build.yml

name: Build

on:
  workflow_dispatch:

  push:
    branches:
      - develop
      - release/*
  pull_request:
    branches:
      - develop
      - release/**
  release:
    types: [published]

jobs:
  snyk-scan-deps-licences:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      pull-requests: read
      contents: read
      deployments: write
    steps:
      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
      - uses: radixdlt/public-iac-resuable-artifacts/fetch-secrets@main
        with:
          role_name: ${{ secrets.AWS_ROLE_NAME_SNYK_SECRET }}
          app_name: 'radix-dapp-toolkit'
          step_name: 'snyk-scan-deps-licenses'
          secret_prefix: 'SNYK'
          secret_name: ${{ secrets.AWS_SECRET_NAME_SNYK }}
          parse_json: true
      - name: Run Snyk to check for deps vulnerabilities
        uses: snyk/actions/node@b98d498629f1c368650224d6d212bf7dfa89e4bf # v0.4.0
        with:
          args: --all-projects --org=${{ env.SNYK_PROJECTS_ORG_ID }} --severity-threshold=critical

  snyk-scan-code:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      pull-requests: read
      contents: read
      deployments: write
    steps:
      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
      - uses: radixdlt/public-iac-resuable-artifacts/fetch-secrets@main
        with:
          role_name: ${{ secrets.AWS_ROLE_NAME_SNYK_SECRET }}
          app_name: 'radix-dapp-toolkit'
          step_name: 'snyk-scan-code'
          secret_prefix: 'SNYK'
          secret_name: ${{ secrets.AWS_SECRET_NAME_SNYK }}
          parse_json: true
      - name: Run Snyk to check for code vulnerabilities
        uses: snyk/actions/node@b98d498629f1c368650224d6d212bf7dfa89e4bf # v0.4.0
        with:
          args: --all-projects --org=${{ env.SNYK_PROJECTS_ORG_ID }} --severity-threshold=high
          command: code test

  snyk-sbom:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      pull-requests: read
      contents: read
      deployments: write
    needs:
      - snyk-scan-deps-licences
      - snyk-scan-code
    steps:
      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
      - uses: radixdlt/public-iac-resuable-artifacts/fetch-secrets@main
        with:
          role_name: ${{ secrets.AWS_ROLE_NAME_SNYK_SECRET }}
          app_name: 'radix-dapp-toolkit'
          step_name: 'snyk-sbom'
          secret_prefix: 'SNYK'
          secret_name: ${{ secrets.AWS_SECRET_NAME_SNYK }}
          parse_json: true
      - name: Generate SBOM # check SBOM can be generated but nothing is done with it
        uses: snyk/actions/node@b98d498629f1c368650224d6d212bf7dfa89e4bf # v0.4.0
        with:
          args: --all-projects --org=${{ env.SNYK_PROJECTS_ORG_ID }} --format=cyclonedx1.4+json --json-file-output sbom.json
          command: sbom

  build:
    runs-on: ubuntu-latest
    needs:
      - snyk-scan-deps-licences
      - snyk-scan-code
    outputs:
      tag: ${{ steps.setup_tags.outputs.tag }}
    steps:
      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c
      
      - name: Setup tags for docker image
        id: setup_tags
        run: echo "tag=sha-$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
        
      - name: Use Node.js
        uses: actions/setup-node@7c29869aec4da703a571b27bcd84d4f15af0b56e
        with:
          node-version: '18.x'

      - name: Authenticate with private NPM package
        run: echo "//registry.npmjs.org/:_authToken=${{ secrets.NPMJS_TOKEN }}" > ~/.npmrc

      - name: Install dependencies
        run: npm ci

      - name: Run tests
        run: npm run test

      - name: Build
        run: npm run build

      - name: Dump context
        uses: crazy-max/ghaction-dump-context@v2

  push-docker-image:
    name: (PRIVATE) Docker AMD
    needs:
      - build
    uses: radixdlt/public-iac-resuable-artifacts/.github/workflows/docker-build.yml@main
    with:
      runs_on: ubuntu-latest
      image_registry: "docker.io"
      image_organization: "radixdlt"
      image_name: "private-radix-dapp-toolkit"
      tag: ${{ needs.build.outputs.tag }}
      tags: |
        type=semver,pattern={{version}}
      context: "./"
      dockerfile: "./Dockerfile"
      platforms: "linux/amd64"
      scan_image: true
      snyk_target_ref: ${{ github.ref_name }}

  snyk-monitor:
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop')
    needs:
      - push-docker-image
    permissions:
      id-token: write
      pull-requests: read
      contents: read
      deployments: write
    steps:
      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
      - uses: radixdlt/public-iac-resuable-artifacts/fetch-secrets@main
        with:
          role_name: ${{ secrets.AWS_ROLE_NAME_SNYK_SECRET }}
          app_name: 'radix-dapp-toolkit'
          step_name: 'snyk-monitor'
          secret_prefix: 'SNYK'
          secret_name: ${{ secrets.AWS_SECRET_NAME_SNYK }}
          parse_json: true
      - name: Enable Snyk online monitoring to check for vulnerabilities
        uses: snyk/actions/node@b98d498629f1c368650224d6d212bf7dfa89e4bf # v0.4.0
        with:
          args: --all-projects --org=${{ env.SNYK_PROJECTS_ORG_ID }} --target-reference=${{ github.ref_name }}
          command: monitor

  snyk-container-monitor:
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop')
    needs:
      - push-docker-image
    permissions:
      id-token: write
      pull-requests: read
      contents: read
      deployments: write
    steps:
      - uses: radixdlt/public-iac-resuable-artifacts/snyk-container-monitor@main
        with:
          role_name: ${{ secrets.AWS_ROLE_NAME_SNYK_SECRET }}
          app_name: 'radix-dapp-toolkit'
          step_name: 'snyk-container-monitor'
          dockerhub_secret_name: ${{ secrets.AWS_SECRET_NAME_DOCKERHUB }}
          snyk_secret_name: ${{ secrets.AWS_SECRET_NAME_SNYK }}
          parse_json: true
          snyk_org_id: ${{ secrets.SNYK_ORG_ID }}
          image: docker.io/radixdlt/private-radix-dapp-toolkit:${{ fromJSON(needs.push-docker-image.outputs.json).labels['org.opencontainers.image.version'] }}
          target_ref: ${{ github.ref_name }}

  deploy-pr:
    if: ${{ github.event_name == 'pull_request' }}
    runs-on: ubuntu-latest
    needs:
      - push-docker-image
    permissions:
      id-token: write
      contents: read
      pull-requests: read
    steps:
      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
      - uses: unfor19/install-aws-cli-action@457b7980b125044247e455d87b9a26fc2299b787
        with:
          version: 2
      - name: Setup helmfile and helm
        uses: mamezou-tech/setup-helmfile@55ae2a66c5af4883148b7a50cc6ddc9b61042184
        with:
          helm-diff-plugin-version: 'v3.1.3'
          helmfile-version: 'v0.144.0'
          helm-version: 'v3.11.0'
          install-kubectl: no
      - name: Install kubectl
        uses: azure/setup-kubectl@901a10e89ea615cf61f57ac05cecdf23e7de06d8 #v3.2
        with:
          version: 'v1.25.6'
      - name: Configure AWS credentials for deployment
        uses: aws-actions/configure-aws-credentials@bab55d3830fe69833c9fecaa51fe2c829a7508f3
        with:
          role-to-assume: ${{ secrets.DEPLOY_PR_IAM_ROLE }}
          aws-region: eu-west-2
      - name: Deploy application
        working-directory: deploy/helm
        run: |
          cat <<DOC > namespace.yaml
          apiVersion: hnc.x-k8s.io/v1alpha2
          kind: SubnamespaceAnchor
          metadata:
            name: radix-dapp-toolkit-pr-${{ github.event.number }}
            namespace: radix-dapp-toolkit-ci-pr
          DOC

          aws eks update-kubeconfig --name ${{ secrets.CLUSTER_NAME }} \
                                    --alias ${{ secrets.CLUSTER_NAME }} \
                                    --region eu-west-2

          kubectl apply -f namespace.yaml

          helmfile --environment pr --namespace radix-dapp-toolkit-pr-${{ github.event.number }} \
                   --state-values-set "ci.tag=${{ env.CI_TAG }}" \
                   --state-values-set "ci.ingressDomain=${{ env.INGRESS_DOMAIN }}" \
                   apply
        env:
          CI_TAG: ${{ fromJSON(needs.push-docker-image.outputs.json).labels['org.opencontainers.image.version'] }}
          INGRESS_DOMAIN: radix-dapp-toolkit-pr-${{ github.event.number}}.${{ secrets.INGRESS_DOMAIN }}
          HELM_GH_USER: ${{ secrets.HELM_GH_USER }}
          HELM_GH_PASS: ${{ secrets.HELM_GH_PASS }}

  deploy-dev:
    if: github.ref == 'refs/heads/develop'
    runs-on: ubuntu-latest
    needs:
      - push-docker-image
    permissions:
      id-token: write
      contents: read
      pull-requests: read
    steps:
      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
      - uses: unfor19/install-aws-cli-action@457b7980b125044247e455d87b9a26fc2299b787
        with:
          version: 2
      - name: Setup helmfile and helm
        uses: mamezou-tech/setup-helmfile@55ae2a66c5af4883148b7a50cc6ddc9b61042184
        with:
          helm-diff-plugin-version: 'v3.1.3'
          helmfile-version: 'v0.144.0'
          helm-version: 'v3.11.0'
          install-kubectl: no
      - name: Install kubectl
        uses: azure/setup-kubectl@901a10e89ea615cf61f57ac05cecdf23e7de06d8 #v3.2
        with:
          version: 'v1.25.6'
      - name: Configure AWS credentials for deployment
        uses: aws-actions/configure-aws-credentials@bab55d3830fe69833c9fecaa51fe2c829a7508f3
        with:
          role-to-assume: ${{ secrets.DEPLOY_DEV_IAM_ROLE }}
          aws-region: eu-west-2
      - name: Deploy application
        working-directory: deploy/helm
        run: |
          aws eks update-kubeconfig --name ${{ secrets.CLUSTER_NAME }} \
                                    --alias ${{ secrets.CLUSTER_NAME }} \
                                    --region eu-west-2

          helmfile --environment dev --namespace radix-dapp-toolkit-dev \
                   --state-values-set "ci.tag=${{ env.CI_TAG }}" \
                   --state-values-set "ci.ingressDomain=${{ env.INGRESS_DOMAIN }}" \
                   apply
        env:
          CI_TAG: ${{ fromJSON(needs.push-docker-image.outputs.json).labels['org.opencontainers.image.version'] }}
          INGRESS_DOMAIN: radix-dapp-toolkit-dev.${{ secrets.INGRESS_DOMAIN }}
          HELM_GH_USER: ${{ secrets.HELM_GH_USER }}
          HELM_GH_PASS: ${{ secrets.HELM_GH_PASS }}

  deploy-release:
    if: startsWith(github.ref_name,'release/')
    runs-on: ubuntu-latest
    needs:
      - push-docker-image
    permissions:
      id-token: write
      contents: read
      pull-requests: read
    steps:
      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b
      - uses: unfor19/install-aws-cli-action@457b7980b125044247e455d87b9a26fc2299b787
        with:
          version: 2
      - name: Setup helmfile and helm
        uses: mamezou-tech/setup-helmfile@55ae2a66c5af4883148b7a50cc6ddc9b61042184
        with:
          helm-diff-plugin-version: 'v3.1.3'
          helmfile-version: 'v0.144.0'
          helm-version: 'v3.11.0'
          install-kubectl: no
      - name: Install kubectl
        uses: azure/setup-kubectl@901a10e89ea615cf61f57ac05cecdf23e7de06d8 #v3.2
        with:
          version: 'v1.25.6'
      - name: Configure AWS credentials for deployment
        uses: aws-actions/configure-aws-credentials@bab55d3830fe69833c9fecaa51fe2c829a7508f3
        with:
          role-to-assume: ${{ secrets.DEPLOY_RELEASES_IAM_ROLE }}
          aws-region: eu-west-2
      - name: Deploy application
        working-directory: deploy/helm
        run: |
          aws eks update-kubeconfig --name ${{ secrets.CLUSTER_NAME }} \
                                    --alias ${{ secrets.CLUSTER_NAME }} \
                                    --region eu-west-2

          BRANCH_NAME=${{ github.ref_name }}
          NORMALIZED_BRANCH_NAME=${BRANCH_NAME/\//-}

          cat <<DOC > subns-manifest.yaml
          apiVersion: hnc.x-k8s.io/v1alpha2
          kind: SubnamespaceAnchor
          metadata:
            name: radix-dapp-toolkit-$NORMALIZED_BRANCH_NAME
            namespace: radix-dapp-toolkit-ci-releases
          DOC

          kubectl apply -f subns-manifest.yaml

          helmfile --environment dev --namespace radix-dapp-toolkit-$NORMALIZED_BRANCH_NAME \
                   --state-values-set "ci.tag=${{ env.CI_TAG }}" \
                   --state-values-set "ci.ingressDomain=radix-dapp-toolkit-${NORMALIZED_BRANCH_NAME}.${{ env.INGRESS_DOMAIN }}" \
                   apply
        env:
          CI_TAG: ${{ fromJSON(needs.push-docker-image.outputs.json).labels['org.opencontainers.image.version'] }}
          INGRESS_DOMAIN: ${{ secrets.INGRESS_DOMAIN }}
          HELM_GH_USER: ${{ secrets.HELM_GH_USER }}
          HELM_GH_PASS: ${{ secrets.HELM_GH_PASS }}