docker.yml

name: Build & Push
on:
  push:
    branches: [main]
jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    strategy:
      matrix:
        service: [web, runtime]
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v4
      - uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/build-push-action@v7
        with:
          context: .
          file: apps/${{ matrix.service }}/Dockerfile
          push: true
          cache-from: type=gha
          cache-to: type=gha,mode=max
          tags: |
            ghcr.io/${{ github.repository_owner }}/apifold-${{ matrix.service }}:latest
            ghcr.io/${{ github.repository_owner }}/apifold-${{ matrix.service }}:${{ github.sha }}
      - uses: aquasecurity/trivy-action@76071ef0d7ec797419534a183b498b4d6366cf37 # v0.31.0
        with:
          image-ref: ghcr.io/${{ github.repository_owner }}/apifold-${{ matrix.service }}:${{ github.sha }}
          severity: "HIGH,CRITICAL"
          exit-code: "1"