action.yaml

name: 'Docker pipeline'
description: 'Docker Build, AWS ECR Push and Kustomize step'

inputs:
  app-name:
    description: 'The app name'
    required: true
  argo-cd-sync:
    description: 'Do you want to run the ArgoCD sync for this application in DEV environment?'
    required: true
  argo-cd-token:
    description: 'The ArgoCD token to sync after Kustomize step'
    required: false
  argo-cd-url:
    description: 'The ArgoCD URL to be used in application sync step'
    required: false
  aws-region:
    description: 'AWS region name to assume role'
    required: true
  dockerfile-name:
    description: 'The Dockerfile name'
    default: 'Dockerfile'
    required: true
  k8s-manifest-repo-name:
    description: 'The name of K8S manifests repository'
    required: true
  k8s-manifest-repo-url:
    description: 'The URL of K8S manifests repository'
    required: true
  role-session-name:
    description: 'The AWS Session name'
    required: true
  role-to-assume:
    description: 'The AWS OICD role to assume'
    required: true
  service-github-token:
    description: 'The service user token on Git Hub'
    required: true
  slack-webhook-url:
    description: 'The webhook URL to send notifications to slack'
    required: true

runs:
  using: "composite"
  steps:
    - name: Configure AWS credentials from AWS account
      uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ inputs.role-to-assume }}
        aws-region: ${{ inputs.aws-region }}
        role-session-name: ${{ inputs.role-session-name }}

    - name: Login to Amazon ECR
      id: login-ecr
      uses: aws-actions/amazon-ecr-login@v2
      with:
        mask-password: 'true'

    - name: Get git repository informations
      uses: LerianStudio/github-actions-git-informations@main

    - name: Run Trivy vulnerability scanner in repo mode
      uses: aquasecurity/trivy-action@master
      with:
        scan-type: 'fs'
        format: 'table'
        ignore-unfixed: true
        severity: 'CRITICAL,HIGH'
        exit-code: '0'

    - name: Build, tag, and push docker image to Amazon ECR
      shell: bash
      env:
        REGISTRY: ${{ steps.login-ecr.outputs.registry }}
        REPOSITORY: ${{ inputs.app-name }}
        IMAGE_TAG: ${{ env.RELEASE_VERSION }}
      run: |
        docker build -t $REGISTRY/$REPOSITORY:$IMAGE_TAG -f ${{ inputs.dockerfile-name }} \
          --build-arg GITHUB_USER_TOKEN=${{ inputs.service-github-token }} .
        docker push $REGISTRY/$REPOSITORY:$IMAGE_TAG

    - name: Run Trivy vulnerability scanner
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: '${{ steps.login-ecr.outputs.registry }}/${{ inputs.app-name }}:${{ env.RELEASE_VERSION }}'
        format: 'table'
        ignore-unfixed: true
        vuln-type: 'os,library'
        severity: 'CRITICAL,HIGH'
        exit-code: '0'

    - name: Kustomize step
      uses: LerianStudio/github-actions-kustomize-argocd-manifests@main
      with:
        app-name: ${{ inputs.app-name }}
        app-registry: ${{ steps.login-ecr.outputs.registry }}
        github-actor: ${{ github.actor }}
        github-token: '${{ inputs.service-github-token }}'
        k8s-manifest-repo-name: '${{ inputs.k8s-manifest-repo-name }}'
        k8s-manifest-repo-url: '${{ inputs.k8s-manifest-repo-url }}'

    - name: ArgoCD Sync - DEV
      if: ${{ env.GITOPS_BRANCH == 'develop' && inputs.argo-cd-sync == true }}
      uses: LerianStudio/github-actions-argocd-sync@main
      with:
        app-name: ${{ inputs.app-name }}
        env-prefix: 'dev'
        argo-cd-token:  ${{ inputs.argo-cd-token }}
        argo-cd-url: ${{ inputs.argo-cd-url }}

    - name: Slack Notification - failure
      if: ${{ failure() }}
      uses: rtCamp/action-slack-notify@v2
      env:
        SLACK_WEBHOOK: ${{ inputs.slack-webhook-url }}
        SLACK_COLOR: ${{job.status}}
        SLACK_USERNAME: GitHub Actions
        SLACK_ICON: https://github.githubassets.com/assets/GitHub-Mark-ea2971cee799.png
        SLACK_MESSAGE: 'Deploy da aplicação *${{ inputs.app-name }}* falhou :fire:'

    - name: Slack Notification - success
      if: ${{ success() }}
      uses: rtCamp/action-slack-notify@v2
      env:
        SLACK_WEBHOOK: ${{ inputs.slack-webhook-url }}
        SLACK_COLOR: ${{job.status}}
        SLACK_USERNAME: GitHub Actions
        SLACK_ICON: https://github.githubassets.com/assets/GitHub-Mark-ea2971cee799.png
        SLACK_MESSAGE: 'Deploy da aplicação *${{ inputs.app-name }}* realizado com sucesso :rocket:'

    - name: Slack Notification - success
      if: ${{ success() && env.GITOPS_BRANCH == 'main' }}
      uses: rtCamp/action-slack-notify@v2
      env:
        SLACK_WEBHOOK: ${{ inputs.slack-webhook-url }}
        SLACK_COLOR: ${{job.status}}
        SLACK_USERNAME: GitHub Actions
        SLACK_ICON: https://github.githubassets.com/assets/GitHub-Mark-ea2971cee799.png
        SLACK_MESSAGE: 'PR aberto no repositório de GitOps para deploy da aplicação *${{ inputs.app-name }}* em PRODUÇÃO, revisar e fazer merge do PR.'