security-checks.yml

name: Security checks

on:
  workflow_call:
    secrets:
      MONDOO_SECRET:
        required: true

jobs:
  build-api:
    name: Build and scan api container image
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Build
        uses: docker/build-push-action@v5
        env:
          NODE_ENV: production
        with:
          push: false
          target: production
          tags: ghcr.io/podkrepi-bg/api:pr
      
      - name: Scan with Mondoo
        uses: mondoohq/actions/docker-image@main
        env:
          MONDOO_CONFIG_BASE64: ${{ secrets.MONDOO_SECRET }}
        with:
          image: ghcr.io/podkrepi-bg/api:pr

  build-maintenance:
    name: Build and scan migrations container image
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Build
        uses: docker/build-push-action@v5
        with:
          push: false
          file: Dockerfile.migrations
          target: base
          tags: ghcr.io/podkrepi-bg/api/migrations:pr

      - name: Scan with Mondoo
        uses: mondoohq/actions/docker-image@main
        env:
          MONDOO_CONFIG_BASE64: ${{ secrets.MONDOO_SECRET }}
        with:
          image: ghcr.io/podkrepi-bg/api/migrations:pr

  scan-manifests:
    name: Scan k8s manifests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install kustomize
        uses: imranismail/setup-kustomize@v2

      - name: Build development manifests
        run: kustomize build manifests/overlays/development > dev-manifests.yaml

      - name: Scan development manifests with Mondoo
        uses: mondoohq/actions/k8s-manifest@main
        env:
          MONDOO_CONFIG_BASE64: ${{ secrets.MONDOO_SECRET }}
        with:
          path: dev-manifests.yaml

      - name: Build production manifests
        run: kustomize build manifests/overlays/production > prod-manifests.yaml

      - name: Scan production manifests with Mondoo
        uses: mondoohq/actions/k8s-manifest@main
        env:
          MONDOO_CONFIG_BASE64: ${{ secrets.MONDOO_SECRET }}
        with:
          path: prod-manifests.yaml