build-test.yml

name: Build-Test

on:
  pull_request:
  workflow_dispatch:

jobs:
  Build-Test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v1
      - name: Build rootless image
        run: ./build-rootless.sh $(echo $GITHUB_REPOSITORY |cut -d '/' -f1)
      - name: Build standard image
        run: ./build.sh $(echo $GITHUB_REPOSITORY |cut -d '/' -f1)
      - name: List Docker images
        run: docker images --filter "reference=puppet-dev-tools*" --filter "reference=*/puppet-dev-tools*"
      - name: Show Docker image labels
        run: |
          docker inspect --format='{{json .Config.Labels}}' ${{ secrets.DOCKERHUB_USERNAME }}/puppet-dev-tools
      - name: Trivy scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: puppet-dev-tools:latest
          exit-code: 1
          ignore-unfixed: true
          severity: 'CRITICAL,HIGH,MEDIUM'
          vuln-type: os
          timeout: 10m0s
          skip-files: "/root/.pdk/cache/ruby/*/gems/aws-sdk-core-*/lib/aws-sdk-ssooidc/client.rb"
        env:
          TRIVY_SKIP_DB_UPDATE: true
          TRIVY_SKIP_JAVA_DB_UPDATE: true
      - name: Run tests
        working-directory: ${{ github.workspace }}/tests
        run: ./run_tests.sh