cron.yml

---
name: Trivy Java DB
on:
  schedule:
    - cron: "0 0 * * *" # update indexes every day in 00:00
  workflow_dispatch:
env:
  GH_USER: aqua-bot
  DB_VERSION: 1
permissions:
  packages: write # for GHCR
  contents: read
jobs:
  build:
    name: Build DB
    runs-on: ubuntu-latest
    steps:
      - name: Check out code into the Go module directory
        uses: actions/checkout@v2

      - name: Set up Go
        uses: actions/setup-go@v3
        with:
          go-version-file: go.mod
        id: go

      - name: Build the binary
        run: make build

      - name: Crawl indexes
        run: make db-crawl

      - name: Build database
        run: make db-build

      - name: Compress database
        run: make db-compress

      - name: Move DB
        run: mv cache/db/javadb.tar.gz .

      - name: Login to GitHub Packages Container registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ env.GH_USER }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Login to ECR
        uses: docker/login-action@v3
        with:
          registry: public.ecr.aws
          username: ${{ secrets.ECR_ACCESS_KEY_ID }}
          password: ${{ secrets.ECR_SECRET_ACCESS_KEY }}

      - name: Upload assets to GHCR and ECR Public
        run: |
          lowercase_repo=$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')
          oras version
          
          # Define an array of registry base URLs
          registries=(
            "ghcr.io"
            "public.ecr.aws"
          )

          # Loop through each registry and push the artifact
          for registry in "${registries[@]}"; do
            full_registry_url="${registry}/${lowercase_repo}"
            oras push --artifact-type application/vnd.aquasec.trivy.config.v1+json \
            "${full_registry_url}:${DB_VERSION}" \
            javadb.tar.gz:application/vnd.aquasec.trivy.javadb.layer.v1.tar+gzip
          
            echo "Pushed to ${full_registry_url}"
          done

      - name: Microsoft Teams Notification
        ## Until the PR with the fix for the AdaptivCard version is merged yet
        ## /~https://github.com/Skitionek/notify-microsoft-teams/pull/96
        ## Use the aquasecurity fork
        uses: aquasecurity/notify-microsoft-teams@master
        if: failure()
        with:
          webhook_url: ${{ secrets.TRIVY_MSTEAMS_WEBHOOK }}
          needs: ${{ toJson(needs) }}
          job: ${{ toJson(job) }}
          steps: ${{ toJson(steps) }}