81.3 Project 79: Docker build and push with Actions

echo 'Build the image from the same SHA that passed tests'

mkdir -p /tmp/gha79/app/.github/workflows && echo 'Today: Dockerfile, login, build-push, main only'

echo 'PR builds verify Dockerfile; main pushes'

printf '%s\n' 'FROM public.ecr.aws/docker/library/node:20-alpine' 'WORKDIR /app' 'COPY package.json ./' 'RUN npm install --omit=dev' 'COPY . .' 'CMD ["node", "server.js"]' > /tmp/gha79/app/Dockerfile && cat /tmp/gha79/app/Dockerfile

printf '%s\n' 'console.log("shop api");' > /tmp/gha79/app/server.js && echo 'shop api' > /dev/null; cat /tmp/gha79/app/server.js

printf '%s\n' '{"name":"shop-api","version":"1.0.0"}' > /tmp/gha79/app/package.json && cat /tmp/gha79/app/package.json

printf '%s\n' '      - uses: docker/login-action@v3' '        with:' '          registry: registry.example.com' '          username: \${{ secrets.REGISTRY_USER }}' '          password: \${{ secrets.REGISTRY_TOKEN }}' > /tmp/gha79/LOGIN.txt && cat /tmp/gha79/LOGIN.txt

echo 'Store REGISTRY_USER and REGISTRY_TOKEN in Actions secrets'

echo 'For Amazon ECR prefer OIDC in project 80 instead of long keys'

printf '%s\n' 'name: image' 'on:' '  push:' '    branches: [ main ]' '  pull_request:' '    branches: [ main ]' 'jobs:' '  docker:' '    runs-on: ubuntu-latest' '    steps:' '      - uses: actions/checkout@v4' '      - uses: docker/setup-buildx-action@v3' '      - name: Login' '        if: github.event_name == \'push\'' '        uses: docker/login-action@v3' '        with:' '          registry: registry.example.com' '          username: \${{ secrets.REGISTRY_USER }}' '          password: \${{ secrets.REGISTRY_TOKEN }}' '      - uses: docker/build-push-action@v6' '        with:' '          context: .' '          push: \${{ github.event_name == \'push\' }}' '          tags: registry.example.com/shop/api:\${{ github.sha }}' > /tmp/gha79/app/.github/workflows/image.yml && grep -E 'push:|tags:' /tmp/gha79/app/.github/workflows/image.yml

echo 'github.sha is the full commit — unique per build'

echo 'push false on pull_request builds the image without uploading'

echo 'tags: registry.example.com/shop/api:\${{ github.sha }}'

echo 'Or compute short SHA in a prior step and use that tag'

echo 'Never retag latest for production deploys'

printf '%s\n' 'cache-from: type=gha' 'cache-to: type=gha,mode=max' > /tmp/gha79/CACHE.txt && cat /tmp/gha79/CACHE.txt

echo 'Add those under build-push-action with:'

echo 'First build is slow; later builds reuse layers'

printf '%s\n' 'permissions:' '  contents: read' '  packages: write' > /tmp/gha79/PERMS.txt && cat /tmp/gha79/PERMS.txt

echo 'Least privilege: only the jobs that push need packages write'

echo 'External registries use your own secrets instead'

echo 'docker pull registry.example.com/shop/api:$GITHUB_SHA'

echo 'Confirm the digest matches the Actions log'

printf '%s\n' 'Acceptance: main push creates a SHA tag; PR does not' > /tmp/gha79/ACCEPT.txt && cat /tmp/gha79/ACCEPT.txt

echo 'Add a Trivy scan step before push in DevSecOps projects'

echo 'Fail the job on CRITICAL findings'

echo 'Do not push unscanned images to prod registries'

printf '%s\n' 'At Razorpay in Bengaluru, a PR workflow pushed latest and overwrote a release mid-day.' 'Mehul limited pushes to main and required SHA tags.' > /tmp/gha79/STORY.txt && wc -l /tmp/gha79/STORY.txt

echo 'Rough cost: about ₹19 lakh in retries'

echo 'Mehul: PASS'

grep build-push-action /tmp/gha79/app/.github/workflows/image.yml

test -f /tmp/gha79/ACCEPT.txt && echo 'accept ok'

echo 'Next: Deploy to AWS with OIDC project 80'

echo 'build-push with SHA tag'

echo 'PR builds without push'

echo 'Secrets used for login'