx-action@4b4e9c3e2d4531116a6f8ba8e71fc6e2cb6e6c8c # v2.5.0
+
+        - name: Log into registry ${{ env.REGISTRY }} for ${{ github.actor }}
+          uses: docker/login-action@28218f9b04b4f3f62068d7b6ce6ca5b26e35336c
+          with:
+            registry: ${{ env.REGISTRY }}
+            username: ${{ github.actor }}
+            password: ${{ secrets.DOCKER_HUB_TOKEN }}
+
+        - name: Build Docker Image
+          uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671
+          with:
+            context: .
+            file: ./Dockerfile
+            push: true
+            tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
+
+        - name: Run Trivy vulnerability scanner
+          uses: aquasecurity/trivy-action@1f0aa582c8c8f5f7639610d6d38baddfea4fdcee # 0.9.2
+          continue-on-error: true
+          with:
+            image-ref: docker.io/${{ inputs.image }}:${{ steps.meta.outputs.version }}
+            format: 'sarif'
+            output: 'trivy-results-${{ inputs.image }}.sarif'
+            ignore-unfixed: 'true'
+
+        - name: Upload Trivy scan results to GitHub Security tab
+          uses: github/codeql-action/upload-sarif@16964e90ba004cdf0cd845b866b5df21038b7723 # v2.2.6
+          continue-on-error: true
+          with:
+            sarif_file: 'trivy-results-${{ inputs.image }}.sarif'

.github/workflows/go.yml

@@ -5,7 +5,7 @@ name: Go
 
 on:
   push:
-    branches: [ "main" ]
+    branches: [ "main", "*" ]
   pull_request:
     branches: [ "main" ]