build-and-test.yml

name: Build and Test Docker Image

on:
  push:
    branches-ignore:
      - latest

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Run Development Pipeline
        run: make dev-pipeline
        working-directory: .

      - name: Cache Trivy DB
        uses: actions/cache@v4
        with:
          path: ~/.cache/trivy
          key: ${{ runner.os }}-trivy-db-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-trivy-db-

      - name: Install Trivy
        run: |
          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sudo sh -s -- -b /usr/local/bin

      - name: Trivy Scanning
        run: |
          export TRIVY_DISABLE_VEX_NOTICE=true
          
          # Disable exit on error for the retry logic
          set +e
          
          # Retry logic for Trivy
          max_retries=5
          attempt=1
          success=false
      
          while [ $attempt -le $max_retries ]; do
            echo "Running Trivy scan, attempt $attempt..."
            
            # Run the Trivy scan and capture the exit status
            trivy image --severity CRITICAL --exit-code 1 --quiet udx-worker/udx-worker:latest | tee trivy.log | grep -v 'INFO'
            scan_exit_code=$?
            
            # Check for CRITICAL vulnerabilities
            if grep -E "Total: [1-9]" trivy.log; then
              echo "CRITICAL vulnerabilities detected!"
              exit 1
            fi
            
            # Check if Trivy exited with an error
            if [ $scan_exit_code -eq 0 ]; then
              echo "No CRITICAL vulnerabilities found."
              success=true
              break
            else
              echo "Trivy scan failed, retrying in 2 minutes..."
              sleep 120
              attempt=$((attempt+1))
            fi
          done
      
          # If all retries fail, exit with an error
          if [ "$success" = false ]; then
            echo "Failed to complete Trivy scan after $max_retries attempts."
            exit 1
          fi