name: MobilityOps release evidence

on:
  push:
    tags: ["v*"]

jobs:
  release-evidence:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - name: Build commit-labelled release images
        run: |
          docker build --target runtime --build-arg VCS_REF="$GITHUB_SHA" --tag mobilityops-api-release --file backend/Dockerfile .
          docker build --build-arg VCS_REF="$GITHUB_SHA" --tag mobilityops-web-release frontend
          docker build --build-arg VCS_REF="$GITHUB_SHA" --tag mobilityops-backup-tools-release --file deploy/unraid/Dockerfile.backup-tools .
      - name: Scan all release images
        run: |
          for image in mobilityops-api-release mobilityops-web-release mobilityops-backup-tools-release; do
            docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
              -v mobilityops-release-trivy:/root/.cache/ \
              aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969 \
              image --scanners vuln --severity HIGH,CRITICAL \
              --ignore-unfixed --exit-code 1 "$image"
          done
      - name: Generate CycloneDX SBOMs with the pinned scanner image
        run: |
          for component in api web backup-tools; do
            docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
              -v "$PWD:/work" -w /work \
              aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969 \
               image --format cyclonedx --output "mobilityops-${component}-sbom.cdx.json" \
               "mobilityops-${component}-release"
          done
      - name: Record immutable image metadata
        run: |
          docker image inspect mobilityops-api-release > mobilityops-api-image.json
          docker image inspect mobilityops-web-release > mobilityops-web-image.json
          docker image inspect mobilityops-backup-tools-release > mobilityops-backup-tools-image.json
          python scripts/generate-release-provenance.py
          sha256sum mobilityops-*-sbom.cdx.json mobilityops-*-image.json release-provenance.json > SHA256SUMS
      - name: Upload release evidence
        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3; Gitea-compatible artifact protocol
        with:
          name: mobilityops-${{ github.ref_name }}-evidence
          path: |
            mobilityops-*-sbom.cdx.json
            mobilityops-*-image.json
            release-provenance.json
            SHA256SUMS