name: Docker Security Scan

env:
  DOCKER_IMAGE: katanemo/plano

on:
  push:
    branches:
      - main
  pull_request:

permissions:
  contents: read
  security-events: write

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4

      - name: Build Docker Image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64
          push: false
          tags: ${{ env.DOCKER_IMAGE }}:scan

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ env.DOCKER_IMAGE }}:scan
          format: table
          # Fail on PRs so vulnerabilities block merge; on main just report
          exit-code: ${{ github.event_name == 'pull_request' && '1' || '0' }}
          ignore-unfixed: true
          severity: CRITICAL,HIGH

      - name: Run Trivy scanner (SARIF for GitHub Security tab)
        if: always()
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ env.DOCKER_IMAGE }}:scan
          format: sarif
          output: trivy-results.sarif
          ignore-unfixed: true
          severity: CRITICAL,HIGH

      - name: Upload Trivy results to GitHub Security tab
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: trivy-results.sarif