docker-image.yml

name: Docker Image CI with Trivy Security Report

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]

jobs:
  build:
    runs-on: ubuntu-latest

    env:
      IMAGE_TAG: ${{ github.run_id }}

    steps:
    - uses: actions/checkout@v3
    
    - name: Build the Docker image
      run: |
        docker build . --file Dockerfile --tag name-convention-generator:${IMAGE_TAG}
    
    - name: Set up Trivy
      run: |
        sudo apt-get update
        sudo apt-get install -y wget
        wget https://github.com/aquasecurity/trivy/releases/download/v0.40.0/trivy_0.40.0_Linux-64bit.deb
        sudo dpkg -i trivy_0.40.0_Linux-64bit.deb
        trivy --version

    - name: Scan Docker image with Trivy and generate SARIF
      run: |
        mkdir -p trivy-reports
        trivy image name-convention-generator:${IMAGE_TAG} \
          --format sarif \
          --output trivy-reports/trivy-report.sarif \
          --severity HIGH,CRITICAL

    - name: Upload SARIF file to GitHub Security tab
      uses: github/codeql-action/upload-sarif@v2
      with:
        sarif_file: trivy-reports/trivy-report.sarif