push-to-docker.yml

name: Push SAF CLI to Docker Hub on every release

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      version:
        description: 'Version'
        required: true

permissions:
  contents: read

jobs:
  docker:
    runs-on: ubuntu-24.04
    steps:
      - name: Run string replace to remove the v from the version number before using it in the docker tag
        uses: frabert/replace-string-action@v2
        id: format-tag
        with:
          pattern: 'v'
          string: "${{ github.event.release.tag_name || github.event.inputs.version }}"
          replace-with: ''
          flags: 'g'
      - name: Checkout the SAF Repository
        uses: actions/checkout@v5
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Login to DockerHub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_TOKEN }}
      - name: Build and push the container image to DockerHub
        id: docker_build
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          platforms: "linux/amd64,linux/arm64"
          tags: mitre/saf:release-latest,mitre/saf:${{ steps.format-tag.outputs.replaced }},mitre/saf:v1
      - name: Get Docker SHA since the Iron Bank release requires us to specify the exact resources we need them to pull into the environment
        shell: bash
        id: get-docker-sha
        run: |
          MAX_RETRIES=5
          RETRY_DELAY=0.5 # in seconds
          RETRY_COUNT=0
          SUCCESS=false

          while [ "$RETRY_COUNT" -lt "$MAX_RETRIES" ]; do
            if docker pull mitre/saf:${{ steps.format-tag.outputs.replaced }}; then
              SUCCESS=true
              break
            else
              RETRY_COUNT="$((RETRY_COUNT + 1))"
              echo "Retry $RETRY_COUNT/$MAX_RETRIES: Docker pull failed.  Retrying in $RETRY_DELAY seconds..."
              sleep "$RETRY_DELAY"
            fi
          done

          if [ "$SUCCESS" = true ]; then
            echo "DOCKER_SHA=$(docker inspect --format='{{index .RepoDigests 0}}' mitre/saf:${{ steps.format-tag.outputs.replaced }} | cut -d '@' -f 2)" >> $GITHUB_ENV
          else
            echo "Docker pull failed after $MAX_RETRIES attempts."
            exit 1
          fi
      - name: Upgrade Iron Bank
        uses: mitre/ironbank_release_action@v1
        with:
          name: SAF-CLI
          version: ${{ steps.format-tag.outputs.replaced }}
          ironbank_pat: ${{ secrets.SAF_IRONBANK_REPO1_PAT }}
          ironbank_username: ${{ secrets.SAF_IRONBANK_REPO1_USERNAME }}
          ironbank_project_id: 17072
          ironbank_project_clone_url: repo1.dso.mil/dsop/mitre/security-automation-framework/saf.git
          git_commit_author_name: "Automated SAF CLI Release"
          git_commit_author_email: "saf@mitre.org"
          update_commands: |
            yq e -i '.args.SAF_VERSION=\"${{ steps.format-tag.outputs.replaced }}\" | .tags[0]=\"${{ steps.format-tag.outputs.replaced }}\" | .labels.\"org.opencontainers.image.version\"=\"${{ steps.format-tag.outputs.replaced }}\" | .resources[0].tag=\"mitre/saf:${{ steps.format-tag.outputs.replaced }}\" | .resources[0].url=\"docker://docker.io/mitre/saf@${{ env.DOCKER_SHA }}\"' hardening_manifest.yaml
            sed -i s/SAF_VERSION=\.\*/SAF_VERSION=${{ steps.format-tag.outputs.replaced }}/ Dockerfile