docker-publish.yml

name: Docker Nessus-Scanner CI

run-name: ${{ github.event.inputs.manual_commit_message }}

on:
  push:
    paths:
     - 'Dockerfile'
  workflow_dispatch:
    inputs:
      manual_commit_message:
        description: "Insert manual commit message"
        type: string
        required: true

jobs:
  Build:
    runs-on: ubuntu-22.04

    steps:
    - uses: actions/checkout@v4

    - name: Build Docker Image
      run: docker buildx build -t ciromota/nessus-scanner:latest .

  Test:
    runs-on: ubuntu-22.04
    needs: Build
    permissions:
      contents: read
      id-token: write
      packages: write
      security-events: write

    steps:
    - uses: actions/checkout@v4

    - name: Build Docker Image
      run: docker buildx build -t ciromota/nessus-scanner:latest .

    - name: Run Trivy vulnerability scanner
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: 'ciromota/nessus-scanner:latest'
        format: 'sarif'
        output: 'trivy-results.sarif'
        exit-code: '1'
        ignore-unfixed: true
        vuln-type: 'os,library'
        severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL'
      
    - name: Push trivy results
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: 'trivy-results.sarif'

    - name: Container Running and Health Check
      run: |
        docker container run -td --name nessus-scanner -p 8834:8834 -v /etc/localtime:/etc/localtime ciromota/nessus-scanner:latest
        
        CONTAINER_NAME=$(docker ps -a | awk 'FNR==2{print $1}')

        if docker inspect -f '{{.State.Running}}' "$CONTAINER_NAME" 2>/dev/null | grep -q "true"; then
            echo "::notice:: All tests OK. 🚀"
        else
            echo "::error:: Failing, reason: Container is not running."
            exit 1
        fi

  Push:
    needs: Test
    runs-on: ubuntu-22.04

    steps:
    - name: Check out the repo
      uses: actions/checkout@v4

    - name: Install Cosign
      uses: sigstore/cosign-installer@v3.1.1

    - name: Docker Registry Login
      uses: docker/login-action@v3
      with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

    - name: Extract metadata for Docker
      id: meta
      uses: docker/metadata-action@v5
      with:
          images: ciromota/nessus-scanner
          flavor: |
            latest=true

    - name: Build and Push Docker image
      uses: docker/build-push-action@v5
      with:
          context: .
          push: true
          tags: ciromota/nessus-scanner:latest

    - name: Sign image with Cosign
      run: |
          cosign sign --yes --key env://COSIGN_PRIVATE_KEY ciromota/nessus-scanner:latest
      env:
        COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
        COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}