build.yaml

---
name: Build Containers

on:
  pull_request:
    paths-ignore:
      - "**/*.md"

env:
  KICS_apt_version_pin: 965a08d7-ef86-4f14-8792-4a3b2098937e

jobs:
  kics-scan:
    name: KICS Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v2
        with:
          path: "repo"
      - name: KICS Github Action
        uses: checkmarx/kics-action@v1.5
        with:
          path: "repo"
          output_path: "results"
          exclude_queries: ${{ env.KICS_apt_version_pin }}
          fail_on: high,medium
          enable_comments: true

  build:
    name: Build
    runs-on: ubuntu-latest
    needs:
      - kics-scan
    steps:
      - name: Code checkout
        uses: actions/checkout@v2

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v3
        with:
          context: .
          push: true
          build-args: |
            RUBY_VERSION=3.1.2
            TERRAFORM_VERSIONS=0.14.7 1.5.6
          tags: ghcr.io/${{ github.repository }}:rc-${{ github.head_ref }}

  test:
    name: test
    runs-on: ubuntu-latest
    needs:
      - build
    strategy:
      matrix:
        terraform_version:
          - 0.14.7
          - 1.5.6
        ruby_version:
          - 3.1.2
    env:
      TFENV_TERRAFORM_VERSION: ${{ matrix.terraform_version }}
    steps:
      - name: Code checkout
        uses: actions/checkout@v2

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Test container [kitchen converge]
        run: docker run --rm -e TFENV_TERRAFORM_VERSION=${TFENV_TERRAFORM_VERSION} -v "$(pwd)/examples/check-container":/usr/action ghcr.io/${{ github.repository }}:rc-${{ github.head_ref }} "converge"
      - name: Test container [kitchen verify]
        run: docker run --rm -e TFENV_TERRAFORM_VERSION=${TFENV_TERRAFORM_VERSION} -v "$(pwd)/examples/check-container":/usr/action ghcr.io/${{ github.repository }}:rc-${{ github.head_ref }} "verify"