docker-build-and-scan.yaml

name: Docker Build and Trivy Scan

on:
  workflow_call:
    inputs:
      DOCKER_PATH_CONTEXT:
        required: true
        type: string
      DOCKER_BUILD_DOCKERFILE:
        required: true
        type: string
      DOCKER_TAGS:
        required: true
        type: string
      DOCKER_USERNAME:
        required: true
        type: string

jobs:
  build-and-scan:
    runs-on: ubuntu-latest
    env:
      DOCKER_PATH_CONTEXT: ${{ inputs.DOCKER_PATH_CONTEXT }}
      DOCKER_BUILD_DOCKERFILE: ${{ inputs.DOCKER_BUILD_DOCKERFILE }}
      DOCKER_TAGS: ${{ inputs.DOCKER_TAGS }}
      DOCKER_USERNAME: ${{ inputs.DOCKER_USERNAME }}
    steps:
      - uses: actions/checkout@v6
      - uses: docker/setup-qemu-action@v4
      - uses: docker/setup-buildx-action@v4
      - uses: docker/login-action@v4
        with:
          username: ${{ env.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Build & push multi-arch image
        uses: docker/build-push-action@v7
        with:
          context: ${{ env.DOCKER_PATH_CONTEXT }}
          file: ${{ env.DOCKER_BUILD_DOCKERFILE }}
          platforms: linux/amd64,linux/arm64
          push: true
          tags: docker.io/${{ env.DOCKER_TAGS }}
      - name: Run Trivy vulnerability scanner (multi-arch manifest)
        uses: aquasecurity/trivy-action@0.35.0
        with:
          image-ref: docker.io/${{ env.DOCKER_TAGS }}
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'