anchore-workflow.yml

name: SEC - Container Scan - Anchore Container Image Scan

on:
  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

jobs:
  anchore_web:
    name: Anchore Web Container Image Scan
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v2
    
    - name: Build the Web container image
      working-directory: ./Application-Source-Code
      run: docker build . --tag localbuild/webimage:latest --file src/Web/Dockerfile
    
    - name: Scan Web container image
      uses: anchore/scan-action@v3
      id: anchoreScan
      with:
        image: "localbuild/webimage:latest"
        fail-build: true
        severity-cutoff: high

    - name: Upload Anchore Web scan SARIF report
      uses: github/codeql-action/upload-sarif@v2
      if: ${{ success() || failure() }}
      with:
        sarif_file: ${{ steps.anchoreScan.outputs.sarif }}
  
  anchore_api:
    name: Anchore API Container Image Scan
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v2
    
    - name: Build the API container image
      working-directory: ./Application-Source-Code
      run: docker build . --tag localbuild/apiimage:latest --file src/PublicApi/Dockerfile
    
    - name: Scan API container image
      uses: anchore/scan-action@v3
      id: anchoreScan
      with:
        image: "localbuild/apiimage:latest"
        fail-build: true
        severity-cutoff: high

    - name: Upload Anchore API scan SARIF report
      uses: github/codeql-action/upload-sarif@v2
      if: ${{ success() || failure() }}
      with:
        sarif_file: ${{ steps.anchoreScan.outputs.sarif }}