ci-main.yaml

name: "CI - Main"

on:
  push:
    branches:
      - "master"
      - "main"
env:
  TERM: 'xterm'
  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

jobs:
  node-lint:
    name: Lint Node.js
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v2

      - name: Use Node.js
        uses: actions/setup-node@v1
        with:
          node-version: '18.x'

      - name: Install dependencies
        run: npm ci

      - name: Lint Code
        run: npm run lint

  node-test:
    name: Run Test Suite
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [16.x, 18.x, 20.x] # https://nodejs.org/en/about/releases/
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v2

      - name: Use Node.js v${{ matrix.node-version }}
        uses: actions/setup-node@v2
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Run test suite
        run: npm run test

  node-audit:
    name: Critical Vulnerability Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v2

      - name: Use Node.js
        uses: actions/setup-node@v1
        with:
          node-version: '18.x'

      - name: Install dependencies
        run: npm ci

      - name: Check for critical vulnerabilities
        run: npm audit --audit-level=critical

  vuln-report:
    name: Vulnerability Report
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v2

      - name: Run Trivy vulnerability scanner in repo mode
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          ignore-unfixed: true
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH,MODERATE'

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v1
        with:
          sarif_file: 'trivy-results.sarif'
  
  helm-lint:
    name: Lint Helm chart
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v2

      - name: Lint Helm chart
        run: helm lint ./chart

  release:
    name: "Release"
    needs: [node-lint, node-test, node-audit, vuln-report, helm-lint]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout source code
        id: checkout-code
        uses: "actions/checkout@v2"
        with:
          ref: ${{ github.ref }}

      - name: Bump version and push tag
        id: bump-tag
        uses: anothrNick/github-tag-action@1.36.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_BRANCHES: "master,main"
          DEFAULT_BUMP: "patch"
          INITIAL_VERSION: "2.0.40"

      - name: Update version in version files
        id: update-version
        run: |
          # Update package.json
          npm version ${{ steps.bump-tag.outputs.new_tag }} --no-git-tag-version
          # Update Helm chart version
          sed -r -i "s/(version:[^*]|appVersion:[^*])([[:alnum:].]*.*)/\1${{ steps.bump-tag.outputs.new_tag }}/g" ./chart/Chart.yaml

      - name: Build Docker Tags
        id: docker-tags
        run: |
          CUR_BRANCH=$(git rev-parse --abbrev-ref HEAD)
          if [[ $CUR_BRANCH = "main" || $CUR_BRANCH = "master" ]]; then
              TAGS="${{ github.repository }}:${{ steps.bump-tag.outputs.new_tag }},${{ github.repository }}:latest"
          else
              TAGS="${{ github.repository }}:${{ steps.bump-tag.outputs.new_tag }},${{ github.repository }}:develop"
          fi
          echo "::set-output name=tags::${TAGS}"

      - name: Set up QEMU
        id: setup-qemu
        uses: docker/setup-qemu-action@v1

      - name: Set up Docker Buildx
        id: setup-buildx
        uses: docker/setup-buildx-action@v1

      - name: Cache Docker layers
        uses: actions/cache@v2
        with:
          path: /tmp/.buildx-cache/${{ runner.os }}-${{ steps.setup-buildx.outputs.name }}-${{ hashFiles('**/Dockerfile') }}
          key: ${{ runner.os }}-buildx-${{ steps.vars.outputs.sha_short }}-{{ hashFiles('**/Dockerfile') }}
          restore-keys: |
            ${{ runner.os }}-buildx-

      - name: Login to DockerHub
        uses: docker/login-action@v1 
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_ACCESS_TOKEN }}
        
      - name: Build & Push Base Image
        id: docker-build
        uses: docker/build-push-action@v2
        with:
          builder: ${{ steps.buildx.outputs.name }}
          context: ./
          platforms: linux/amd64,linux/arm64
          file: ./Dockerfile
          push: true
          tags: ${{ steps.docker-tags.outputs.tags }}
          cache-from: type=local,src=/tmp/.buildx-cache
          cache-to: type=local,dest=/tmp/.buildx-cache

      - name: Package and publish Helm Chart
        id: publish-helm
        run: |
          # Setup auth and workspace
          CLONE_DIR=$(mktemp -d)
          git config --global user.email "fairplay89@gmail.com"
          git config --global user.name "jonfairbanks"
          git clone "https://${{ secrets.HELM_CHARTS_PAT }}@github.com/jonfairbanks/helm-charts.git" "$CLONE_DIR"
          
          # Package chart and push commit
          helm package ./chart
          cp *.tgz "$CLONE_DIR/_releases/"
          cd "$CLONE_DIR"
          git add .
          git commit --message "Update from https://github.com/$GITHUB_REPOSITORY/commit/$GITHUB_SHA"
          git push -u origin master

      - name: Notify Slack
        uses: act10ns/slack@v1
        with:
          status: ${{ job.status }}
          steps: ${{ toJson(steps) }}
        if: always()