name: Security Scan

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

permissions:
  pull-requests: write

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  scout:
    # Docker Hub secrets are not exposed to pull requests from forks, so the
    # Scout login can never succeed there.
    if: github.repository == 'liketrek/TREK' && github.event.pull_request.head.repo.fork != true
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: docker/setup-buildx-action@v3

      - uses: docker/build-push-action@v5
        with:
          context: .
          push: false
          load: true
          tags: trek:scan

      - uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - uses: docker/scout-action@v1
        with:
          command: cves
          image: trek:scan
          only-severities: critical,high
          only-fixed: true
          exit-code: true