docker.yml

name: Docker

on:
  workflow_call:
    inputs:
      tag:
        required: true
        type: string
      platforms:
        required: true
        type: string
      assert:
        type: boolean
        default: false
      flow_name:
        required: true
        type: string
      trail_name:
        required: true
        type: string
      kosli_org:
        required: true
        type: string
    secrets:
      slack_channel:
        required: true
      slack_webhook:
        required: true
      kosli_api_token:
        required: true
      snyk_token:
        required: true         


env:
  IMAGE: ghcr.io/kosli-dev/cli
  # KOSLI_DRY_RUN: "True"
  # Ordinarily we declare KOSLI_ORG and KOSLI_FLOW here but
  # this interferes with the CLI integration tests


jobs:  
  docker:
    name: Docker Build
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: write
      attestations: write
      packages: write

    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 3

    - uses: actions/setup-go@v5
      with:
        go-version: '1.22.0'

    # Set up QEMU emulator to allow building multi-arch images
    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3

    # This is the a separate action that sets up buildx (buildkit) runner
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: setup-kosli-cli
      uses: kosli-dev/setup-cli-action@v2
      with:
        version:
          ${{ vars.KOSLI_CLI_VERSION }}
    
    - name: Login to GitHub Container Registry
      uses: docker/login-action@v3
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    # Push image to the GHCR 
    - name: Build and push Docker image
      id: docker_build
      uses: docker/build-push-action@v5
      with:
        context: .
        push: true
        tags: ${{ env.IMAGE }}:${{ inputs.tag }}
        platforms: ${{ inputs.platforms }}
        cache-from: type=registry,ref=${{ env.IMAGE }}:buildcache
        cache-to: type=registry,ref=${{ env.IMAGE }}:buildcache,mode=max


    - name: Make the image fingerprint available for following steps
      run: |
        ARTIFACT_SHA=$( echo ${{ steps.docker_build.outputs.digest }} | sed 's/.*://')
        echo "FINGERPRINT=$ARTIFACT_SHA" >> ${GITHUB_ENV}


    - name: Attest Build Provenance
      uses: actions/attest-build-provenance@v1
      with:
        subject-name: ${{ env.IMAGE }}
        subject-digest: ${{ steps.docker_build.outputs.digest }}
        push-to-registry: true

    - name: Generate SBOM for the docker image
      uses: anchore/sbom-action@v0
      with:
        image: ${{ env.IMAGE }}:${{ inputs.tag }}
        format: 'spdx-json'
        output-file: 'sbom.spdx.json'
        upload-artifact: false


    - name: Attest SBOM to Github
      uses: actions/attest-sbom@v1
      with:
        sbom-path: 'sbom.spdx.json'
        subject-name: ${{ env.IMAGE }}
        subject-digest: ${{ steps.docker_build.outputs.digest }}
        push-to-registry: true

    
    - name: setup Snyk
      uses: snyk/actions/setup@master


    - name: Report Docker image to Kosli
      if: ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') }}
      env:
        KOSLI_API_TOKEN: ${{ secrets.kosli_api_token }}
      run: 
        kosli attest artifact
           ${{ env.IMAGE }}:${{ inputs.tag }}
           --flow ${{ inputs.flow_name }} 
           --trail ${{ inputs.trail_name }} 
           --name cli-docker
           --fingerprint ${{ env.FINGERPRINT }}
           --external-url sigstore=https://search.sigstore.dev/?hash=${{ env.FINGERPRINT }}
           --org ${{ inputs.kosli_org }}

           
    - name: Report SBOM to Kosli
      if: ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') }}
      env:
        KOSLI_API_TOKEN: ${{ secrets.kosli_api_token }}
      run: 
        kosli attest generic
          --flow ${{ inputs.flow_name }}
          --trail ${{ inputs.trail_name }} 
          --name container-sbom
          --fingerprint ${{ env.FINGERPRINT }}
          --attachments  sbom.spdx.json
          --org ${{ inputs.kosli_org }}

    
    - name: Run Snyk to scan the Docker image for vulnerabilities
      env:
        SNYK_TOKEN: ${{ secrets.snyk_token }}
      run: 
          snyk container test ${{ env.IMAGE }}:${{ inputs.tag }} 
             --file=Dockerfile
             --sarif
             --policy-path=.snyk
             --sarif-file-output=snyk-docker.json


    - name: Report Snyk Docker scan results attestation to Kosli
      if:  ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') && (success() || failure()) }}
      env:
        KOSLI_API_TOKEN: ${{ secrets.kosli_api_token }}
      run: 
        kosli attest snyk 
            --flow ${{ inputs.flow_name }}
            --trail ${{ inputs.trail_name }} 
            --fingerprint ${{ env.FINGERPRINT }} 
            --name snyk-container
            --scan-results snyk-docker.json
            --org ${{ inputs.kosli_org }}


    - name: Smoke test the docker image to be sure it can connect to Kosli
      id: smoke-test
      env:
        KOSLI_ORG: cyber-dojo
        KOSLI_API_TOKEN: any-token-will-do
      run: 
        docker run -e KOSLI_API_TOKEN
          -e KOSLI_ORG --rm ${{ env.IMAGE }}:${{ inputs.tag }}
          list environments

    - name: Report Docker smoke test attestation to Kosli
      if:  ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') && (success() || failure()) }}
      env:
        KOSLI_API_TOKEN: ${{ secrets.kosli_api_token }}
        SMOKE_TEST_OUTCOME: ${{ steps.smoke-test.outcome}}
      run: 
        kosli attest generic 
            --flow ${{ inputs.flow_name }}
            --trail ${{ inputs.trail_name }} 
            --fingerprint ${{ env.FINGERPRINT }} 
            --name smoke-test
            --compliant=${{ steps.smoke-test.outcome == 'success' }} 
            --org ${{ inputs.kosli_org }}