clair-db.yml

name: Generate Clair Database

on:
  schedule:
    # Every 12 hours (at 11:00 and 23:00)
    - cron: '0 11,23 * * *'
  workflow_dispatch:
  pull_request:

env:
  IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}

jobs:
  generate:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write
    env:
      IMAGE_NAME: eternal-linux/helpers/ci/clair-db
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Run Clair V4 update
        uses: quay/clair-action@allow-update
        with:
          db-file: .clair/matcher.db
          mode: update

      - name: Compress database
        run: |
          tar -czvf .clair/matcher.db.tar.gz .clair/matcher.db
          rm .clair/matcher.db

      - name: Docker Login
        uses: docker/login-action@v1
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and Push
        uses: docker/build-push-action@v2
        with:
          context: .clair/.
          file: .clair/Containerfile
          push: true
          tags: |
            ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:latest