restrict to single file

.github/workflows/on-merge-or-tag.yml

@@ -64,4 +64,4 @@ jobs:
             Authorization = "Bearer ${{ env.TOKEN }}"
           }
 
-          Invoke-RestMethod -Method POST -Uri ${{ env.API_URL }}/releases -Body $body -Headers $headers
+          #Invoke-RestMethod -Method POST -Uri ${{ env.API_URL }}/releases -Body $body -Headers $headers

.github/workflows/on-prerelease.yml

@@ -16,6 +16,12 @@ env:
   VSS_NUGET_EXTERNAL_FEED_ENDPOINTS: '{"endpointCredentials": [{"endpoint": "${{ secrets.AZURE_ARTIFACTS_FEED_URL }}","password": "${{ secrets.AZURE_ARTIFACTS_PERSONAL_ACCESS_TOKEN }}"}]}'
   MANIFEST_FILE: "_manifest/spdx_2.2/manifest.spdx.json"
   PACKAGE_NAME: "AdminApi"
+  IMAGE_NAME: ${{ vars.IMAGE_NAME }}
+  DATABASE_IMAGE_NAME: ${{ vars.DATABASE_IMAGE_NAME }}
+  DOCKER_USERNAME: ${{ vars.DOCKER_USERNAME }}
+  DOCKER_HUB_TOKEN: ${{ secrets.DOCKER_HUB_TOKEN }}
+  REF: ${{ github.ref_name }}
+
 jobs:
   pack:
     name: Build and Pack
@@ -235,7 +241,114 @@ jobs:
             NuGetApiKey = "${{ env.ARTIFACTS_API_KEY }}"
           }
 
-          $artifact | ForEach-Object {
-              $arguments.PackageFile = $_
-              ./build.ps1 Push @arguments
-           }
+          # $artifact | ForEach-Object {
+          #     $arguments.PackageFile = $_
+          #     ./build.ps1 Push @arguments
+          #  }
+  docker-publish:
+    name: Publish to Docker Hub
+    runs-on: ubuntu-latest
+    needs:
+      - publish-package
+    permissions:
+      security-events: write
+    steps:
+      - name: Wait 20s
+        # Give Azure Artifacts caching a moment to catch up
+        run: sleep 20
+
+      - name: Prepare Tags
+        id: prepare-tags
+        run: |
+          REF="${{ env.REF }}"   
+
+          if [[ $REF =~ "Pre-Release" ]]
+          then
+             # Remove Pre-Release prefix 
+             PREFIX="Pre-Release-"
+             PACKAGEVERSION=${REF#"$PREFIX"}
+          else
+             PACKAGEVERSION=${REF}
+          fi
+
+          if [[ $PACKAGEVERSION =~ "alpha" ]]
+          then
+            # Pre-releases get the tag "pre"
+            APITAGS="${{ env.IMAGE_NAME }}:pre"
+            DBTAGS="${{ env.DATABASE_IMAGE_NAME }}:pre"
+          else
+            # Releases get the version, plus shortened form for minor release.
+            # We are not using shortened form for major or using "latest"
+            # because they are too imprecise.
+            echo "${PACKAGEVERSION}"
+            MINOR=`echo ${PACKAGEVERSION} | awk -F"." '{print $1"."$2}'`
+            APITAGS="${{ env.IMAGE_NAME }}:${PACKAGEVERSION},${{ env.IMAGE_NAME }}:${MINOR}"
+            DBTAGS="${{ env.DATABASE_IMAGE_NAME }}:${PACKAGEVERSION},${{ env.DATABASE_IMAGE_NAME }}:${MINOR}"
+          fi
+
+          SEMVERSION=${PACKAGEVERSION:1}  # strip off the leading 'v'
+          echo "APITAGS=$APITAGS" >> $GITHUB_OUTPUT
+          echo "DBTAGS=$DBTAGS" >> $GITHUB_OUTPUT
+          # echo "VERSION=$SEMVERSION" >> $GITHUB_OUTPUT
+          echo "VERSION=0.0.0-alpha.0.67" >> $GITHUB_OUTPUT
+          echo "${APITAGS}"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4b4e9c3e2d4531116a6f8ba8e71fc6e2cb6e6c8c  # v2.5.0
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a  # v2.1.0
+        with:
+          username: ${{ env.DOCKER_USERNAME }}
+          password: ${{ env.DOCKER_HUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for admin api image
+        id: metaapi
+        uses: docker/metadata-action@507c2f2dc502c992ad446e3d7a5dfbe311567a96  # v4.3.0
+        with:
+          images: ${{ env.IMAGE_NAME }}
+
+      - name: Build and push admin api image
+        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671  # v4.0.0
+        with:
+          context: "{{defaultContext}}:Docker"
+          cache-from: type=registry,ref=${{ env.IMAGE_NAME }}:pre
+          cache-to: type=inline
+          build-args: VERSION=${{ steps.prepare-tags.outputs.VERSION }}
+          file: api-pgsql.Dockerfile
+          tags: ${{ steps.prepare-tags.outputs.APITAGS }}
+          labels: ${{ steps.metaapi.outputs.labels }}
+          push: true
+
+      - name: Extract metadata (tags, labels) for admin api database image
+        id: metadatabase
+        uses: docker/metadata-action@507c2f2dc502c992ad446e3d7a5dfbe311567a96  # v4.3.0
+        with:
+          images: ${{ env.DATABASE_IMAGE_NAME }}
+
+      - name: Build and push admin api database image
+        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671  # v4.0.0
+        with:
+          context: "{{defaultContext}}:Docker/Settings/DB-Admin/pgsql"
+          cache-from: type=registry,ref=${{ env.DATABASE_IMAGE_NAME }}:pre
+          cache-to: type=inline
+          build-args: VERSION=${{ steps.prepare-tags.outputs.VERSION }}
+          file: Dockerfile
+          tags: ${{ steps.prepare-tags.outputs.DBTAGS }}
+          labels: ${{ steps.metadatabase.outputs.labels }}
+          push: true
+
+      - name: Analyze for critical and high CVEs
+        id: docker-scout-cves        
+        uses: docker/scout-action@v0.20.0
+        with:
+          command: cves
+          image: ${{ steps.prepare-tags.outputs.APITAGS }}
+          sarif-file: sarif.output.json
+          summary: true
+
+      # - name: Upload SARIF result
+      #   id: upload-sarif       
+      #   uses: github/codeql-action/upload-sarif@v2
+      #   with:
+      #     sarif_file: sarif.output.json

.github/workflows/on-pullrequest-dockerfile.yml

@@ -0,0 +1,47 @@
+name: On Pull Request - Dockerfile
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/on-pullrequest-dockerfile.yml"
+      - "Docker/*"
+  pull_request:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/on-pullrequest-dockerfile.yml"
+      - "Docker/*"
+  workflow_dispatch:
+
+jobs:
+  docker-testing:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+
+      - uses: hadolint/hadolint-action@54c9adbab1582c2ef04b2016b760714a4bfde3cf # v3.1.0
+        name: Run Linter on Postgres Dockerfile
+        with:
+          dockerfile: "Docker/api-pgsql.Dockerfile"
+          failure-threshold: error
+
+      - uses: hadolint/hadolint-action@54c9adbab1582c2ef04b2016b760714a4bfde3cf # v3.1.0
+        name: Run Linter on Sql Dockerfile
+        with:          
+          dockerfile: "Docker/api-mssql.Dockerfile"
+          failure-threshold: error
+
+      - uses: hadolint/hadolint-action@54c9adbab1582c2ef04b2016b760714a4bfde3cf # v3.1.0
+        name: Run Linter on Database Dockerfile
+        with:          
+          dockerfile: "Docker/dbadmin.Dockerfile"
+          failure-threshold: error
+
+      - uses: hadolint/hadolint-action@54c9adbab1582c2ef04b2016b760714a4bfde3cf # v3.1.0
+        name: Run Linter on Development Dockerfile
+        with:          
+          dockerfile: "Docker/dev.Dockerfile"
+          failure-threshold: error     

Docker/Settings/DB-Admin/pgsql/Dockerfile

@@ -10,7 +10,7 @@ ENV POSTGRES_USER=${POSTGRES_USER}
 ENV POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
 ENV POSTGRES_DB=postgres
 
-ENV VERSION="0.0.0-alpha.0.65"
+ARG VERSION=latest
 
 COPY run-adminapi-migrations.sh /docker-entrypoint-initdb.d/3-run-adminapi-migrations.sh
 

Docker/api-mssql.Dockerfile

@@ -6,7 +6,7 @@
 #tag 6.0-alpine 
 FROM mcr.microsoft.com/dotnet/aspnet@sha256:201cedd60cb295b2ebea7184561a45c5c0ee337e37300ea0f25cff5a2c762538
 LABEL maintainer="Ed-Fi Alliance, LLC and Contributors <techsupport@ed-fi.org>"
-ENV VERSION="0.0.0-alpha.0.65"
+ARG VERSION=latest
 
 # Alpine image does not contain Globalization Cultures library so we need to install ICU library to get for LINQ expression to work
 # Disable the globaliztion invariant mode (set in base image)

Docker/api-pgsql.Dockerfile

@@ -6,7 +6,8 @@
 #tag 6.0-alpine 
 FROM mcr.microsoft.com/dotnet/aspnet@sha256:201cedd60cb295b2ebea7184561a45c5c0ee337e37300ea0f25cff5a2c762538
 LABEL maintainer="Ed-Fi Alliance, LLC and Contributors <techsupport@ed-fi.org>"
-ENV VERSION="0.0.0-alpha.0.65"
+
+ARG VERSION=latest
 
 # Alpine image does not contain Globalization Cultures library so we need to install ICU library to get for LINQ expression to work
 # Disable the globaliztion invariant mode (set in base image)

Docker/dev.Dockerfile

@@ -44,4 +44,6 @@ RUN apk --no-cache add curl=~8 dos2unix=~7 bash=~5 gettext=~0 icu=~72 gcompat &&
 EXPOSE 443
 WORKDIR /app
 
+# dummy change for testing lint
+
 ENTRYPOINT ["/app/run.sh"]