build-centos8.yml

name: Build and publish CentOS 8 runner

on:
  schedule:
    - cron: '15 3 1 * *'  # build once a week unless needed to more frequently
  workflow_dispatch:
  push:
    branches:
    - main
    paths:
    - 'images/centos8.Dockerfile'
    - '.github/workflows/**-centos8.yml'
    - 'images/**.sh'
    - 'images/docker/*'
    - 'images/patched/*'
    - 'images/software/*'
    - 'images/supervisor/*'

jobs:
  build:
    runs-on: [ ubuntu-latest ]

    steps:
      - name: Checkout
        uses: actions/checkout@v2

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v1
        with:
          registry: ghcr.io
          username: ${{ secrets.GHCR_USERNAME }}
          password: ${{ secrets.GHCR_TOKEN }}

      - name: Build the image
        run: |
          cd images
          docker build --network=host --file centos8.Dockerfile --tag ghcr.io/boozallen/goobernetes/centos8-runner:latest .

      - name: Run the Anchore scan action itself with GitHub Advanced Security code scanning integration enabled
        uses: anchore/scan-action@main
        with:
          image: "ghcr.io/boozallen/goobernetes/centos8-runner:latest"
          fail-build: false
          acs-report-enable: true

      - name: Upload Anchore Scan Report
        uses: github/codeql-action/upload-sarif@v1
        with:
          sarif_file: results.sarif

      - name: Generate SBOM for the CentOS 8 runner
        uses: anchore/sbom-action@v0
        with:
          image: ghcr.io/boozallen/goobernetes/centos8-runner:latest

      - name: Push to GitHub Packages
        run: docker push ghcr.io/boozallen/goobernetes/centos8-runner:latest