docker-image.yml

---
name: Docker Image CI

on: # yamllint disable-line rule:truthy
  push:
    branches: ["main"]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: ["main"]
  workflow_dispatch:

env:
  IMAGE_NAME: algorithm-exercises-cpp
  ARTIFACT_NAME: algorithm-exercises-cpp_${{ github.sha }}

permissions:
  contents: read

jobs:
  setup:
    name: "Setup matrix"
    runs-on: ubuntu-26.04
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - name: Set base images matrix
        id: set-matrix
        run: |
          echo 'matrix={"base_image":["alpine","debian","ubuntu"]}' \
            >> "$GITHUB_OUTPUT"

  build-lint:
    name: "Build Docker LINT image (${{ matrix.base_image }})"
    runs-on: ubuntu-26.04
    needs: setup
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.setup.outputs.matrix) }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: "LINT: Build and push"
        uses: docker/build-push-action@v7
        with:
          context: .
          file: Dockerfile.${{ matrix.base_image }}
          target: lint
          outputs:
            # yamllint disable-line rule:line-length
            type=docker,dest=/tmp/${{ env.ARTIFACT_NAME }}_${{ matrix.base_image }}_lint.tar
          tags: |
            ${{ env.IMAGE_NAME }}-${{ matrix.base_image }}:lint
      - name: "LINT: Upload artifact"
        uses: actions/upload-artifact@v7
        with:
          name: ${{ env.ARTIFACT_NAME }}_${{ matrix.base_image }}_lint
          path: /tmp/${{ env.ARTIFACT_NAME }}_${{ matrix.base_image }}_lint.tar

  build-test:
    name: "Build Docker TEST image (${{ matrix.base_image }})"
    runs-on: ubuntu-26.04
    needs: setup
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.setup.outputs.matrix) }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: "TEST: Build and push"
        uses: docker/build-push-action@v7
        with:
          context: .
          file: Dockerfile.${{ matrix.base_image }}
          target: testing
          outputs:
            # yamllint disable-line rule:line-length
            type=docker,dest=/tmp/${{ env.ARTIFACT_NAME }}_${{ matrix.base_image }}_test.tar
          tags: |
            ${{ env.IMAGE_NAME }}-${{ matrix.base_image }}:test
      - name: "TEST: Upload artifact"
        uses: actions/upload-artifact@v7
        with:
          name: ${{ env.ARTIFACT_NAME }}_${{ matrix.base_image }}_test
          path: /tmp/${{ env.ARTIFACT_NAME }}_${{ matrix.base_image }}_test.tar

  build-prod:
    name: "Build Docker PRODUCTION image (${{ matrix.base_image }})"
    runs-on: ubuntu-26.04
    needs: setup
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.setup.outputs.matrix) }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
      - name: "PRODUCTION: Build and push"
        uses: docker/build-push-action@v7
        with:
          context: .
          file: Dockerfile.${{ matrix.base_image }}
          target: production
          outputs:
            # yamllint disable-line rule:line-length
            type=docker,dest=/tmp/${{ env.ARTIFACT_NAME }}_${{ matrix.base_image }}_prod.tar
          tags: |
            ${{ env.IMAGE_NAME }}:latest-${{ matrix.base_image }}
            ${{ env.IMAGE_NAME }}:${{ github.sha }}-${{ matrix.base_image }}
      - name: "PRODUCTION: Upload artifact"
        uses: actions/upload-artifact@v7
        with:
          name: ${{ env.ARTIFACT_NAME }}_${{ matrix.base_image }}_prod
          path: /tmp/${{ env.ARTIFACT_NAME }}_${{ matrix.base_image }}_prod.tar

  run-lint-markdown:
    name: "Run in docker: Markdown LINT"
    runs-on: ubuntu-26.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Run markdown lint
        run: >
          make compose/lint/markdown

  run-lint-yaml:
    name: "Run in docker: YAML LINT"
    runs-on: ubuntu-26.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Run YAML lint
        run: >
          make compose/lint/yaml

  run-lint-json:
    name: "Run in docker: JSON LINT"
    runs-on: ubuntu-26.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Run JSON lint
        run: >
          make compose/lint/json

  run-lint:
    name: "Run in docker: LINT (${{ matrix.base_image }})"
    runs-on: ubuntu-26.04
    needs: [setup, build-lint]
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.setup.outputs.matrix) }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Download artifact
        uses: actions/download-artifact@v8
        with:
          name: ${{ env.ARTIFACT_NAME }}_${{ matrix.base_image }}_lint
          path: /tmp/

      - name: Load image
        env:
          # yamllint disable-line rule:line-length
          ARTIFACT_FILE: "${{ env.ARTIFACT_NAME }}_${{ matrix.base_image }}_lint.tar"
        run: |
          docker load --input /tmp/${{ env.ARTIFACT_FILE }}
          docker image ls -a

      - name: Run lint
        env:
          BASE_IMAGE: ${{ matrix.base_image }}
        run: >
          docker
          run --rm ${{ env.IMAGE_NAME }}-${{ matrix.base_image }}:lint
          make lint-no-deps

  run-test:
    name: "Run in docker: TEST (${{ matrix.base_image }})"
    runs-on: ubuntu-26.04
    needs: [setup, build-test]
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.setup.outputs.matrix) }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Download artifact
        uses: actions/download-artifact@v8
        with:
          name: ${{ env.ARTIFACT_NAME }}_${{ matrix.base_image }}_test
          path: /tmp/

      - name: Load image
        env:
          # yamllint disable-line rule:line-length
          ARTIFACT_FILE: "${{ env.ARTIFACT_NAME }}_${{ matrix.base_image }}_test.tar"
        run: |
          docker load --input /tmp/${{ env.ARTIFACT_FILE }}
          docker image ls -a

      - name: Run test
        run: >
          docker
          run --rm ${{ env.IMAGE_NAME }}-${{ matrix.base_image }}:test
          make test-no-deps

  # yamllint disable rule:line-length
  # security:
  #   name: "Snyk Container"
  #   runs-on: ubuntu-26.04
  #   needs: build-prod
  #   permissions:
  #     actions: read
  #     contents: read
  #     security-events: write
  #   steps:
  #     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
  #     - name: Download artifact
  #       uses: actions/download-artifact@v4
  #       with:
  #         name: ${{ env.ARTIFACT_NAME }}_prod
  #         path: /tmp/

  #     - name: Load image
  #       run: |
  #         docker load --input /tmp/${{ env.ARTIFACT_NAME }}_prod.tar
  #         docker image ls -a

  #     - name: Run Snyk to check Docker image for vulnerabilities
  #       # Snyk can be used to break the build when it detects vulnerabilities.
  #       # In this case we want to upload the issues to GitHub Code Scanning
  #       continue-on-error: true
  #       uses: snyk/actions/docker@master
  #       env:
  #         # yamllint disable rule:line-length
  #         # In order to use the Snyk Action you will need to have a Snyk API token.
  #         # See https://docs.snyk.io/integrations/ci-cd-integrations/github-actions-integration#getting-your-snyk-token
  #         # or you can sign up for free at https://snyk.io/login
  #         # yamllint enable rule:line-length
  #         SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
  #       with:
  #         image: ${{ env.IMAGE_NAME }}:${{ github.sha }}
  #         args: --file=Dockerfile
  #     # yamllint disable rule:line-length
  #     # https://github.com/github/codeql-action/issues/2187#issuecomment-2043220400
  #     - name: Replace security-severity undefined for license-related findings
  #       run: |
  #         sed -i 's/"security-severity": "undefined"/"security-severity": "0"/g' snyk.sarif
  #         sed -i 's/"security-severity": "null"/"security-severity": "0"/g' snyk.sarif
  #     # yamllint enable rule:line-length
  #     - name: Upload result to GitHub Code Scanning
  #       uses: github/codeql-action/upload-sarif@v3
  #       with:
  #         sarif_file: 'snyk.sarif'
  # yamllint enable rule:line-length

  scan:
    name: "Trivy (${{ matrix.base_image }})"
    runs-on: ubuntu-26.04
    needs: [setup, build-prod]
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.setup.outputs.matrix) }}
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Download artifact
        uses: actions/download-artifact@v8
        with:
          name: ${{ env.ARTIFACT_NAME }}_${{ matrix.base_image }}_prod
          path: /tmp/

      - name: Load image
        env:
          # yamllint disable-line rule:line-length
          ARTIFACT_FILE: "${{ env.ARTIFACT_NAME }}_${{ matrix.base_image }}_prod.tar"
        run: |
          docker load --input /tmp/${{ env.ARTIFACT_FILE }}
          docker image ls -a

      - name: Run Trivy vulnerability scanner (cli report)
        uses: aquasecurity/trivy-action@v0.36.0
        with:
          # yamllint disable-line rule:line-length
          image-ref: ${{ env.IMAGE_NAME }}:${{ github.sha }}-${{ matrix.base_image }}
          format: "table"
        env:
          TRIVY_DB_REPOSITORY: ${{ vars.TRIVY_DB_REPOSITORY }}

      - name: Run Trivy vulnerability scanner (sarif report)
        uses: aquasecurity/trivy-action@v0.36.0
        with:
          # yamllint disable-line rule:line-length
          image-ref: ${{ env.IMAGE_NAME }}:${{ github.sha }}-${{ matrix.base_image }}
          format: "sarif"
          output: "trivy-results-${{ matrix.base_image }}.sarif"
        env:
          TRIVY_DB_REPOSITORY: ${{ vars.TRIVY_DB_REPOSITORY }}

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: "trivy-results-${{ matrix.base_image }}.sarif"