pull_request.yaml

name: Validate on Pull Request

on:
  workflow_dispatch:
  pull_request:
    types: [ opened, reopened, synchronize ]
    paths:
      - "**/Dockerfile"

jobs:
  security-checks:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: write
      id-token: write
    strategy:
      max-parallel: 5
      matrix:
        image-name:
          - github-runner
          - samba
          - php-pdo
    steps:
      - name: Checkout Repo
        uses: actions/checkout@v4
      - name: Build Local Image
        uses: drewbernetes/container-security-action@v0.2.0
        with:
          image-repo: "drewviles"
          repo-username: ${{ secrets.DOCKER_USER }}
          repo-password: ${{ secrets.DOCKER_PASSWORD }}
          image-name: ${{ matrix.image-name }}
          image-tag: v0.0.0
          check-severity: "high"
          grypeignore-from-s3: true
          s3-endpoint: "https://api.s3.hudson-viles.uk"
          s3-access-key: ${{secrets.S3_ACCESS_KEY}}
          s3-secret-key: ${{secrets.S3_SECRET_KEY}}
          s3-bucket: "grypeignores"
          s3-path: "docker-images.yaml"
          add-latest-tag: true
          publish-image: true
          ignore-not-fixed: true
          cosign-private-key: ${{secrets.COSIGN_KEY}}
          cosign-password: ${{secrets.COSIGN_PASSWORD}}
          cosign-tlog: true
          dockerfile-path: ${{ matrix.image-name }}
          enable-dependency-graph: true
          github-token: ${{ secrets.GITHUB_TOKEN }}