name: "make"
on:
  push:
    branches:
      - "main"
    tags:
      - "v*"
  pull_request:
    branches:
      - "main"

jobs:
  docker-build:
    name: "docker-build"
    runs-on: "ubuntu-24.04"
    permissions:
      contents: "read"
      packages: "write"
    env:
      DOCKER_BUILD_FLAGS: "--push"
      DOCKER_TAG_NAME: ${{ startsWith(github.ref, 'refs/tags/') && github.ref_name || 'latest' }}
    steps:
      - uses: "actions/checkout@v4"
      - uses: "docker/setup-qemu-action@v2"
      - uses: "docker/setup-buildx-action@v2"
      - uses: "docker/login-action@v2"
        with:
          registry: "ghcr.io"
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - run: "make docker-build"
  
  trivy-scan:
    name: "trivy-scan"
    needs: 
      - "docker-build"
    runs-on: "ubuntu-22.04"
    permissions:
      contents: "read"
      packages: "read"
    env:
      DOCKER_TAG_NAME: ${{ startsWith(github.ref, 'refs/tags/') && github.ref_name || 'latest' }}
      TRIVY_DISABLE_VEX_NOTICE: true
    steps:
      - uses: "aquasecurity/trivy-action@0.28.0"
        with:
          image-ref: 'ghcr.io/getprobo/probo:${{ env.DOCKER_TAG_NAME }}'
          format: "table"
          exit-code: 1
          ignore-unfixed: true
          vuln-type: "os,library"
          severity: "CRITICAL,HIGH"

  build:
    name: "build"
    runs-on: "ubuntu-22.04"
    permissions:
      contents: "read"
    steps:
      - uses: "actions/checkout@v4"
      - uses: "actions/setup-go@v5"
      - uses: "actions/setup-node@v4"
        with:
          node-version: 22
      - run: "npm ci"
      - run: "make build"