docker-security.yaml

name: Docker Security
on:
  workflow_call:
    inputs:
      PROJECT:
        type: string
        required: true

jobs:
  docker-security:
    runs-on: ubuntu-22.04
    steps:
      - name: download a build artifact
        uses: actions/download-artifact@v6.0.0
        id: download
        with:
          name: artifacts_image_${{inputs.PROJECT}}

      - name: docker load
        run: docker image load --input image_${{inputs.PROJECT}}.tar

      - name: get the image id
        id: get_image_id
        run: echo "id=$(docker images --format "{{.Repository}}:{{.Tag}}"| grep ${{inputs.PROJECT}} | awk 'NR==1{print $1}')" >> $GITHUB_OUTPUT

      - uses: anchore/sbom-action@v0
        with:
          image: ${{ steps.get_image_id.outputs.id }}
          artifact-name: sbom_${{inputs.PROJECT}}.spdx.json

      - name: docker scan
        id: scan
        uses: anchore/scan-action@v6.5.1
        continue-on-error: true
        with:
          sbom: sbom_${{inputs.PROJECT}}.spdx.json
          output-format: sarif

      - name: upload sarif report
        uses: github/codeql-action/upload-sarif@v3
        continue-on-error: true
        with:
          sarif_file: ${{ steps.scan.outputs.sarif }}