Harden Kubernetes IaC for vote, worker, result (Sysdig Best Practices) #3

	name: Voting App Build & Scan

	on:
	push:
	branches:
	- main
	pull_request:
	workflow_dispatch:

	jobs:
	build-and-scan:
	runs-on: ubuntu-latest

	env:
	SYS_DIG_SECURE_URL: https://app.au1.sysdig.com

	steps:
	- name: Checkout source
	uses: actions/checkout@v3

	- name: Set up Docker Buildx
	uses: docker/setup-buildx-action@v2

	- name: Log in to DockerHub (optional)
	if: ${{ secrets.DOCKERHUB_USERNAME && secrets.DOCKERHUB_TOKEN }}
	uses: docker/login-action@v2
	with:
	username: ${{ secrets.DOCKERHUB_USERNAME }}
	password: ${{ secrets.DOCKERHUB_TOKEN }}

	- name: Build Voting App images
	run: \|
	docker build -t voting-app ./vote
	docker build -t worker ./worker
	docker build -t result ./result

	- name: Scan image with Sysdig CLI Scanner
	env:
	SECURE_API_TOKEN: ${{ secrets.SECURE_API_TOKEN }}
	run: \|
	docker run --rm --platform linux/amd64 --user 0 -v "$(pwd)/scan-logs:/home/nonroot/scan-logs" -v /var/run/docker.sock:/var/run/docker.sock -e SECURE_API_TOKEN="${{ secrets.SECURE_API_TOKEN }}" quay.io/sysdig/sysdig-cli-scanner:1.22.4 --apiurl "$SYS_DIG_SECURE_URL" --loglevel info --skiptlsverify docker://voting-app

Provide feedback