name: 'Scan Backend Image'
run-name: '${{ inputs.repo_path }} → trivy [${{ inputs.branch }}]'
on:
  workflow_dispatch:
    inputs:
      repo_path:
        description: 'Репозиторий'
        required: true
        type: choice
        options:
          - devspace-apiregistry-core-service
          - devspace-apiregistry-generator-service
          - devspace-gateway
          - devspace-api
        default: devspace-apiregistry-core-service
      branch:
        description: 'Ветка'
        required: true
        type: string
        default: master
jobs:
  scan:
    name: 'Trivy scan'
    runs-on: ubuntu-latest
    steps:
      - name: 'Print Info'
        run: |
          echo "Repository: ${{ github.event.inputs.repo_path }}"
          echo "Branch: ${{ github.event.inputs.branch }}"
      - name: Cloning
        uses: https://git.binom.pw/otp/devops/clone@main
        with:
          ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
          repository: "devspc/${{ github.event.inputs.repo_path }}"
          branch: ${{ github.event.inputs.branch }}
      - uses: https://git.binom.pw/otp/devops/config-gradle@main
      - uses: https://git.binom.pw/otp/devops/setup-gradle@main
      - name: Setup Jvm
        uses: actions/setup-java@v4
        with:
          java-version: 21
          distribution: "adopt"
      - name: Building
        run: |
          ./gradlew bootJar --no-daemon -x cyclonedxBom
          echo 'Jar in libs folder'
          ls ./build/libs
      - name: Build Docker Image
        uses: https://git.binom.pw/otp/devops/docker@main
        with:
          image-name: "otp/devspc/${{ github.event.inputs.repo_path }}"
          tags: scan
          push: false
          nexus-username: ${{ secrets.NEXUS_USERNAME }}
          nexus-password: ${{ secrets.NEXUS_PASSWORD }}
      - name: Export Image to tar
        run: |
          rm -f /tmp/image.tar
          buildah push "otp/devspc/${{ github.event.inputs.repo_path }}:scan" docker-archive:/tmp/image.tar
          ls -lh /tmp/image.tar
      - name: Install Trivy
        run: |
          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
          trivy --version
      - name: Scan Image
        run: |
          trivy image --input /tmp/image.tar \
            --scanners vuln,secret,misconfig \
            --format table
      - name: 'Cleanup'
        if: always()
        shell: bash
        run: |
          echo 'Cleaning...'
          rm -f /tmp/image.tar
          rm -rf ~/.gradle/init.gradle.kts
          rm -rf ~/.ssh/config
          rm -rf ~/.ssh/my_key