main.yml

name: Main

on:
  push:
    branches:
      - master

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v1
    - name: Set up QEMU
      uses: docker/setup-qemu-action@v1
    - name: Build
      env:
        REPO: ${{ github.repository }}
      shell: bash
      run: |
        echo "docker_repo=${{ env.REPO }}" >> $GITHUB_ENV
        make build && make build-arm64
    - name: Trivy vulnerability scanner
      uses: aquasecurity/trivy-action@0.0.20
      with:
        image-ref: '${{ env.docker_repo }}:latest'
        format: 'table'
        exit-code: '1'
        ignore-unfixed: true
        vuln-type: 'os,library'
        severity: 'CRITICAL,HIGH'
    - name: Trivy vulnerability scanner on arm64 image
      uses: aquasecurity/trivy-action@0.0.20
      with:
        image-ref: '${{ env.docker_repo }}:latest-arm64'
        format: 'table'
        exit-code: '1'
        ignore-unfixed: true
        vuln-type: 'os,library'
        severity: 'CRITICAL,HIGH'
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v1
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v1
      - name: Build
        shell: bash
        run: make build && make build-arm64
      - name: Test
        run: make test 
  publish:
    needs: [scan, test]
    if: github.repository == 'rust-serverless/lambda-rust'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v1
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v1
      - name: Build
        shell: bash
        run: make build && make build-arm64
      - name: Publish Latest
        shell: bash
        run: |
          echo "${{ secrets.DOCKER_PASSWORD }}" | docker login -u "${{ secrets.DOCKER_USERNAME }}" --password-stdin
          make publish && make publish-arm64