rpc-proxy-docker.yml

name: RPC Proxy - Docker build, scan and push

on:
   workflow_call:

env:
  DOCKERFILE_LOCATION: "docker/rpc-proxy/Dockerfile"
  DOCKER_IMAGE_NAME: "vechain/sdk-rpc-proxy"
  DOCKER_IMAGE_VERSION: "v1.0.0"

permissions:
  contents: read
  packages: write
  checks: write
  actions: read


jobs:
  docker:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up QEMU
        if: ${{ github.event_name != 'pull_request' }}
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        if: ${{ github.event_name != 'pull_request' }}
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        if: ${{ github.event_name != 'pull_request' }}
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and export to Docker
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ${{ env.DOCKERFILE_LOCATION }}
          load: true
          tags: "${{ env.DOCKER_IMAGE_NAME }}:${{env.DOCKER_IMAGE_VERSION}}"
          labels: |
            maintainer=vechain
            description="RPC Proxy for vechain Thor"
            build_timestamp=${{ github.event.after }}
            source=https://github.com/vechain/vechain-sdk-js
            commit_hash=${{ github.sha }}

      - name: Create .trivyignore file
        # "cross-spawn" is resolved as version 7.0.5 but Trivy keeps showing the error
        run: |
          echo "CVE-2024-21538" > .trivyignore
          echo "CVE-2024-13176" >> .trivyignore

      - name: Run Trivy Scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{env.DOCKER_IMAGE_NAME}}
          format: 'table'
          ignore-unfixed: true
          exit-code: '1'
          vuln-type: os,library
          severity: CRITICAL,HIGH,MEDIUM
          scanners: misconfig,vuln,secret
          trivyignores: .trivyignore
        env:
          # See https://github.com/aquasecurity/trivy/discussions/7538
          TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2

      - name: Build and push
        if: ${{ github.event_name != 'pull_request' }}
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ${{env.DOCKERFILE_LOCATION}}
          platforms: linux/amd64,linux/arm64
          push: true
          tags: "${{ env.DOCKER_IMAGE_NAME }}:${{env.DOCKER_IMAGE_VERSION}}"