name: ci
on: [push]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: environment
        run: |
          echo "arch: $(uname -m)"

      - name: run tests
        run: |
          python3 -c "assert 2 + 2 == 4; print('test passed')"

      - name: build image
        run: |
          cat > Dockerfile <<'DOCKER'
          FROM alpine:latest
          RUN echo "built on $(uname -m)" > /where
          CMD cat /where
          DOCKER
          docker build -t ci-demo:${GITHUB_SHA::7} .

      - name: scan image for vulnerabilities
        run: |
          # trivy is on the host; the runner shares the host docker socket,
          # so it can see the image we just built
          docker run --rm \
            -v /var/run/docker.sock:/var/run/docker.sock \
            aquasec/trivy:latest image \
            --quiet --scanners vuln --severity HIGH,CRITICAL \
            --exit-code 1 \
            ci-demo:${GITHUB_SHA::7}
          echo "no HIGH or CRITICAL vulnerabilities - image approved"

      - name: run it
        run: docker run --rm ci-demo:${GITHUB_SHA::7}