pr-cve-scan.yml

name: HMDA PR CVE Scan

on:
  pull_request:
    branches:
      - master

jobs:
  tests:
    runs-on: ubuntu-latest

    steps:
      - name: Check out code
        uses: actions/checkout@v4

      - name: Set up docker build
        uses: docker/setup-buildx-action@v3

      - name: Build image of hmda platform only
        run: |
          sbt "project hmda-platform" dockerPublishLocalSkipTests
        continue-on-error: true

      - name: Tag docker image
        run: docker tag $(docker images --filter=reference="hmda/hmda-platform:latest" --format "{{.ID}}") hmda-cve/hmda-platform:pr-cve-scan

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        run: echo ${{ secrets.DOCKERHUB_PASSWORD }} | docker login -u ${{ secrets.DOCKERHUB_USERNAME }} --password-stdin

      - name: Check image for CVEs
        uses: docker/scout-action@v1
        with:
          command: cves
          image: hmda-cve/hmda-platform:pr-cve-scan

      - name: Remove docker image
        run: |
          docker rmi hmda-cve/hmda-platform:pr-cve-scan