build.yml

# Builds and tests Docker image on pull requests
# Validates multi-stage build, GitLeaks installation, and scanner functionality
# Trigger: pull_request (all branches) | Permissions: contents:read

name: Docker build 🚀
run-name: Docker build 🚀

on:
  pull_request:
    branches: ["**"]

permissions: {}

env:
  environment: base
  timezone: ${{ vars.TIMEZONE }}

jobs:
  # 1. Setup infrastructure
  setup:
    name: Infrastructure 🔧
    runs-on: ubuntu-latest
    outputs:
      environment: ${{ env.environment }}
      timezone: ${{ env.timezone }}
    steps:
      - name: Environment 🧪
        run: echo "Environment set to ${{ env.environment }}"

      - name: Timezone 🌐
        run: echo "Timezone set to ${{ env.timezone }}"

  # 2. Build and test Docker image
  build:
    permissions:
      contents: read
      pull-requests: read

    name: Docker 📦
    needs: setup
    environment:
      name: ${{ needs.setup.outputs.environment }}
    runs-on: ubuntu-latest

    steps:
      - name: Repository
        uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # frozen: v6.0.1

      - name: Build
        run: docker build -t devsecops-hooks:local ./

      - name: Run
        run: docker run --rm -v "$(pwd):/src:rw,Z" -w /src devsecops-hooks:local