Build, test and publish container images

test → build (Buildx, cached) → push (tags from Git) → scan → record digest → PR to GitOps repo

# .github/workflows/image.yml
name: image
on:
  push:
    branches: [main]
    tags: ["v*.*.*"]
  pull_request:

permissions:
  contents: read
  packages: write          # push to GHCR

jobs:
  image:
    runs-on: ubuntu-latest
    outputs:
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - uses: actions/checkout@v4

      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        if: github.event_name != 'pull_request'
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository_owner }}/orders-api
          tags: |
            type=sha,format=long
            type=semver,pattern={{version}}
            type=ref,event=pr

      - id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          push: ${{ github.event_name != 'pull_request' }}   # PRs build but don't push
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - uses: aquasecurity/trivy-action@0.28.0    # pin a version you tested
        if: github.event_name != 'pull_request'
        with:
          image-ref: ghcr.io/${{ github.repository_owner }}/orders-api@${{ steps.build.outputs.digest }}
          severity: CRITICAL,HIGH
          exit-code: "1"
          ignore-unfixed: true

  promote-dev:
    needs: image
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          repository: acme/gitops-config
          token: ${{ secrets.GITOPS_REPO_TOKEN }}   # or a GitHub App token; scoped to that repo only
      - run: |
          yq -i '.image.digest = "${{ needs.image.outputs.digest }}"' apps/orders-api/envs/dev/values.yaml
      - uses: peter-evans/create-pull-request@v7
        with:
          branch: promote/orders-api-dev-${{ github.sha }}
          title: "orders-api: promote ${{ github.sha }} to dev"
          body: "Built by ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"