docker.yml

name: Docker Build & Scan

on:
  pull_request:
    branches: [main, development]

permissions:
  contents: read

jobs:
  docker:
    name: Build & Scan
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build image (no push)
        uses: docker/build-push-action@v7
        with:
          context: .
          push: false
          load: true
          tags: tracker-tracker:ci
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Smoke test
        run: |
          set -euo pipefail

          docker network create smoke-net

          docker run -d --name smoke-db --network smoke-net \
            -e POSTGRES_USER=test \
            -e POSTGRES_PASSWORD=test \
            -e POSTGRES_DB=test \
            postgres:18-alpine

          sleep 10

          docker run -d --name smoke --network smoke-net -p 3000:3000 \
            -e DATABASE_URL="postgresql://test:test@smoke-db:5432/test" \
            -e NODE_ENV=production \
            -e SESSION_SECRET="ci-smoke-test-secret-that-is-at-least-32-characters-long" \
            tracker-tracker:ci

          sleep 5

          STATUS=$(docker inspect -f '{{.State.Status}}' smoke 2>/dev/null || echo "missing")
          if [ "$STATUS" != "running" ]; then
            echo "::error::Container exited unexpectedly"
            docker logs smoke || true
            docker stop smoke-db >/dev/null 2>&1 || true
            docker rm smoke-db >/dev/null 2>&1 || true
            docker network rm smoke-net >/dev/null 2>&1 || true
            exit 1
          fi

          echo "Smoke test passed — container is running."

          docker stop smoke smoke-db
          docker rm smoke smoke-db
          docker network rm smoke-net

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@0.35.0
        with:
          image-ref: tracker-tracker:ci
          format: table
          exit-code: "1"
          severity: CRITICAL,HIGH
          ignore-unfixed: true
          trivyignores: .trivyignore