docker-build.yml

name: Docker Builds

on:
  pull_request:
  push:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: docker-builds-${{ github.ref }}
  cancel-in-progress: true

jobs:
  docker-build:
    name: Build ${{ matrix.name }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: target-vulnerable-app
            dockerfile: apps/target-vulnerable-app/Dockerfile
          - name: evidence-dashboard
            dockerfile: apps/evidence-dashboard/Dockerfile
          - name: phoenix-mcp-adapter
            dockerfile: services/phoenix-mcp-adapter/Dockerfile
          - name: evidence-watcher
            dockerfile: services/evidence-watcher/Dockerfile

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ${{ matrix.dockerfile }}
          platforms: linux/amd64
          push: false
          tags: evidence-freezer/${{ matrix.name }}:ci
          cache-from: type=gha,scope=${{ matrix.name }}
          cache-to: type=gha,mode=max,scope=${{ matrix.name }}

  sensitive-scan:
    name: Sensitive Value Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Scan for high-confidence secrets
        shell: bash
        run: |
          set -euo pipefail
          pattern='(AIza[0-9A-Za-z_-]{35}|ya29\.[0-9A-Za-z_-]+|ghp_[0-9A-Za-z]{36,}|github_pat_[0-9A-Za-z_]{20,}|sk_(live|test)_[0-9A-Za-z]{20,}|rk_live_[0-9A-Za-z]{20,}|whsec_[0-9A-Za-z]{20,}|xox[baprs]-[0-9A-Za-z-]{20,}|AKIA[0-9A-Z]{16}|-----BEGIN (RSA|OPENSSH|EC|PRIVATE) KEY-----)'
          if grep -RInE --exclude-dir=.git --exclude=pnpm-lock.yaml "$pattern" .; then
            echo "High-confidence secret-looking value found. Remove it or rotate it before publishing."
            exit 1
          fi