merge.yml

name: Merge

on:
  push:
    branches: [main]
    paths-ignore:
      - ".github/ISSUE_TEMPLATE/*"
      - "**.md"
  workflow_dispatch:

concurrency:
  group: test-prod
  cancel-in-progress: false

jobs:
  vars:
    name: Set Variables
    outputs:
      pr: ${{ steps.pr.outputs.pr }}
    runs-on: ubuntu-22.04
    timeout-minutes: 1
    steps:
      # Get PR number for squash merges to main
      - name: PR Number
        id: pr
        uses: bcgov-nr/action-get-pr@v0.0.1

  deploy-test:
    name: Deploy (test)
    uses: bcgov/quickstart-openshift-helpers/.github/workflows/.deployer.yml@v0.8.3
    secrets:
      oc_namespace: ${{ secrets.OC_NAMESPACE }}
      oc_token: ${{ secrets.OC_TOKEN }}
    with:
      environment: test
      params: --set global.autoscaling=true --set rctool.pdb.enabled=true --set frontend.pdb.enabled=true



  zap_scan:
    runs-on: ubuntu-22.04
    needs: [deploy-test, vars]
    name: Penetration Tests
    env:
      URL: ${{ github.event.repository.name }}-test-frontend.apps.silver.devops.gov.bc.ca
    steps:
      - name: ZAP Scan
        uses: zaproxy/action-full-scan@v0.12.0
        with:
          allow_issue_writing: true
          artifact_name: "zap_rctool"
          cmd_options: "-a"
          issue_title: "ZAP: rctool"
          target: https://${{ env.URL }}
  promotions:
    name: Promote Images
    needs: [deploy-test, vars]
    permissions:
      packages: write
    runs-on: ubuntu-22.04
    strategy:
      matrix:
        package: [frontend, rctool]
    timeout-minutes: 1
    steps:
      - uses: shrink/actions-docker-registry-tag@v4
        with:
          registry: ghcr.io
          repository: ${{ github.repository }}/${{ matrix.package }}
          tags: test
          target: ${{ needs.vars.outputs.pr }}