ci.yml

name: Run CI

# Run this workflow every time a new commit pushed to your repository
on:
  push:
    branches:
      - main
    tags:
      - '*'
  pull_request:
  workflow_dispatch:

env:
  IMAGE_NAME: openzaak/open-notificaties
  DJANGO_SETTINGS_MODULE: nrc.conf.ci
  DB_PASSWORD: ''
  DB_USER: postgres
  ALLOWED_HOSTS: openzaak.nl

jobs:
  tests:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        postgres: ['10', '11', '12', '13', '14']

    name: Tests (PG ${{ matrix.postgres }})

    services:
      postgres:
        image: postgres:${{ matrix.postgres }}
        env:
          POSTGRES_HOST_AUTH_METHOD: trust
        ports:
          - 5432:5432
        # needed because the postgres container does not provide a healthcheck
        options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5

    steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-python@v2
        with:
          python-version: '3.10'
      - uses: actions/setup-node@v2-beta
        with:
          node-version: '16'

      - name: Start CI docker-compose
        run: docker-compose -f docker-compose.ssl.yml up -d mock

      - name: Install dependencies
        run: pip install -r requirements/ci.txt codecov

      - name: Build frontend
        run: |
          npm ci --legacy-peer-deps
          npm run build --production

      - name: Run tests
        run: |
          python src/manage.py collectstatic --noinput --link
          coverage run src/manage.py test src

      - name: Publish coverage report
        uses: codecov/codecov-action@v1

  docs:
    runs-on: ubuntu-latest
    name: Documentation build

    steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-python@v2
        with:
          python-version: '3.10'
      - name: Install dependencies
        run: pip install -r requirements/dev.txt pytest
      - name: Build and test docs
        run: cd docs && pytest check_sphinx.py -v --tb=auto

  docker:
    runs-on: ubuntu-latest
    name: Docker image build

    steps:
      - uses: actions/checkout@v2
      - name: Determine tag/commit hash
        id: vars
        run: |
          # Strip git ref prefix from version
          VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')

          # Strip "v" prefix from tag name (if present at all)
          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')

          # Use Docker `latest` tag convention
          [ "$VERSION" == "main" ] && VERSION=latest

          echo ::set-output name=tag::${VERSION}
          echo ::set-output name=git_hash::${GITHUB_SHA}
      - name: Build the Docker image
        run: |
          docker build \
            --tag $IMAGE_NAME:${{ steps.vars.outputs.tag }} \
            --build-arg COMMIT_HASH=${{ steps.vars.outputs.git_hash }} \
            --build-arg RELEASE=${{ steps.vars.outputs.tag }} \
            .
      - run: docker image save -o image.tar $IMAGE_NAME:${{ steps.vars.outputs.tag }}
      - name: Store image artifact
        uses: actions/upload-artifact@v2
        with:
          name: docker-image
          path: image.tar
          retention-days: 1

  image_scan:
    runs-on: ubuntu-latest
    name: Scan docker image
    needs:
      - docker

    steps:
      - name: Download built image
        uses: actions/download-artifact@v3
        with:
          name: docker-image
      - name: Scan image with Trivy
        uses: aquasecurity/trivy-action@master
        with:
          input: /github/workspace/image.tar  # from download-artifact
          format: 'sarif'
          output: 'trivy-results-docker.sarif'
          ignore-unfixed: true
      - name: Upload results to GH Security tab
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results-docker.sarif'

  publish:
    needs:
      - tests
      - docker

    name: Push Docker image
    runs-on: ubuntu-latest
    if: github.event_name == 'push'  # exclude PRs/forks

    steps:
      - uses: actions/checkout@v2
      - name: Download built image
        uses: actions/download-artifact@v2
        with:
          name: docker-image

      - name: Determine tag/commit hash
        id: vars
        run: |
          # Strip git ref prefix from version
          VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')

          # Strip "v" prefix from tag name (if present at all)
          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')

          # Use Docker `latest` tag convention
          [ "$VERSION" == "main" ] && VERSION=latest

          echo ::set-output name=tag::${VERSION}

      - name: Load image
        run: |
          docker image load -i image.tar

      - name: Log into registry
        run: echo "${{ secrets.DOCKER_TOKEN }}" | docker login -u ${{ secrets.DOCKER_USERNAME }} --password-stdin

      - name: Push the Docker image
        run: docker push $IMAGE_NAME:${{ steps.vars.outputs.tag }}