build.yaml

name: Branch を Push したらイメージをビルドする

on:
  push:
    branches:
      - '*'         # matches every branch that doesn't contain a '/'
      - '*/*'       # matches every branch containing a single '/'
      - '**'        # matches every branch
      - '!main'     # excludes main

env:
  IMAGE_NAME: my-ubuntu:dev

jobs:
  build-test-image:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      attestations: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Check Dockerfile 
        run: |
          docker run --rm -i hadolint/hadolint < Dockerfile

      - name: Build a image
        id: push
        uses: docker/build-push-action@v5
        with:
          context: .
          push: false
          tags: ${{ env.IMAGE_NAME }}
          labels: ${{ env.IMAGE_NAME }}

      - name: Check vulnerabilities 
        run: |
          docker images
          docker run -v /var/run/docker.sock:/var/run/docker.sock --rm aquasec/trivy image --no-progress ${{ env.IMAGE_NAME }}

      - name: Test a container from the image
        run: |
          docker images
          docker run -i --name test ${{ env.IMAGE_NAME }} apt list --installed
          docker ps -a