udx · fqjony · Mar 12, 2025 · Mar 12, 2025 · Mar 12, 2025 · Mar 12, 2025
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -0,0 +1,61 @@
+name: Test Build
+
+on:
+  push:
+    branches-ignore:
+      - master
+
+env:
+  # GCP and Artifact Registry configuration
+  PROJECT_ID: ${{ secrets.GKE_PROJECT }}
+  AR_LOCATION: ${{ vars.AR_LOCATION }}
+  AR_REPOSITORY: ${{ vars.AR_REPOSITORY }}
+  IMAGE_NAME: ${{vars.AR_LOCATION}}-docker.pkg.dev/${{secrets.GKE_PROJECT}}/${{vars.AR_REPOSITORY}}
+
+jobs:
+  build-and-test:
+    name: Build and Test
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push'
+    permissions:
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      # Get version from package.json
+      - name: Get Tag from package.json
+        id: version
+        run: echo "TAG=$(node -p "require('./package.json').version")" >> $GITHUB_OUTPUT
+
+      # Configure Docker for Artifact Registry
+      - name: Configure Docker authentication for Artifact Registry
+        run: |-
+          gcloud --quiet auth configure-docker $AR_LOCATION-docker.pkg.dev
+
+      # Set lowercase branch name
+      - name: Set lowercase branch name
+        run: echo "BRANCH_NAME=$(echo "${{ github.ref_name }}" | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV
+
+      # Build the Docker image
+      - name: Build
+        run: |-
+          docker build \
+            --tag "${{env.IMAGE_NAME}}/${{ env.BRANCH_NAME }}:${{ steps.version.outputs.TAG }}" \
+            --build-arg GITHUB_SHA="$GITHUB_SHA" \
+            --build-arg GITHUB_REF="$GITHUB_REF" \
+            .
+
+      # Scan Docker image for vulnerabilities
+      - name: Scan for vulnerabilities
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: "${{env.IMAGE_NAME}}/${{ env.BRANCH_NAME }}:${{ steps.version.outputs.TAG }}"
+          exit-code: "1"
+          severity: "CRITICAL"
+          timeout: "10m0s"
+          format: "table"
+          scan-type: "image"
+          scanners: "vuln"
diff --git a/Dockerfile b/Dockerfile
@@ -11,7 +11,7 @@ RUN apt-get update && apt-get install -y \
     authbind=2.2.0ubuntu1 \
     wget=1.24.5-2ubuntu1 \
     gnupg2=2.4.4-2ubuntu22 \
-    apt-transport-https=2.9.31ubuntu3 \
+    apt-transport-https=2.9.32ubuntu1 \
     libssl-dev=3.4.1-1ubuntu1 \
     libffi-dev=3.4.7-1 \
     file=1:5.45-3build1 \

diff --git a/changes.md b/changes.md
@@ -1,6 +1,7 @@
 ### 0.7.1
-* `axios` → `^1.8.3`
-* `firebase-admin` → `^13.2.0`
+* Docker `apt-transport-https` → `2.9.32ubuntu1`
+* NPM `axios` → `^1.8.3`
+* NPM `firebase-admin` → `^13.2.0`
 * Fixed package versions alignment
 
 ### 0.7.0