commit-stage.yml

name: Commit Stage
on: push

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: grouphq/group-service
  VERSION: ${{ github.sha }}
  NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
  AWS_RDS_ROOT_CERT_US_EAST_1: https://truststore.pki.rds.amazonaws.com/us-east-1/us-east-1-bundle.pem

jobs:
  build:
    name: Build and Test
    runs-on: ubuntu-22.04
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Checkout source code
        uses: actions/checkout@v3
      - name: Set up JDK
        uses: actions/setup-java@v3
        with:
          distribution: temurin
          java-version: 17
          cache: gradle
      - name: Cache Gradle dependencies
        uses: actions/cache@v3
        with:
          path: ~/.gradle/dependency-check-data
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle') }}
          restore-keys: |
            ${{ runner.os }}-gradle-
      - name: Grant execute permission for gradlew
        run: chmod +x gradlew
      - name: Dependency vulnerability scanning
        run: ./gradlew dependencyCheckAnalyze --stacktrace -PnvdApiKey=${{ env.NVD_API_KEY }}
      - name: Checking code style
        run: |
          ./gradlew checkstyleMain
          ./gradlew checkstyleTest
      - name: Checking code quality
        run: |
          ./gradlew pmdMain
          ./gradlew pmdTest
      - name: Running Unit Tests
        run: ./gradlew testUnit
      - name: Upload test report
        if: failure()
        uses: actions/upload-artifact@v2
        with:
          name: unit-test-report
          path: build/reports/tests/testUnit
      - name: Running Integration Tests
        run: ./gradlew testIntegration
      - name: Upload test report
        if: failure()
        uses: actions/upload-artifact@v2
        with:
          name: integration-test-report
          path: build/reports/tests/testIntegration
      - name: Assembling Build
        run: ./gradlew assemble
      - name: Setup arkade
        uses: alexellis/setup-arkade@v3
      - name: Validate Kubernetes manifests
        run: |
          arkade get kubeconform
          kustomize build k8s/base | kubeconform -strict -summary -output json
          kustomize build k8s/overlays/observability | kubeconform -strict -summary -output json
  package:
    name: Package and Publish
    if: ${{ github.ref == 'refs/heads/main' }}
    needs: [ build ]
    runs-on: ubuntu-22.04
    permissions:
      contents: read
      packages: write
      security-events: write
    steps:
      - name: Checkout source code
        uses: actions/checkout@v3
      - name: Download AWS RDS Root Certificate for us-east-1
        run: |
          mkdir -p ./.postgresql
          curl -o ./.postgresql/root.crt ${{ env.AWS_RDS_ROOT_CERT_US_EAST_1 }}
      - name: Set up JDK
        uses: actions/setup-java@v3
        with:
          distribution: temurin
          java-version: 17
          cache: gradle
      - name: Build container image
        run: |
          chmod +x gradlew
          ./gradlew bootBuildImage \
          --imageName ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.VERSION }}
      - name: Add Amazon RDS Root Certificate (us-east-1)
        run: docker build -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.VERSION }} .
      - name: OCI image vulnerability scanning
        uses: anchore/scan-action@v3
        id: scan
        with:
          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.VERSION }}
          fail-build: false
          severity-cutoff: high
          acs-report-enable: true
      - name: Log into container registry
        uses: docker/login-action@v2
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Publish container image
        run: docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.VERSION }}
      - name: Publish container image (latest)
        run: |
          docker tag \
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.VERSION }} \
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
          docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest