name: MobilityOps security

on:
  schedule:
    - cron: "17 3 * * 1"
  workflow_dispatch:

concurrency:
  group: mobilityops-security
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  images:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          fetch-depth: 0
      - name: Build production images once
        run: |
          docker build --target runtime --build-arg VCS_REF="$GITHUB_SHA" \
            --tag mobilityops-api-ci --file backend/Dockerfile .
          docker build --build-arg VCS_REF="$GITHUB_SHA" \
            --tag mobilityops-web-ci frontend
      - name: Scan production images for fixed HIGH and CRITICAL vulnerabilities
        run: |
          for image in mobilityops-api-ci mobilityops-web-ci; do
            docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
              docker.io/aquasec/trivy@sha256:be1190afcb28352bfddc4ddeb71470835d16462af68d310f9f4bca710961a41e \
              image --severity HIGH,CRITICAL --exit-code 1 --ignore-unfixed --no-progress "$image"
          done
      - name: Scan repository secrets and misconfiguration
        uses: docker://docker.io/aquasec/trivy@sha256:be1190afcb28352bfddc4ddeb71470835d16462af68d310f9f4bca710961a41e
        with:
          args: fs --scanners misconfig,secret --exit-code 1 --no-progress .
      - name: Remove temporary image tags
        if: always()
        run: docker image rm mobilityops-api-ci mobilityops-web-ci || true