build-only.yml

name: Build gwfh

on:
  push:
    branches: 
      - "**"
      - "!master"
      - "!dev"

env:
  DOCKER_ENV_FILE: ".github/workflows/docker.env"
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build-only:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4

      - name: Log in to the Container registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

      - name: Build only
        uses: docker/build-push-action@v6
        with:
          context: .
          push: false
          # load: true # add to local docker daemon so we can use it in the next step
          tags: |
            ${{ steps.meta.outputs.tags }}
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
          labels: ${{ steps.meta.outputs.labels }}
          platforms: linux/amd64,linux/arm64

      # - name: trivy scan
      #   uses: aquasecurity/trivy-action@master
      #   with:
      #     image-ref: '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}'
      #     format: 'template'
      #     template: '@/contrib/sarif.tpl'
      #     output: 'trivy-results.sarif'
      #     severity: 'CRITICAL,HIGH'
      #     ignore-unfixed: true