GitHub Workflow to create, scan and publish docker images

.github/workflows/build-core.yml

@@ -0,0 +1,82 @@
+name: Build, Scan, Publish and Sign Lookup-Core Scanner
+
+on:
+  push:
+    tags: ['core-v*']
+
+permissions:
+  contents: read
+  packages: write
+  id-token: write
+  attestations: write
+
+env:
+  IMAGE_NAME: ghcr.io/adampetho/lookup-core
+  DOCKERFILE_PATH: ./Dockerfile.core
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Build candidate
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ${{ env.DOCKERFILE_PATH }}
+          platforms: linux/amd64
+          load: true
+          tags: lookup-core:scan-candidate
+
+      - name: Scan candidate with Trivy     # Check for vulnerabilities with Trivy before pushing to GHCR
+        uses: aquasecurity/trivy-action@0.72.0      # Pin to version, instead of relying on master
+        with:
+          image-ref: lookup-core:scan-candidate
+          severity: CRITICAL,HIGH
+          exit-code: 1
+
+  build-and-push:
+    needs: scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Extract version from tag
+        id: version
+        run: echo "version=${GITHUB_REF_NAME#core-}" >> "$GITHUB_OUTPUT"
+
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ${{ env.DOCKERFILE_PATH }}
+          platforms: linux/amd64,linux/arm64
+          push: true
+          provenance: true
+          sbom: true
+          labels: |
+            org.opencontainers.image.title=LookUp Scanner
+            org.opencontainers.image.description=Scans the Bitcoin blockchain for OP_RETURN human-readable messages.
+            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
+            org.opencontainers.image.version=${{ steps.version.outputs.version }}
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.licenses=MIT
+          tags: |
+            ${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}
+            ${{ env.IMAGE_NAME }}:latest
+
+     - name: Install Cosign
+       uses: sigstore/cosign-installer@v3
+     - name: Keyless Sign
+       run: cosign sign --yes ${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}

.github/workflows/build-website.yml

@@ -0,0 +1,82 @@
+name: Build, Scan, Publish and Sign Lookup-Core Website
+
+on:
+  push:
+    tags: ['website-v*']
+
+permissions:
+  contents: read
+  packages: write
+  id-token: write
+  attestations: write
+
+env:
+  IMAGE_NAME: ghcr.io/adampetho/lookup-website
+  DOCKERFILE_PATH: ./Dockerfile.blazor
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Build candidate
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ${{ env.DOCKERFILE_PATH }}
+          platforms: linux/amd64
+          load: true
+          tags: lookup-website:scan-candidate
+
+      - name: Scan candidate with Trivy     # Check for vulnerabilities with Trivy before pushing to GHCR
+        uses: aquasecurity/trivy-action@0.72.0      # Pin to version, instead of relying on master
+        with:
+          image-ref: lookup-website:scan-candidate
+          severity: CRITICAL,HIGH
+          exit-code: 1
+
+  build-and-push:
+    needs: scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Extract version from tag
+        id: version
+        run: echo "version=${GITHUB_REF_NAME#website-}" >> "$GITHUB_OUTPUT"
+
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ${{ env.DOCKERFILE_PATH }}
+          platforms: linux/amd64,linux/arm64
+          push: true
+          provenance: true
+          sbom: true
+          labels: |
+            org.opencontainers.image.title=LookUp Website
+            org.opencontainers.image.description=Browse messages on the Bitcoin blockchain.
+            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
+            org.opencontainers.image.version=${{ steps.version.outputs.version }}
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.licenses=MIT    
+          tags: |
+            ${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}
+            ${{ env.IMAGE_NAME }}:latest
+
+     - name: Install Cosign
+       uses: sigstore/cosign-installer@v3
+     - name: Keyless Sign
+       run: cosign sign --yes ${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}