From 2fb9762dfc0c9c6616bf09e2031d8a7f5691dd6e Mon Sep 17 00:00:00 2001
From: gigirassy <gigirassy@noreply.codeberg.org>
Date: Thu, 16 Apr 2026 00:49:05 +0200
Subject: [PATCH] Update .github/workflows/codeberg-publish.yml

---
 .github/workflows/codeberg-publish.yml | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/codeberg-publish.yml b/.github/workflows/codeberg-publish.yml
index 32d097f..6f08ba0 100644
--- a/.github/workflows/codeberg-publish.yml
+++ b/.github/workflows/codeberg-publish.yml
@@ -8,6 +8,7 @@ env:
 on:
   push:
 
+
 jobs:
   build:
     runs-on: self-hosted
@@ -16,7 +17,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Set up QEMU (for cross-platform building)
+      - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
 
       - name: Set up Buildx
@@ -29,7 +30,25 @@ jobs:
           username: ${{ secrets.REGISTRY_USER }}
           password: ${{ secrets.REGISTRY_PASS }}
 
-      - name: Build and push images
+      - name: Build image (export tar)
+        run: |
+          docker buildx build \
+            --platform linux/amd64 \
+            --output type=docker,dest=image.tar \
+            -t local-image:scan \
+            .
+
+      - name: Scan image with Grype
+        run: |
+          docker run --rm \
+            -v $(pwd):/work \
+            anchore/grype:latest \
+            docker-archive:/work/image.tar \
+            --fail-on high \
+            -o table
+
+      - name: Build and push multi-arch image
+        if: success()
         uses: docker/build-push-action@v6
         with:
           context: .