docker.yaml

---

name: 'Docker'


on:
  workflow_call:
    inputs:
      DOCKER_BUILD_REGISTRY:
        default: "ghcr.io"
        description: Registry where build image will live
        required: false
        type: string
      DOCKER_BUILD_IMAGE_NAME:
        default: "${{ github.repository }}"
        description: Docker image name for building image
        required: false
        type: string
      DOCKER_BUILD_IMAGE_NAME_NO_ORG:
        default: "${{ github.repository.name }}"
        description: Docker image name for building image
        required: false
        type: string
      DOCKER_BUILD_IMAGE_TAG:
        default: "${{ github.sha }}"
        description: Docker image tag for building image
        required: false
        type: string
      DOCKER_FILE:
        default: "dockerfile"
        description: Path to the dockerfile
        required: false
        type: string
      DOCKER_LABEL_ARTIFACTHUB_MAINTAINER:
        default: '[{"name":"No Fuss Computing","email":"helpdesk@nofusscomputing.com"}]'
        description: Artifact hub Maintainer
        required: false
        type: string
      DOCKER_LABEL_ARTIFACTHUB_README:
        default: 'https://raw.githubusercontent.com/${{ github.repository }}/development/README.md'
        description: Artifact hub ReadMe
        required: false
        type: string
      DOCKER_PUBLISH_REGISTRY:
        default: "docker.io"
        description: Registry where image will be published to
        required: false
        type: string
      DOCKER_PUBLISH_IMAGE_NAME:
        default: "${{ github.repository }}"
        description: Docker image name for publishing the image
        required: false
        type: string
      DOCKER_SCAN_IMAGE_VULNERABILITY:
        default: true
        description: Scan Image with Trivy
        required: false
        type: boolean
      DOCKER_TAG_IMAGE_TAG_SOURCE:
        default: "${{ github.sha }}"
        description: Docker image tag Used for source Image to tag
        required: false
        type: string
      DOCKER_TAG_IMAGE_TAG_LATEST:
        default: true
        description: Create image with tag 'Latest'
        required: false
        type: boolean
      DOCKER_TAG_IMAGE_TAG_SHA:
        default: true
        description: Create image with tag that is the git commit
        required: false
        type: boolean
    secrets:
      DOCKER_PUBLISH_USERNAME:
        description: Publish Docker registry username
        required: true
      DOCKER_PUBLISH_PASSWORD:
        description: Publish Docker registry username
        required: true

env:
  TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2    # see https://github.com/nofusscomputing/action_python/issues/10


permissions:
  artifact-metadata: write
  pull-requests: write
  contents: write
  actions: read
  checks: write
  packages: write
  security-events: write
  statuses: write
  id-token: write
  attestations: write

jobs:

  # causes CI to report failed
  # docker-image-exists:
  #   if:
  #     (${{
  #       github.event.push
  #         ||
  #       github.ref_type == 'tag'
  #     }})
  #   runs-on: ubuntu-latest
  #   name: Check if Image Exists
  #   outputs:
  #     result_un_tagged: ${{ steps.image_exists.conclusion }}  
  #     result_tagged: ${{ steps.image_exists_tagged.conclusion }}
  #   continue-on-error: true
  #   steps:



  #     - name: Debug
  #       run: |
  #         echo "${{ github.event.pull_request.head.repo.full_name || github.repository }}";
  #         echo "**************************";
  #         echo "${{ github.event.pull_request.head.repo.full_name }}";
  #         echo "**************************";
  #         echo "${{ github.repository }}";
  #         echo "**************************";
  #         echo "${{ github.event.pull_request.head.repo }}";
  #         echo "**************************";
  #         echo "${{ github.event.push }}";
  #         echo "**************************";
  #         echo "${{ inputs.DOCKER_BUILD_IMAGE_NAME_NO_ORG }}";
  #         echo "**************************";

  #     # - uses: actions/checkout@v4


  #     - name: Check image exists
  #       id: image_exists
  #       uses: cloudposse/github-action-docker-image-exists@main
  #       with:
  #         registry: ${{ inputs.DOCKER_BUILD_REGISTRY }}
  #         organization: "${{ github.event.repository.owner.login }}"
  #         repository: 'centurion-erp'
  #         login: ${{ github.actor }}
  #         password: ${{ secrets.GITHUB_TOKEN }}
  #         tag: ${{ inputs.DOCKER_BUILD_IMAGE_TAG }}


  #     - name: Check image exists (tagged)
  #       id: image_exists_tagged
  #       uses: cloudposse/github-action-docker-image-exists@main
  #       with:
  #         registry: ${{ inputs.DOCKER_BUILD_REGISTRY }}
  #         organization: "${{ github.event.repository.owner.login }}"
  #         repository: 'centurion-erp'
  #         login: ${{ github.actor }}
  #         password: ${{ secrets.GITHUB_TOKEN }}
  #         tag: ${{ github.ref_name }}



  #     - name: Debug
  #       if: success() || failure()
  #       run: |
  #         echo "${{ steps.image_exists_no.conclusion }}";
  #         echo "**************************";
  #         echo "${{ steps.image_exists.conclusion }}";
  #         echo "**************************";
  #         echo "${{ steps.image_exists.outputs.image }}";
  #         echo "**************************";
  #         echo "${{ steps.image_exists.outputs.tag }}";
  #         echo "**************************";




  docker-build:
    if: >-
      (
        github.event_name == 'push'
          ||
        github.ref_type == 'tag'
      )
    runs-on: ubuntu-latest
    # needs:
    #   - docker-image-exists
    name: Build Image
    outputs:
      build-image-digest: ${{ steps.image-digest.outputs.value-out }}
    steps:


      - name: Image
        run: |
          echo "The image already exists"


      - name: Debug
        run: |
          echo "${{ github.event.pull_request.head.repo.full_name || github.repository }}";
          echo "**************************";
          echo "${{ github.event.pull_request.head.repo.full_name }}";
          echo "**************************";
          echo "${{ github.repository }}";
          echo "**************************";
          echo "${{ github.event.pull_request.head.repo }}";
          echo "**************************";
          echo "${{ github.event.push }}";
          echo "**************************";
          echo "${{ github.event_nam }}";
          echo "**************************";
          echo "${{ inputs.DOCKER_BUILD_IMAGE_NAME_NO_ORG }}";
          echo "**************************";

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1    # v7.0.1


      - name: Download built artifact to dist/
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c    # V8.0.1
        continue-on-error: true
        with:
          name: Packages
          path: dist


      - name: Log into registry ${{ inputs.DOCKER_BUILD_REGISTRY }}
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
        with:
          registry: ${{ inputs.DOCKER_BUILD_REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}


      # - name: Setup BuildX
      #   run: |
      #     docker buildx create --name project-v3-builder;
      #     docker buildx use project-v3-builder;


      # - name: build image
      #   run: |
      #     docker buildx build --platform="linux/amd64,linux/arm64" . \
      #       --label "org.opencontainers.image.created=$(date '+%Y-%m-%dT%H:%M:%S%:z')" \
      #       --label "org.opencontainers.image.source=https://github.com/${{ github.repository }}" \
      #       --label "org.opencontainers.image.revision=${{ github.sha }}" \
      #       \
      #       --label "io.artifacthub.package.readme-url=${{ inputs.DOCKER_LABEL_ARTIFACTHUB_README }}" \
      #       --label 'io.artifacthub.package.maintainers=${{ inputs.DOCKER_LABEL_ARTIFACTHUB_MAINTAINER }}' \
      #       \
      #       --build-arg CI_PROJECT_URL=https://github.com/${{ github.repository }} \
      #       --build-arg CI_COMMIT_SHA=${{ github.sha }} \
      #       --build-arg CI_COMMIT_TAG=${{ github.ref_name }} \
      #     --push \
      #     --file ${{ inputs.DOCKER_FILE }} \
      #     --tag ${{ inputs.DOCKER_BUILD_REGISTRY }}/${{ inputs.DOCKER_BUILD_IMAGE_NAME }}:${{ inputs.DOCKER_BUILD_IMAGE_TAG }};


      - name: Set up QEMU
        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1    # v4.4.0


      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069    # v4.4.1


      - name: set build timestamp
        id: timestamp
        run: echo "created=$(date '+%Y-%m-%dT%H:%M:%S%:z')" >> "$GITHUB_OUTPUT"


      - name: build image
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc    # v7.4.0
        with:
          build-args: |
            CI_PROJECT_URL=https://github.com/${{ github.repository }}
            CI_COMMIT_SHA=${{ github.sha }}
            CI_COMMIT_TAG=${{ github.ref_name }}
          context: .
          file: ${{ inputs.DOCKER_FILE }}
          labels: |
            org.opencontainers.image.created=${{ steps.timestamp.outputs.created }}
            org.opencontainers.image.source=https://github.com/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}
            io.artifacthub.package.readme-url=${{ inputs.DOCKER_LABEL_ARTIFACTHUB_README }}
            io.artifacthub.package.maintainers=${{ inputs.DOCKER_LABEL_ARTIFACTHUB_MAINTAINER }}
          platforms: linux/amd64,linux/arm64
          # provenance: mode=max
          push: true
          # sbom: true
          sbom: false
          tags: ${{ inputs.DOCKER_BUILD_REGISTRY }}/${{ inputs.DOCKER_BUILD_IMAGE_NAME }}:${{ inputs.DOCKER_BUILD_IMAGE_TAG }}


      - name: Fetch image
        run: |
          docker pull ${{ inputs.DOCKER_BUILD_REGISTRY }}/${{ inputs.DOCKER_BUILD_IMAGE_NAME }}:${{ inputs.DOCKER_BUILD_IMAGE_TAG }} >> /dev/null;


      - name: Fetch Manifest digest
        id: image-digest
        run: |
          echo "value-out=$(docker inspect --format='{{index .RepoDigests 0}}' ${{ inputs.DOCKER_BUILD_REGISTRY }}/${{ inputs.DOCKER_BUILD_IMAGE_NAME }}:${{ inputs.DOCKER_BUILD_IMAGE_TAG }} | cut -d '@' -f 2)" >> $GITHUB_OUTPUT


      - name: Attest build provenance
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6    # v4.2.2
        with:
          subject-name: ${{ inputs.DOCKER_BUILD_REGISTRY }}/${{ inputs.DOCKER_BUILD_IMAGE_NAME }}
          subject-digest: ${{ steps.image-digest.outputs.value-out }}
          push-to-registry: true


      # - name: Build and push
      #   uses: docker/build-push-action@v7
      #   with:
      #     context: .
      #     labels:
      #       org.opencontainers.image.source: https://github.com/${{ github.repository }}
      #     push: true
      #     tags: ${{ inputs.DOCKER_BUILD_REGISTRY }}/${{ inputs.DOCKER_BUILD_IMAGE_NAME }}:${{ inputs.DOCKER_BUILD_IMAGE_TAG }}



      # - name: Remove "Unknown" Image from Manifest - development branch
      #   if: ${{ github.ref_name == 'development' }}
      #   run: |

      #     DOCKER_MULTI_ARCH_IMAGES=$(docker buildx imagetools inspect "${{ inputs.DOCKER_BUILD_REGISTRY }}/${{ inputs.DOCKER_BUILD_IMAGE_NAME }}:${{ inputs.DOCKER_BUILD_IMAGE_TAG }}" --format "{{ range .Manifest.Manifests }}{{ if ne (print .Platform) \"&{unknown unknown  [] }\" }}${{ inputs.DOCKER_BUILD_REGISTRY }}/${{ inputs.DOCKER_BUILD_IMAGE_NAME }}:${{ inputs.DOCKER_BUILD_IMAGE_TAG }}@{{ println .Digest }}{{end}} {{end}}");

      #     docker buildx imagetools create $DOCKER_MULTI_ARCH_IMAGES \
      #       --tag ${{ inputs.DOCKER_BUILD_REGISTRY }}/${{ inputs.DOCKER_BUILD_IMAGE_NAME }}:${{ inputs.DOCKER_BUILD_IMAGE_TAG }} \
      #       --tag ${{ inputs.DOCKER_BUILD_REGISTRY }}/${{ inputs.DOCKER_BUILD_IMAGE_NAME }}:dev;


      # - name: Remove "Unknown" Image from Manifest - other branches
      #   if: ${{ github.ref_name != 'development' }}
      #   run: |

      #     DOCKER_MULTI_ARCH_IMAGES=$(docker buildx imagetools inspect "${{ inputs.DOCKER_BUILD_REGISTRY }}/${{ inputs.DOCKER_BUILD_IMAGE_NAME }}:${{ inputs.DOCKER_BUILD_IMAGE_TAG }}" --format "{{ range .Manifest.Manifests }}{{ if ne (print .Platform) \"&{unknown unknown  [] }\" }}${{ inputs.DOCKER_BUILD_REGISTRY }}/${{ inputs.DOCKER_BUILD_IMAGE_NAME }}:${{ inputs.DOCKER_BUILD_IMAGE_TAG }}@{{ println .Digest }}{{end}} {{end}}");

      #     docker buildx imagetools create $DOCKER_MULTI_ARCH_IMAGES \
      #       --tag ${{ inputs.DOCKER_BUILD_REGISTRY }}/${{ inputs.DOCKER_BUILD_IMAGE_NAME }}:${{ inputs.DOCKER_BUILD_IMAGE_TAG }};


      # - name: Attest
      #   if: >-
      #     github.ref_name == 'development'
      #       ||
      #     github.ref_name == 'master'
      #       ||
      #     github.ref_type == 'tag'
      #   uses: actions/attest-build-provenance@v1.4.3
      #   id: image-attest
      #   with:
      #     subject-name: ${{ inputs.DOCKER_BUILD_REGISTRY }}/${{ inputs.DOCKER_BUILD_IMAGE_NAME }}
      #     subject-digest: ${{ steps.image-digest.outputs.value-out }}
      #     push-to-registry: true


      # - name: Upload Image Attestation Artifact
      #   if: >-
      #     github.ref_name == 'development'
      #       ||
      #     github.ref_name == 'master'
      #       ||
      #     github.ref_type == 'tag'
      #   uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a    # v7.0.1
      #   with:
      #     name: ${{ inputs.DOCKER_BUILD_REGISTRY }}-attestation-image
      #     path: ${{ steps.image-attest.outputs.bundle-path }}


      # - name: Cleanup BuildX
      #   run: |
      #     docker buildx rm project-v3-builder;



  docker-scan-vulnerability:
    if: >-
      (
        github.event_name == 'push'
          ||
        github.ref_type == 'tag'
      )
        &&
      inputs.DOCKER_SCAN_IMAGE_VULNERABILITY
    needs:
      - docker-build
    runs-on: ubuntu-latest
    name: Vulnerability Scan
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1    # v7.0.1


      - name: Dummy Task
        if: inputs.DOCKER_SCAN_IMAGE_VULNERABILITY == false
        run: |
          echo "Scanning image turned off.This Job does nothing however as 'docker-scan-vulnerability' is a dependency job, must do something.";


      - name: Log into registry ${{ inputs.DOCKER_BUILD_REGISTRY }}
        if: inputs.DOCKER_SCAN_IMAGE_VULNERABILITY
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
        with:
          registry: ${{ inputs.DOCKER_BUILD_REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}


      - name: Run Trivy vulnerability scanner (sarif Report)
        if: inputs.DOCKER_SCAN_IMAGE_VULNERABILITY
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25    # v0.36.0
        with:
          image-ref: '${{ inputs.DOCKER_BUILD_REGISTRY }}/${{ inputs.DOCKER_BUILD_IMAGE_NAME }}:${{ inputs.DOCKER_BUILD_IMAGE_TAG }}'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'LOW,MEDIUM,HIGH,CRITICAL'
          vuln-type: 'os,library'
          scanners: vuln
          ignore-unfixed: true


      - name: Create Draft GH Release
        if: github.ref_type == 'tag'
        uses: softprops/action-gh-release@v2
        with:
          name:  ${{ github.ref_name }}
          tag_name:  ${{ github.ref_name }}
          draft: true
          files: |
            trivy-results.sarif


      - name: Upload Trivy scan results to GitHub Security tab
        if: inputs.DOCKER_SCAN_IMAGE_VULNERABILITY && github.event_name != 'pull_request'
        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81    # v4.37.3
        with:
          sarif_file: 'trivy-results.sarif'


      - name: Upload scan results sarif Report)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a    # v7.0.1
        with:
          name: docker-scan-results-sarif
          path: trivy-results.sarif


      - run: |
          echo "${PWD}" || echo "couldnt PWD";

          echo "1";

          ls -la;

          echo "2";

          mkdir -p ${{ runner.temp }}/_github_home/ || echo "could not make";

          echo "2.1";

          ls -la ${{ runner.temp }}/_github_home/;

          echo "3";

          mv -f trivy-results.sarif ${{ runner.temp }}/_github_home/trivy-results.sarif;

          echo "4";

          ls -la ${{ runner.temp }}/_github_home/;


      - name: Convert Sarif -> Markdown
        if: success() || failure()
        id: sarif-to-markdown
        uses: 11notes/action-sarif-to-markdown@bc689850bd33a1037ea1d0a609ab4ea14b3c4396   # v1.2.0
        with:
          sarif_file: trivy-results.sarif


      - name: Create Report Artifact
        run: |
          ls -la ${{ runner.temp }}/_github_home/sarif.md;

          echo "## Docker Image Scan" > vulnerability-report.md;
          echo "" >> vulnerability-report.md;
          echo "- **Image:** ${{ inputs.DOCKER_BUILD_REGISTRY }}/${{ inputs.DOCKER_BUILD_IMAGE_NAME }}:${{ inputs.DOCKER_BUILD_IMAGE_TAG }}" >> vulnerability-report.md;
          echo "" >> vulnerability-report.md;
          echo ">[!tip]" >> vulnerability-report.md;
          echo ">" >> vulnerability-report.md;
          echo "> _If this report shows nothing, it means there was nothing found._" >> vulnerability-report.md;
          echo "" >> vulnerability-report.md;
          echo -n "#" >> vulnerability-report.md;
          cat ${{ runner.temp }}/_github_home/sarif.md >> vulnerability-report.md;


      - name: Upload scan results
        if: inputs.DOCKER_SCAN_IMAGE_VULNERABILITY
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a    # v7.0.1
        with:
          name: docker-vulnerability-report
          path: vulnerability-report.md


      # - name: Upload scan results
      #   if: inputs.DOCKER_SCAN_IMAGE_VULNERABILITY
      #   uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a    # v7.0.1
      #   with:
      #     name: docker-vulnerability-report-full
      #     path: full-vulnerability-report.md



  docker-sbom:
    if: >-
      (
        github.event_name == 'push'
          ||
        github.ref_type == 'tag'
      )
    needs: 
      - docker-build
    runs-on: ubuntu-latest
    name: Image SBOM
    steps:


      - name: Scan Image
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25    # v0.36.0
        with:
          scan-type: image
          format: cyclonedx
          output: dependency-results.sbom.json
          image-ref: '${{ inputs.DOCKER_BUILD_REGISTRY }}/${{ inputs.DOCKER_BUILD_IMAGE_NAME }}:${{ inputs.DOCKER_BUILD_IMAGE_TAG }}'
          scan-ref: .
          ignore-unfixed: false
          vuln-type: os,library
          severity: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
          list-all-pkgs: false


      - name: Upload SBOM as a Github artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a    # v7.0.1
        with:
          name: trivy-sbom-report
          path: '${{ github.workspace }}/dependency-results.sbom.json'


      - name: Create Draft GH Release
        if: github.ref_type == 'tag'
        uses: softprops/action-gh-release@v2
        with:
          name: ${{ github.ref_name }}
          tag_name:  ${{ github.ref_name }}
          draft: true
          files: |
            dependency-results.sbom.json


      - name: Log into registry ${{ inputs.DOCKER_BUILD_REGISTRY }}
        # if: >-
        #   (
        #     github.ref_name == 'development'
        #       ||
        #     github.ref_name == 'master'
        #       ||
        #     github.ref_type == 'tag'
        #   )
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
        with:
          registry: ${{ inputs.DOCKER_BUILD_REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}


      # - name: Generate SBOM Attestation
      #   # if: >-
      #   #   (
      #   #     github.ref_name == 'development'
      #   #       ||
      #   #     github.ref_name == 'master'
      #   #       ||
      #   #     github.ref_type == 'tag'
      #   #   )
      #   id: sbom-attest
      #   uses: actions/attest-sbom@v1.4.1
      #   with:
      #     subject-name: '${{ inputs.DOCKER_BUILD_REGISTRY }}/${{ inputs.DOCKER_BUILD_IMAGE_NAME }}'
      #     subject-digest: ${{ needs.docker-build.outputs.build-image-digest }}
      #     sbom-path: 'dependency-results.sbom.json'
      #     push-to-registry: true


      - name: Fetch image
        run: |
          docker pull ${{ inputs.DOCKER_BUILD_REGISTRY }}/${{ inputs.DOCKER_BUILD_IMAGE_NAME }}:${{ inputs.DOCKER_BUILD_IMAGE_TAG }} >> /dev/null;


      - name: Attest SBOM
        id: sbom-attest
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6    # v4.2.2
        with:
          subject-name: ${{ inputs.DOCKER_BUILD_REGISTRY }}/${{ inputs.DOCKER_BUILD_IMAGE_NAME }}
          subject-digest: ${{ needs.docker-build.outputs.build-image-digest }}
          sbom-path: 'dependency-results.sbom.json'
          push-to-registry: true


      - name: Upload SBOM Attestation Artifact
        # if: >-
        #   (
        #     github.ref_name == 'development'
        #       ||
        #     github.ref_name == 'master'
        #       ||
        #     github.ref_type == 'tag'
        #   )
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a    # v7.0.1
        with:
          name: ${{ inputs.DOCKER_BUILD_REGISTRY }}-attestation-image-sbom
          path: ${{ steps.sbom-attest.outputs.bundle-path }}


  docker-reports:
    needs: 
      - docker-scan-vulnerability
      - docker-build
    runs-on: ubuntu-latest
    name: Create Reports
    steps:


      - name: Dummy Task
        if: inputs.DOCKER_SCAN_IMAGE_VULNERABILITY == false
        run: |
          echo "Scanning image turned off.This Job does nothing however as 'docker-scan-vulnerability' is a dependency job, must do something.";


      - name: Fetch Scan Results
        if: inputs.DOCKER_SCAN_IMAGE_VULNERABILITY
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c    # V8.0.1
        with:
          name: docker-vulnerability-report


      - uses: dtinth/markdown-report-action@v1
        if: inputs.DOCKER_SCAN_IMAGE_VULNERABILITY
        with:
          name: Docker Vulnerability Report
          title: Vulnerability Report
          body-file: vulnerability-report.md



  docker-tagged:
    if: github.ref_type == 'tag'
    needs: 
      - docker-scan-vulnerability
      - docker-reports
    runs-on: ubuntu-latest
    name: Tagged Image
    steps:


      - name: Log into registry ${{ inputs.DOCKER_BUILD_REGISTRY }}
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
        with:
          registry: ${{ inputs.DOCKER_BUILD_REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}


      - name: Create Image Tag '${{ github.ref_name }}'
        run: |
          docker buildx imagetools create ${{ inputs.DOCKER_BUILD_REGISTRY }}/${{ inputs.DOCKER_BUILD_IMAGE_NAME }}:${{ inputs.DOCKER_TAG_IMAGE_TAG_SOURCE }} \
            --tag ${{ inputs.DOCKER_BUILD_REGISTRY }}/${{ inputs.DOCKER_BUILD_IMAGE_NAME }}:${{ github.ref_name }};


      - name: Create Image Tag 'latest'
        if: inputs.DOCKER_TAG_IMAGE_TAG_LATEST
        shell: bash
        run: |

          TAG_NAME=dev;

          if [ "${{ github.ref_name }}" == 'master' ]; then

            TAG_NAME=latest;

          fi

          echo "[Debug] TAG_NAME=${TAG_NAME}";

          docker buildx imagetools create ${{ inputs.DOCKER_BUILD_REGISTRY }}/${{ inputs.DOCKER_BUILD_IMAGE_NAME }}:${{ inputs.DOCKER_TAG_IMAGE_TAG_SOURCE }} \
            --tag ${{ inputs.DOCKER_BUILD_REGISTRY }}/${{ inputs.DOCKER_BUILD_IMAGE_NAME }}:${TAG_NAME};



  docker-pr-comment:
    if: >-
        github.event_name != 'pull_request'
          &&
        github.ref_type != 'tag'
    needs:
      - docker-scan-vulnerability
    runs-on: ubuntu-latest
    name: PR Comment (Vulnerability)
    steps:


      - name: Fetch Vulnerability Report
        if: inputs.DOCKER_SCAN_IMAGE_VULNERABILITY
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c    # V8.0.1
        with:
          name: docker-vulnerability-report


      - name: Capture scan results
        if: inputs.DOCKER_SCAN_IMAGE_VULNERABILITY
        run: |
          content=$(cat vulnerability-report.md | head -c 65000)
          echo "report<<EOF" >> $GITHUB_ENV
          echo "$content" >> $GITHUB_ENV
          echo "EOF" >> $GITHUB_ENV

      - uses: jwalton/gh-find-current-pr@f3d61b485d2801773f7a07b2aaa3306bd8f8e653    #v1.3.5
        id: finder

      - name: Comment scan results on PR
        if: inputs.DOCKER_SCAN_IMAGE_VULNERABILITY
        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88    # v3.0.5
        with:
          number: ${{ steps.finder.outputs.pr }}
          header: Docker Image Scan Results
          message: |
            ${{ env.report }}



  docker-publish:
    if: >-
      (
        github.ref_type == 'tag'
          ||
        github.ref_name == 'development'
      )
        &&
      github.event_name != 'pull_request'
    needs: 
      - docker-build
      - docker-scan-vulnerability
      - docker-reports
    runs-on: ubuntu-latest
    name: Publish
    steps:


      - name: Log into registry ${{ inputs.DOCKER_PUBLISH_REGISTRY }}
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
        with:
          registry: ${{ inputs.DOCKER_PUBLISH_REGISTRY }}
          username: ${{ secrets.DOCKER_PUBLISH_USERNAME }}
          password: ${{ secrets.DOCKER_PUBLISH_PASSWORD }}


      - name: Tag Image with GIT Tag '${{ github.ref_name }}'
        if: github.ref_type == 'tag'
        run: |
          docker buildx imagetools create ${{ inputs.DOCKER_BUILD_REGISTRY }}/${{ inputs.DOCKER_BUILD_IMAGE_NAME }}:${{ inputs.DOCKER_TAG_IMAGE_TAG_SOURCE }} \
            --tag ${{ inputs.DOCKER_PUBLISH_REGISTRY }}/${{ inputs.DOCKER_PUBLISH_IMAGE_NAME }}:${{ github.ref_name }} \


      - name: Tag Image with GIT 'latest'
        if: inputs.DOCKER_TAG_IMAGE_TAG_LATEST
        id: tag-image
        shell: bash
        run: |
          TAG_NAME=dev;

          if [ "${{ github.ref_name }}" == 'master' ]; then

            TAG_NAME=latest;

          fi

          echo "[Debug] TAG_NAME=${TAG_NAME}";

          echo "mutable_tag_name=${TAG_NAME}" > $GITHUB_OUTPUT

          docker buildx imagetools create ${{ inputs.DOCKER_BUILD_REGISTRY }}/${{ inputs.DOCKER_BUILD_IMAGE_NAME }}:${{ inputs.DOCKER_TAG_IMAGE_TAG_SOURCE }} \
            --tag ${{ inputs.DOCKER_PUBLISH_REGISTRY }}/${{ inputs.DOCKER_PUBLISH_IMAGE_NAME }}:${TAG_NAME};


      - name: Tag Image with GIT commit '${{ inputs.DOCKER_TAG_IMAGE_TAG_SOURCE }}'
        if: inputs.DOCKER_TAG_IMAGE_TAG_SHA
        run: |
          docker buildx imagetools create ${{ inputs.DOCKER_BUILD_REGISTRY }}/${{ inputs.DOCKER_BUILD_IMAGE_NAME }}:${{ inputs.DOCKER_TAG_IMAGE_TAG_SOURCE }} \
            --tag ${{ inputs.DOCKER_PUBLISH_REGISTRY }}/${{ inputs.DOCKER_PUBLISH_IMAGE_NAME }}:${{ inputs.DOCKER_TAG_IMAGE_TAG_SOURCE }} \


      - name: Fetch image ${{ inputs.DOCKER_TAG_IMAGE_TAG_SOURCE }}
        if: github.ref_type == 'tag'
        run: |
          docker pull ${{ inputs.DOCKER_PUBLISH_REGISTRY }}/${{ inputs.DOCKER_PUBLISH_IMAGE_NAME }}:${{ inputs.DOCKER_TAG_IMAGE_TAG_SOURCE }} >> /dev/null;


      - name: Fetch image ${{ inputs.DOCKER_TAG_IMAGE_TAG_SOURCE }}
        if: github.ref_type != 'tag'
        run: |
          docker pull ${{ inputs.DOCKER_PUBLISH_REGISTRY }}/${{ inputs.DOCKER_PUBLISH_IMAGE_NAME }}:${{ steps.tag-image.outputs.mutable_tag_name }} >> /dev/null;


      - name: Fetch Manifest digest ${{ github.ref_name }}
        id: image-digest
        run: |
          if [ "${{ github.ref_type}}" == 'tag'  ]; then

            MANIFEST_TAG=${{ inputs.DOCKER_TAG_IMAGE_TAG_SOURCE }};
          
          else

            MANIFEST_TAG=${{ steps.tag-image.outputs.mutable_tag_name }};

          fi;

          echo "[Debug] MANIFEST_TAG=${MANIFEST_TAG}";

          echo "value-out=$(docker inspect --format='{{index .RepoDigests 0}}' ${{ inputs.DOCKER_PUBLISH_REGISTRY }}/${{ inputs.DOCKER_PUBLISH_IMAGE_NAME }}:${MANIFEST_TAG} | cut -d '@' -f 2)" >> $GITHUB_OUTPUT


      # - name: Attest ${{ github.ref_name }}
      #   uses: actions/attest-build-provenance@v1.4.3
      #   id: image-attest
      #   with:
      #     subject-name: ${{ inputs.DOCKER_PUBLISH_REGISTRY }}/${{ inputs.DOCKER_PUBLISH_IMAGE_NAME }}
      #     subject-digest: ${{ steps.image-digest.outputs.value-out }}
      #     push-to-registry: true


      - name: Attest build provenance
        id: image-attest
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6    # v4.2.2
        with:
          subject-name: ${{ inputs.DOCKER_PUBLISH_REGISTRY }}/${{ inputs.DOCKER_PUBLISH_IMAGE_NAME }}
          subject-digest: ${{ steps.image-digest.outputs.value-out }}
          push-to-registry: true


      - name: Upload Image Attestation Artifact ${{ github.ref_name }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a    # v7.0.1
        with:
          name: ${{ inputs.DOCKER_PUBLISH_REGISTRY }}-attestation-image-published
          path: ${{ steps.image-attest.outputs.bundle-path }}


      - name: Download SBOM as a Github artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c    # V8.0.1
        with:
          name: trivy-sbom-report



      - name: Attest SBOM
        id: sbom-attest
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6    # v4.2.2
        with:
          subject-name: ${{ inputs.DOCKER_PUBLISH_REGISTRY }}/${{ inputs.DOCKER_PUBLISH_IMAGE_NAME }}
          subject-digest: ${{ needs.docker-build.outputs.build-image-digest }}
          sbom-path: 'dependency-results.sbom.json'
          push-to-registry: true

      # - name: Generate SBOM Attestation (publish)
      #   id: sbom-attest
      #   uses: actions/attest-sbom@v1.4.1
      #   with:
      #     subject-name: '${{ inputs.DOCKER_PUBLISH_REGISTRY }}/${{ inputs.DOCKER_PUBLISH_IMAGE_NAME }}'
      #     subject-digest: ${{ needs.docker-build.outputs.build-image-digest }}
      #     sbom-path: 'dependency-results.sbom.json'
      #     push-to-registry: true


      - name: Upload SBOM Attestation Artifact (publish)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a    # v7.0.1
        with:
          name: ${{ inputs.DOCKER_PUBLISH_REGISTRY }}-attestation-image-sbom-published
          path: ${{ steps.sbom-attest.outputs.bundle-path }}


      - name: Append GH Release Body
        if: ${{ github.ref_type == 'tag' }}
        id: release
        uses: softprops/action-gh-release@v2
        with:
          append_body: true
          draft: true
          body: |
            ### Images part of this release

            The following images were built and published:

            - `docker pull ${{ inputs.DOCKER_PUBLISH_REGISTRY }}/${{ inputs.DOCKER_PUBLISH_IMAGE_NAME }}:${{ steps.tag-image.outputs.mutable_tag_name }}`
            - `docker pull ${{ inputs.DOCKER_PUBLISH_REGISTRY }}/${{ inputs.DOCKER_PUBLISH_IMAGE_NAME }}:${{ inputs.DOCKER_TAG_IMAGE_TAG_SOURCE }}`
            - `docker pull ${{ inputs.DOCKER_PUBLISH_REGISTRY }}/${{ inputs.DOCKER_PUBLISH_IMAGE_NAME }}:${{ github.ref_name }}`



  docker-release-files:
    if: github.ref_type == 'tag'
    needs: 
      - docker-build
      - docker-sbom
      - docker-tagged
      - docker-publish
    runs-on: ubuntu-latest
    name: Release Files
    steps:


      - name: Fetch Image Attestation Artifact - ${{ inputs.DOCKER_PUBLISH_REGISTRY }}
        if: inputs.DOCKER_PUBLISH_REGISTRY != inputs.DOCKER_BUILD_REGISTRY
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c    # V8.0.1
        with:
          name: ${{ inputs.DOCKER_PUBLISH_REGISTRY }}-attestation-image-published
          path: attestation-image/


      - 
        if: inputs.DOCKER_PUBLISH_REGISTRY != inputs.DOCKER_BUILD_REGISTRY
        run: |
          mv attestation-image/attestation.json ${{ inputs.DOCKER_PUBLISH_REGISTRY }}-attestation-image.json


      - name: Fetch SBOM Attestation Artifact - ${{ inputs.DOCKER_PUBLISH_REGISTRY }}
        if: inputs.DOCKER_PUBLISH_REGISTRY != inputs.DOCKER_BUILD_REGISTRY
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c    # V8.0.1
        with:
          name: ${{ inputs.DOCKER_PUBLISH_REGISTRY }}-attestation-image-sbom-published
          path: attestation-sbom/


      - if: inputs.DOCKER_PUBLISH_REGISTRY != inputs.DOCKER_BUILD_REGISTRY
        run: |
          mv attestation-sbom/attestation.json ${{ inputs.DOCKER_PUBLISH_REGISTRY }}-attestation-sbom.json


      - if: inputs.DOCKER_PUBLISH_REGISTRY != inputs.DOCKER_BUILD_REGISTRY
        run: |
          ls -la;


      - name: Create Draft GH Release
        if: github.ref_type == 'tag'
        uses: softprops/action-gh-release@v2
        with:
          name: ${{ github.ref_name }}
          tag_name: ${{ github.ref_name }}
          draft: true
          files: |
            ${{ inputs.DOCKER_PUBLISH_REGISTRY }}-attestation-image.json
            ${{ inputs.DOCKER_PUBLISH_REGISTRY }}-attestation-sbom.json


      # - name: Fetch Image Attestation Artifact - ${{ inputs.DOCKER_BUILD_REGISTRY }}
      #   uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c    # V8.0.1
      #   with:
      #     name: ${{ inputs.DOCKER_BUILD_REGISTRY }}-attestation-image
      #     path: ${{ inputs.DOCKER_BUILD_REGISTRY }}-attestation-image/


      # - run: |
      #     mv ${{ inputs.DOCKER_BUILD_REGISTRY }}-attestation-image/attestation.json ${{ inputs.DOCKER_BUILD_REGISTRY }}-attestation-image.json


      # - name: Fetch SBOM Attestation Artifact - ${{ inputs.DOCKER_BUILD_REGISTRY }}
      #   uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c    # V8.0.1
      #   with:
      #     name: ${{ inputs.DOCKER_BUILD_REGISTRY }}-attestation-image-sbom
      #     path: ${{ inputs.DOCKER_BUILD_REGISTRY }}-attestation-sbom/


      # - run: |
      #     mv ${{ inputs.DOCKER_BUILD_REGISTRY }}-attestation-sbom/attestation.json ${{ inputs.DOCKER_BUILD_REGISTRY }}-attestation-sbom.json


      - run: |
          ls -la;


      - name: Create Draft GH Release
        if: github.ref_type == 'tag'
        uses: softprops/action-gh-release@v2
        with:
          name: ${{ github.ref_name }}
          tag_name: ${{ github.ref_name }}
          draft: true
          files: |
            ${{ inputs.DOCKER_BUILD_REGISTRY }}-attestation-image.json
            ${{ inputs.DOCKER_BUILD_REGISTRY }}-attestation-sbom.json



  docker-release:
    if: github.ref_type == 'tag'
    needs:
      - docker-release-files
    name: Mark Release Live
    runs-on: ubuntu-latest
    steps:


      - name: Publish Release
        uses: grzegorzkrukowski/action-publish-github-release@v1
        with:
          tag_name: ${{ github.ref_name }}
          token: ${{  secrets.GITHUB_TOKEN }}