build.yml

name: Build

on:
  push:
    tags:
      - 'v*'
  pull_request:
    branches: [ main ]

permissions:
  contents: write
  packages: write
  security-events: write

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v2
      with:
        fetch-depth: 0

    - uses: actions/setup-go@v2
      with:
        go-version: '1.17'

    - name: go Version
      run: go version

    - name: Docker Version
      run: docker version

    - name: Set up QEMU
      uses: docker/setup-qemu-action@v2

    - name: Set up Docker Buildx
      id: buildx
      uses: docker/setup-buildx-action@v2

# Standard Build
    - name: Build
      uses: goreleaser/goreleaser-action@v2
      if: startsWith(github.ref, 'refs/tags/') == false
      with:
        distribution: goreleaser
        version: latest
        args: release --rm-dist --snapshot
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        DOCKER_BUILDKIT: 1 
        COMPOSE_DOCKER_CLI_BUILD: 1
      
    - name: 'Get Previous tag'
      id: previoustag
      uses: "WyriHaximus/github-action-get-previous-tag@v1"

    - name: Run Trivy vulnerability scanner
      uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe
      with:
        image-ref: 'ghcr.io/jackdallas/premiumizearr:${{ steps.previoustag.outputs.tag }}-amd64'
        format: 'template'
        template: '@/contrib/sarif.tpl'
        output: 'trivy-results.sarif'
        severity: 'CRITICAL,HIGH'

    - name: Upload Trivy scan results to GitHub Security tab
      uses: github/codeql-action/upload-sarif@v2
      with:
        sarif_file: 'trivy-results.sarif'
  
    # Release build
    - uses: docker/login-action@v1
      if: startsWith(github.ref, 'refs/tags/')
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Release
      uses: goreleaser/goreleaser-action@v2
      if: startsWith(github.ref, 'refs/tags/') && !contains(github.ref, '-rc')
      with:
        distribution: goreleaser
        version: latest
        args: release --rm-dist
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        DOCKER_BUILDKIT: 1 
        COMPOSE_DOCKER_CLI_BUILD: 1

# Pre-Release build
    - name: Pre-Release
      uses: goreleaser/goreleaser-action@v2
      if: startsWith(github.ref, 'refs/tags/') && contains(github.ref, '-rc')
      with:
        distribution: goreleaser
        version: latest
        args: release --rm-dist -f .prerelease.goreleaser.yaml
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        DOCKER_BUILDKIT: 1 
        COMPOSE_DOCKER_CLI_BUILD: 1

    - name: Upload assets
      uses: actions/upload-artifact@v2
      with:
        name: artifacts
        path: dist/