cicd.yml

name: CICD

on:
  workflow_dispatch:
  push:
    branches:
      - 'main'
      - 'alpha'
      - 'beta'
      - 'dev'
  pull_request:
    types: [opened, reopened, synchronize]
  merge_group:

permissions:
  # deployments permission to deploy GitHub pages website
  deployments: write
  # contents permission to update benchmark contents in gh-pages branch
  contents: write

jobs:
  build-test:
    name: Build & Test
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4

    - name: Setup .NET Core
      uses: actions/setup-dotnet@v4
      with:
        global-json-file: global.json

    - name: .NET Build
      run: dotnet build -c Release

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Docker Buildx
      working-directory: src/oidc-guard
      run: docker buildx build --platform linux/amd64,linux/arm64 -t oidc-guard .

    - name: Add hosts to /etc/hosts
      run: |
          sudo echo "127.0.0.1 demo-app.test.loc" | sudo tee -a /etc/hosts
          sudo echo "127.0.0.1 oidc-guard.test.loc" | sudo tee -a /etc/hosts
          sudo echo "127.0.0.1 oidc-server.oidc-server" | sudo tee -a /etc/hosts

    - name: Install Playwright
      working-directory: tests/oidc-guard-tests/bin/Release/net9.0
      run: ./playwright.ps1 install --with-deps
      shell: pwsh

    - name: .NET Test
      run: dotnet test -c Release --collect:"XPlat Code Coverage" /p:DebugSymbols=true /p:DebugType=full

    - name: Coverage
      uses: codecov/codecov-action@v4
      with:
        token: ${{ secrets.CODECOV_TOKEN }}
        file: coverage.cobertura.xml
        fail_ci_if_error: true

    - name: Publish Benchmark
      working-directory: benchmarks/oidc-guard-benchmarks
      run: dotnet publish -c Release -o bin/publish

    - name: Chmod Benchmark
      working-directory: benchmarks/oidc-guard-benchmarks/bin/publish
      run: chmod +x oidc-guard-benchmarks

    - name: Run Benchmark
      working-directory: benchmarks/oidc-guard-benchmarks/bin/publish
      run: ./oidc-guard-benchmarks

    - name: Store benchmark result
      if: github.ref == 'refs/heads/main'
      uses: benchmark-action/github-action-benchmark@v1
      with:
        name: Benchmark.Net Benchmark
        tool: 'benchmarkdotnet'
        output-file-path: benchmarks/oidc-guard-benchmarks/bin/publish/BenchmarkDotNet.Artifacts/results/Sample.Benchmarks-report-full-compressed.json
        github-token: ${{ secrets.GITHUB_TOKEN }}
        auto-push: true
        # Show alert with commit comment on detecting possible performance regression
        alert-threshold: '120%'
        comment-on-alert: true
        fail-on-alert: false
        alert-comment-cc-users: '@IvanJosipovic'

    - name: Run Trivy vulnerability scanner
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: 'oidc-guard'
        format: 'table'
        exit-code: '1'
        ignore-unfixed: true
        vuln-type: 'os,library'
        severity: 'CRITICAL,HIGH'

  create-release:
    if: ${{ github.event_name != 'pull_request' }}
    name: Create Release
    runs-on: ubuntu-latest
    needs: [build-test]
    steps:
    - uses: actions/checkout@v4

    - name: Configure Git
      run: |
        git config user.name "$GITHUB_ACTOR"
        git config user.email "$GITHUB_ACTOR@users.noreply.github.com"

    - name: Semantic Release
      uses: cycjimmy/semantic-release-action@v4
      id: semantic
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: Set up Docker Buildx
      if: steps.semantic.outputs.new_release_published == 'true'
      uses: docker/setup-buildx-action@v3

    - name: Docker Push
      if: steps.semantic.outputs.new_release_published == 'true'
      working-directory: src/oidc-guard
      run: |
        echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${GITHUB_ACTOR} --password-stdin

        docker buildx build --push --platform linux/amd64,linux/arm64 -t ghcr.io/${GITHUB_REPOSITORY,,}/oidc-guard:latest -t ghcr.io/${GITHUB_REPOSITORY,,}/oidc-guard:${{ steps.semantic.outputs.new_release_version }} --build-arg VERSION=${{ steps.semantic.outputs.new_release_version }} .

    - name: Install Helm
      if: steps.semantic.outputs.new_release_published == 'true'
      uses: azure/setup-helm@v4
      with:
        token: ${{ secrets.GITHUB_TOKEN }}

    - name: Update Helm Version
      if: steps.semantic.outputs.new_release_published == 'true'
      shell: bash
      run: |
          cp ./README.md ./charts/oidc-guard/
          sed -i 's/0.0.1/${{ steps.semantic.outputs.new_release_version }}/' ./charts/oidc-guard/Chart.yaml

    - name: Run chart-releaser
      if: steps.semantic.outputs.new_release_published == 'true'
      uses: helm/chart-releaser-action@v1
      env:
        CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"