docker.yml

name: Build and check image
on:
  schedule:
    - cron: "30 5 * * 1-5"
  push:
    branches: ["master"]
    paths:
      - "docker/**"
      - ".github/workflows/**"
  pull_request:
    branches: ["master"]
    paths:
      - "docker/**"
      - ".github/workflows/**"

env:
  REGISTRY: ghcr.io
  LATEST_TAG: ghcr.io/rootshell-coder/ansible:latest
  VER_LOG: VERSIONS.txt
  TRIVY_SECURITY: SECURITY.txt

jobs:
  build:
    name: Publish to github registry
    runs-on: [ubuntu-24.04]
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: docker
          push: true
          platforms: linux/amd64,linux/arm64
          tags: |
            ${{ env.LATEST_TAG }}

  check:
    needs: [build]
    name: Pull image
    runs-on: [ubuntu-24.04]
    steps:
      - uses: actions/checkout@v4
      - name: Create report file
        run: |
          echo "BUILD TIME" > ${{ env.VER_LOG }}
          date +%s >> ${{ env.VER_LOG }}
          echo "---" >> ${{ env.VER_LOG }}
      - name: Check version
        run: |
          docker pull ${{ env.LATEST_TAG }}
          echo "- PYTHON3 VERSION"  >> ${{ env.VER_LOG }}
          docker run -i --rm  ${{ env.LATEST_TAG }} python3 --version >> ${{ env.VER_LOG }}

          echo "- ANSIBLE VERSION"  >> ${{ env.VER_LOG }}
          docker run -i --rm  ${{ env.LATEST_TAG }} ansible --version >> ${{ env.VER_LOG }}

          echo "- ANSIBLE LINT"  >> ${{ env.VER_LOG }}
          docker run -i --rm  ${{ env.LATEST_TAG }} ansible-lint --version >> ${{ env.VER_LOG }}

          echo "- ANSIBLE GALAXY"  >> ${{ env.VER_LOG }}
          docker run -i --rm  ${{ env.LATEST_TAG }} ansible-galaxy --version >> ${{ env.VER_LOG }}

          echo "- ANSIBLE VAULT"  >> ${{ env.VER_LOG }}
          docker run -i --rm  ${{ env.LATEST_TAG }} ansible-vault --version >> ${{ env.VER_LOG }}

          echo "- ANSIBLE COMMUNITY"  >> ${{ env.VER_LOG }}
          docker run -i --rm  ${{ env.LATEST_TAG }} ansible-community --version >> ${{ env.VER_LOG }}

          echo "- ANSIBLE-GALAXY COLLECTION"  >> ${{ env.VER_LOG }}
          docker run -i --rm  ${{ env.LATEST_TAG }} ansible-galaxy collection list >> ${{ env.VER_LOG }}

          echo "- ANSIBLE USER PERMISSIONS"  >> ${{ env.VER_LOG }}
          docker run -i --rm  ${{ env.LATEST_TAG }} id >> ${{ env.VER_LOG }}

          docker run --rm ghcr.io/rootshell-coder/trivy-cached:latest image ${{ env.LATEST_TAG }} --skip-db-update > ${{ env.TRIVY_SECURITY }}

      - name: Commit changes
        uses: EndBug/add-and-commit@v9
        with:
          author_name: RootShell-coder
          author_email: Root.Shelling@gmail.com
          message: "upd"
          add: "*.txt"