security.yml

name: Security Check
on:
  workflow_dispatch:
  schedule:
    - cron: '0 1 * * *'

permissions:
  contents: read
  security-events: write

jobs:
  scan:
    name: 'Image Scan (PHP: ${{ matrix.php-version }}, Variant: ${{ matrix.variant.name }})'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        php-version:
          - '8.2'
          - '8.3'
          - '8.4'
          - '8.5'
        variant:
          - name: fpm
            dockerfile: fpm/Dockerfile
          - name: fpm-otel
            dockerfile: fpm-otel/Dockerfile
          - name: caddy
            dockerfile: caddy/Dockerfile
          - name: caddy-otel
            dockerfile: caddy/Dockerfile
          - name: nginx
            dockerfile: nginx/Dockerfile
          - name: nginx-otel
            dockerfile: nginx/Dockerfile
          - name: frankenphp
            dockerfile: frankenphp/Dockerfile
          - name: frankenphp-otel
            dockerfile: frankenphp-otel/Dockerfile
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Pull image
        run: docker pull shopware/docker-base:${{ matrix.php-version }}-${{ matrix.variant.name }}

      - name: Login into Github Docker Registery
        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin

      - name: Scan for vulnerabilities
        id: scan
        uses: crazy-max/ghaction-container-scan@v4
        with:
          image: shopware/docker-base:${{ matrix.php-version }}-${{ matrix.variant.name }}
          dockerfile: ./${{ matrix.variant.dockerfile }}

      - name: Upload SARIF file
        if: ${{ steps.scan.outputs.sarif != '' }}
        uses: github/codeql-action/upload-sarif@v4.38.3
        with:
          sarif_file: ${{ steps.scan.outputs.sarif }}
          category: ${{ matrix.php-version }}-${{ matrix.variant.name }}