docker.yml

name: CI
on:
  push:
    branches:
      - main
    paths:
      - "Dockerfile"
      - "app/**"
      - ".github/workflows/docker.yml"
  pull_request:
    branches:
      - main
    paths:
      - "Dockerfile"
      - "app/**"
      - ".github/workflows/docker.yml"
  workflow_dispatch:

env:
  REGISTRY: docker.io
  OWNER: ${{ github.repository_owner }}

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - name: Check out repository code
      uses: actions/checkout@v4
    - name: Set Tag Names
      run: |
        echo "TAG=${{ github.head_ref || github.ref_name }}" >> $GITHUB_ENV
        echo "DATE=v$(echo `date +'%Y.%m'`)" >> $GITHUB_ENV
        echo "REPO_NAME=$(echo ${PWD##*/})" >> $GITHUB_ENV
    - name: Login to DockerHub
      uses: docker/login-action@v3
      if: success()
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ secrets.DOCKER_USERNAME }}
        password: ${{ secrets.DOCKER_PASSWORD }}
    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3
      with:
        platforms: all
    - name: Set up Docker Buildx
      id: buildx
      if: success()
      uses: docker/setup-buildx-action@v3
      env:
        DOCKER_BUILDKIT: 1
    - name: Build and push Docker image - (MAIN)
      uses: docker/build-push-action@v5
      if: success()
      env:
        DOCKER_BUILDKIT: 1
      with:
        context: .
        file: ./Dockerfile
        platforms: linux/amd64,linux/arm64
        build-args: |
          BUILD_ID=${{ env.DATE }}
        pull: true
        push: true
        tags: ${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_NAME }}:${{ env.TAG == 'main' && 'latest' || env.TAG }}
    - name: Build and push Docker image - (DATE)
      uses: docker/build-push-action@v5
      if: ${{ github.event_name == 'schedule' || contains(github.ref, 'main') }}
      env:
        DOCKER_BUILDKIT: 1
      with:
        context: .
        file: ./Dockerfile
        platforms:  linux/amd64,linux/arm64
        build-args: |
          BUILD_ID=${{ env.DATE }}
        pull: true
        push: true
        tags: ${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_NAME }}:${{ env.DATE }}

    - name: Run Trivy vulnerability scanner - (Server)
      uses: aquasecurity/trivy-action@master
      if: success()
      with:
        image-ref: ${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_NAME }}:${{ env.TAG == 'main' && 'latest' || env.TAG }}
        format: 'template'
        template: '@/contrib/sarif.tpl'
        output: 'trivy-results.sarif'
    - name: Upload Trivy scan results to GitHub Security tab - Server
      uses: github/codeql-action/upload-sarif@v3
      if: success()
      with:
        sarif_file: 'trivy-results.sarif'

  k8s-test:
    runs-on: ubuntu-latest
    needs: [build]
    if: ${{ ! contains(github.ref, 'main') }}
    steps:
      - name: Create k8s Kind Cluster
        uses: helm/kind-action@v1.8.0
      - name: Checkout
        uses: actions/checkout@v4
      - name: Run K8s test
        run: |
          kubectl cluster-info
          export NS=`cat deployment/kustomization.yml  | grep namespace | awk '{ print $2 }'`
          if [ -z "$NS" ]; then
            export NS='web'
          fi
          kubectl create namespace $NS
          kubectl kustomize deployment/ | kubectl apply -f -
          kubectl get all -A

  auto-approve:
    runs-on: ubuntu-latest
    needs: [build, k8s-test]
    if: ${{ github.event_name == 'pull_request' }}
    steps:
    - name: Auto Approve PR
      uses: actions/github-script@v7
      with:
       script: |
        github.rest.pulls.createReview({
          owner: context.repo.owner,
          repo: context.repo.repo,
          pull_number: context.issue.number,
          event: "APPROVE"
        })

  auto-preview:
    runs-on: ubuntu-latest
    needs: [auto-approve]
    if: ${{ github.event_name == 'pull_request' }}
    steps:
    - name: Add Preview Label
      uses: actions/github-script@v7
      with:
        script: |
          github.rest.issues.addLabels({
            issue_number: context.issue.number,
            owner: context.repo.owner,
            repo: context.repo.repo,
            labels: ['preview']
          })