name: Docker Build and Test
on:
pull_request:
branches: [main]
paths:
- "Dockerfile"
- "docker-compose.yml"
- "src/**"
- "package*.json"
push:
branches: [main]
tags:
- "v*"
jobs:
docker-build:
name: Build Docker Image
runs-on: ubuntu-latest
steps:
- name: Checkout Repository
uses: actions/checkout@v4
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Build Docker Image
uses: docker/build-push-action@v5
with:
context: .
push: false
load: true
tags: aws-s3-mcp:test
cache-from: type=gha
cache-to: type=gha,mode=max
- name: Test Docker Image
run: |
docker run --name aws-s3-mcp-test -d aws-s3-mcp:test
# Give container time to start
sleep 5
# Check if container is running
docker ps | grep aws-s3-mcp-test
# Test healthcheck
docker exec aws-s3-mcp-test /app/healthcheck.sh
# Clean up
docker stop aws-s3-mcp-test
docker rm aws-s3-mcp-test
docker-scan:
name: Scan Docker Image
runs-on: ubuntu-latest
needs: docker-build
steps:
- name: Checkout Repository
uses: actions/checkout@v4
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Build Docker Image for Scanning
uses: docker/build-push-action@v5
with:
context: .
push: false
load: true
tags: aws-s3-mcp:scan
cache-from: type=gha
cache-to: type=gha,mode=max
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
image-ref: aws-s3-mcp:scan
format: "table"
exit-code: "1"
ignore-unfixed: true
severity: "CRITICAL"
publish:
name: Publish Docker Image
runs-on: ubuntu-latest
needs: [docker-build, docker-scan]
if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
steps:
- name: Checkout Repository
uses: actions/checkout@v4
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Docker metadata
id: meta
uses: docker/metadata-action@v5
with:
images: ghcr.io/${{ github.repository }}
tags: |
type=semver,pattern={{version}}
type=semver,pattern={{major}}.{{minor}}
type=sha
- name: Login to GitHub Container Registry
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Build and push Docker image
uses: docker/build-push-action@v5
with:
context: .
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max
