name: MobilityOps release evidence

on:
  push:
    tags: ["v*"]

jobs:
  release-evidence:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - name: Build commit-labelled release images
        run: |
          docker build --target runtime --build-arg VCS_REF="$GITHUB_SHA" --tag mobilityops-api-release --file backend/Dockerfile .
          docker build --build-arg VCS_REF="$GITHUB_SHA" --tag mobilityops-web-release frontend
          docker build --build-arg VCS_REF="$GITHUB_SHA" --tag mobilityops-backup-tools-release --file deploy/unraid/Dockerfile.backup-tools .
      - name: Scan all release images
        run: |
          for image in mobilityops-api-release mobilityops-web-release mobilityops-backup-tools-release; do
            docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
              -v mobilityops-release-trivy:/root/.cache/ \
              aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969 \
              image --scanners vuln --severity HIGH,CRITICAL \
              --ignore-unfixed --exit-code 1 "$image"
          done
      - name: Generate API CycloneDX SBOM
        uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5 # v0.30.0
        with:
          scan-type: image
          image-ref: mobilityops-api-release
          format: cyclonedx
          output: mobilityops-api-sbom.cdx.json
      - name: Generate web CycloneDX SBOM
        uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5 # v0.30.0
        with:
          scan-type: image
          image-ref: mobilityops-web-release
          format: cyclonedx
          output: mobilityops-web-sbom.cdx.json
      - name: Generate backup-tools CycloneDX SBOM
        uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5 # v0.30.0
        with:
          scan-type: image
          image-ref: mobilityops-backup-tools-release
          format: cyclonedx
          output: mobilityops-backup-tools-sbom.cdx.json
      - name: Record immutable image metadata
        run: |
          docker image inspect mobilityops-api-release > mobilityops-api-image.json
          docker image inspect mobilityops-web-release > mobilityops-web-image.json
          docker image inspect mobilityops-backup-tools-release > mobilityops-backup-tools-image.json
          python scripts/generate-release-provenance.py
          sha256sum mobilityops-*-sbom.cdx.json mobilityops-*-image.json release-provenance.json > SHA256SUMS
      - name: Upload release evidence
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: mobilityops-${{ github.ref_name }}-evidence
          path: |
            mobilityops-*-sbom.cdx.json
            mobilityops-*-image.json
            release-provenance.json
            SHA256SUMS