docker-build-scan.yaml

name: Docker Build Scan
on:
  pull_request:
    branches:
      - 'master'
      - 'celo*'
  workflow_dispatch:

jobs:
  detect-files-changed:
    runs-on: ubuntu-latest
    outputs:
      files-changed: ${{ steps.detect-files-changed.outputs.all_changed_files }}
    steps:
      - uses: actions/checkout@v4
      - name: Detect files changed
        id: detect-files-changed
        uses: tj-actions/changed-files@v44
        with:
          separator: ','

  build-cel2-migration-tool:
    runs-on: ubuntu-latest
    needs: detect-files-changed
    if: |
      contains(needs.detect-files-changed.outputs.files-changed, 'op-chain-ops/cmd/celo-migrate') ||
      contains(needs.detect-files-changed.outputs.files-changed, 'op-chain-ops/Dockerfile')
    permissions:
      contents: read
      id-token: write
      security-events: write
    steps:
      - uses: actions/checkout@v4
      - name: Login at GCP Artifact Registry
        uses: celo-org/reusable-workflows/.github/actions/auth-gcp-artifact-registry@v2.0
        with:
          workload-id-provider: 'projects/1094498259535/locations/global/workloadIdentityPools/gh-optimism/providers/github-by-repos'
          service-account: 'celo-optimism-gh@devopsre.iam.gserviceaccount.com'
          docker-gcp-registries: us-west1-docker.pkg.dev
      - name: Build and push container
        uses: celo-org/reusable-workflows/.github/actions/build-container@v2.0
        with:
          platforms: linux/amd64
          registry: us-west1-docker.pkg.dev/devopsre/dev-images/cel2-migration-tool
          tags: ${{ github.sha }}
          context: ./
          dockerfile: ./op-chain-ops/Dockerfile
          push: true
          trivy: false