GitHub ActionsでプルリクエストされたDockerfileのみを対象に脆弱性スキャンを行う

name: Image PR Sysdig Scan

on:
  pull_request:
    paths:
      - 'images/**/Dockerfile'
    branches:
      - main
      - dev

jobs:
  sysdig_scan:
    runs-on: ubuntu-22.04
    env:
      SYSDIG_SECURE_ENDPOINT: "https://us2.app.sysdig.com"
      AWS_REGION: ap-northeast-1
      ECR_REPOSITORY_NAME: ＜ECRリポジトリ名＞
      ASSUME_ROLE: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/＜IAMロール名＞
      SYSDIG_POLICY: sysdig-best-practices
    permissions:
      id-token: write
      contents: read
      pull-requests: read
      actions: read
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        
      - name: Get changed Dockerfiles
        uses: dorny/paths-filter@v2
        id: dockerfile_changes
        with:
          filters: |
            dockerfiles:
              - 'images/**/Dockerfile'
          list-files: shell  # shellフォーマットに変更
      
      - name: Check for multiple Dockerfile changes
        id: check-dockerfile
        run: |
          # shellフォーマットで出力されたファイルリスト
          FILES=(${{ steps.dockerfile_changes.outputs.dockerfiles_files }})
          FILE_COUNT=${#FILES[@]}
          
          echo "Changed Dockerfiles: ${FILES[@]}"
          echo "Found $FILE_COUNT changed Dockerfile(s)"
          
          if [ "$FILE_COUNT" -gt 1 ]; then
            echo "::error::Multiple Dockerfiles modified in this PR. Please limit changes to a single Dockerfile per PR."
            echo "Modified Dockerfiles:"
            for file in "${FILES[@]}"; do
              echo "  - $file"
            done
            exit 1
          elif [ "$FILE_COUNT" -eq 1 ]; then
            DOCKERFILE=${FILES[0]}
            echo "dockerfile=$DOCKERFILE" >> $GITHUB_OUTPUT
            echo "Found single Dockerfile change: $DOCKERFILE"
          else
            echo "No Dockerfile changes detected."
            echo "dockerfile=" >> $GITHUB_OUTPUT
          fi

      - name: Configure AWS credentials
        if: steps.check-dockerfile.outputs.dockerfile != ''
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ env.ASSUME_ROLE }}
          aws-region: ${{ env.AWS_REGION }}
          
      - name: Login to Amazon ECR
        if: steps.check-dockerfile.outputs.dockerfile != ''
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2
        
      - name: Setup cache
        if: steps.check-dockerfile.outputs.dockerfile != ''
        uses: actions/cache@v4
        with:
          path: cache
          key: ${{ runner.os }}-cache-${{ hashFiles('**/sysdig-cli-scanner', '**/latest_version.txt', '**/db/main.db.meta.json', '**/scanner-cache/inlineScannerCache.db') }}
          restore-keys: ${{ runner.os }}-cache-
          
      - name: Download sysdig-cli-scanner if needed
        if: steps.check-dockerfile.outputs.dockerfile != ''
        run:  |
          curl -sLO https://download.sysdig.com/scanning/sysdig-cli-scanner/latest_version.txt
          mkdir -p ${GITHUB_WORKSPACE}/cache/db/
          if [ ! -f ${GITHUB_WORKSPACE}/cache/latest_version.txt ] || [ $(cat ./latest_version.txt) != $(cat ${GITHUB_WORKSPACE}/cache/latest_version.txt) ]; then
            cp ./latest_version.txt ${GITHUB_WORKSPACE}/cache/latest_version.txt
            curl -sL -o ${GITHUB_WORKSPACE}/cache/sysdig-cli-scanner "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/$(cat ${GITHUB_WORKSPACE}/cache/latest_version.txt)/linux/amd64/sysdig-cli-scanner"
            chmod +x ${GITHUB_WORKSPACE}/cache/sysdig-cli-scanner
          else
            echo "sysdig-cli-scanner latest version already downloaded"
          fi

      - name: Build Docker image
        if: steps.check-dockerfile.outputs.dockerfile != ''
        id: build
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          ECR_REPOSITORY: ${{ env.ECR_REPOSITORY_NAME }}
          DOCKERFILE: ${{ steps.check-dockerfile.outputs.dockerfile }}
        run: |
          dir=$(dirname "$DOCKERFILE")
          imagename=$(basename "$dir")
          tag=pr-${{ github.event.pull_request.number }}
          full_image=$ECR_REGISTRY/$ECR_REPOSITORY:$imagename-$tag
          
          echo "Building image from $DOCKERFILE"
          docker build -t $full_image -f $DOCKERFILE $dir
          echo "image=$full_image" >> $GITHUB_OUTPUT

      - name: Scan Docker image
        if: steps.build.outcome == 'success'
        id: scan
        env:
          SECURE_API_TOKEN: ${{ secrets.SYSDIG_SECURE_API_TOKEN }}
          IMAGE: ${{ steps.build.outputs.image }}
        run: |
          echo "Scanning image with Sysdig CLI Scanner"
          ${GITHUB_WORKSPACE}/cache/sysdig-cli-scanner \
            --apiurl ${SYSDIG_SECURE_ENDPOINT} \
            $IMAGE \
            --console-log \
            --dbpath=${GITHUB_WORKSPACE}/cache/db/ \
            --policy ${SYSDIG_POLICY} \
            --cachepath=${GITHUB_WORKSPACE}/cache/scanner-cache/

      - name: Push Docker image
        if: steps.scan.outcome == 'success'
        env:
          IMAGE: ${{ steps.build.outputs.image }}
        run: |
          echo "Scan passed successfully. Pushing image to ECR..."
          docker push $IMAGE