Docker CI/CD with GitHub Actions

  - name: Build and load for testing
    uses: docker/build-push-action@v7
    with:
      context: .
      load: true
      tags: orders-service:test
      cache-from: type=gha

  - name: Smoke-test the image
    run: |
      docker run -d --name smoke -p 8080:8080 orders-service:test
      timeout 90 bash -c 'until curl -fsS http://localhost:8080/actuator/health/readiness; do sleep 2; done'
      docker rm -f smoke

  - name: Build and push
    uses: docker/build-push-action@v7
    with:
      context: .
      push: true
      tags: ${{ steps.meta.outputs.tags }}
      labels: ${{ steps.meta.outputs.labels }}
      cache-from: type=gha
      cache-to: type=gha,mode=max

  - uses: docker/setup-qemu-action@v4
  - uses: docker/setup-buildx-action@v4
  - uses: docker/build-push-action@v7
    with:
      context: .
      platforms: linux/amd64,linux/arm64
      push: true
      tags: ${{ steps.meta.outputs.tags }}

  # Build every target of docker-bake.hcl, using the metadata-action bake file for tags and labels
  - uses: docker/bake-action@v7
    with:
      files: |
        ./docker-bake.hcl
        cwd://${{ steps.meta.outputs.bake-file }}
      push: true

  # Fail the job on fixable critical or high CVEs in the image just built
  - uses: docker/scout-action@v1
    with:
      command: cves
      image: ${{ steps.meta.outputs.tags }}
      only-severities: critical,high
      only-fixed: true
      exit-code: true

  # Pin the Docker Engine or Compose version instead of the runner's preinstalled one
  - uses: docker/setup-docker-action@v5
    with:
      version: v29.8.1
  - uses: docker/setup-compose-action@v2
    with:
      version: v5.5.1

# .github/workflows/image.yml -- build, test and publish the service image to GHCR
name: image

on:
  push:
    branches: [main]
    tags: ["v*.*.*"]
  pull_request:

permissions:
  contents: read
  packages: write
  id-token: write          # keyless signing / attestation identity
  attestations: write

jobs:
  image:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7

      - uses: docker/setup-qemu-action@v4

      - uses: docker/setup-buildx-action@v4

      - name: Log in to GHCR
        if: github.event_name != 'pull_request'
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Image metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha

      - name: Build for testing
        uses: docker/build-push-action@v7
        with:
          context: .
          load: true
          tags: orders-service:test
          cache-from: type=gha

      - name: Smoke test
        run: |
          docker run -d --name smoke -p 8080:8080 orders-service:test
          timeout 90 bash -c 'until curl -fsS http://localhost:8080/actuator/health/readiness; do sleep 2; done'
          docker rm -f smoke

      - name: Build and push (multi-platform, SBOM and provenance)
        id: push
        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          annotations: ${{ steps.meta.outputs.annotations }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          sbom: true
          provenance: mode=max

# .github/workflows/deploy.yml (excerpt)
permissions:
  contents: read
  id-token: write          # OIDC to the cloud provider
  packages: write

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}          # approval gate and environment-scoped secrets
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-java@v6
        with:
          distribution: temurin
          java-version: '25'
          cache: maven

      - name: Resolve image tag
        id: meta
        run: echo "tag=${{ inputs.image_tag || github.sha }}" >> "$GITHUB_OUTPUT"

      - name: Configure AWS credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
          aws-region: ${{ vars.AWS_REGION }}

      - name: Build and push the image with Cloud Native Buildpacks
        run: |
          mvn -B -ntp -pl boot -am spring-boot:build-image -DskipTests \
            -Dspring-boot.build-image.imageName=${{ vars.IMAGE_REPOSITORY }}:${{ steps.meta.outputs.tag }} \
            -Dspring-boot.build-image.publish=true \
            -Ddocker.publishRegistry.username=${{ secrets.REGISTRY_USERNAME }} \
            -Ddocker.publishRegistry.password=${{ secrets.REGISTRY_PASSWORD }}