main.yml

name: Verify and Deploy
on:
  workflow_dispatch:
    inputs:
      release:
        description: 'Version to release'
        required: true
permissions: write-all
env:
  AWS_REGION : "eu-west-1"
  AWS_REGION_ZONE : "eu-central-1"  
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            docs.github.com:433
            api.github.com:443
            pkg-containers.githubusercontent.com:443
            ghcr.io:443
            api.hack23.com:443
            auth.docker.io:443
            cfu.zaproxy.org:443
            cloudformation.eu-central-1.amazonaws.com:443
            cloudformation.eu-west-1.amazonaws.com:443
            files.pythonhosted.org:443
            github.com:443
            news.zaproxy.org:443
            objects.githubusercontent.com:443
            production.cloudflare.docker.com:443
            pypi.org:443
            raw.githubusercontent.com:443
            registry-1.docker.io:443
            sts.eu-central-1.amazonaws.com:443
            sts.eu-west-1.amazonaws.com:443
            tel.zaproxy.org:443
            www.bridgecrew.cloud:443
            api.snapcraft.io:443
      - name: Checkout
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      
      - name: Cache APT packages
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
        with:
          path: |
            /var/cache/apt/archives
            /var/lib/apt/lists
          key: ${{ runner.os }}-apt-${{ hashFiles('.github/workflows/main.yml') }}
          restore-keys: |
            ${{ runner.os }}-apt-
      
      - name: Setup Python
        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
        with:
          python-version: '3.12'
      
      - name: Cache Python dependencies
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
        with:
          path: |
            ~/.cache/pip
            ~/.local/lib/python3.12/site-packages
          key: ${{ runner.os }}-pip-cfn-lint-checkov-${{ hashFiles('.github/workflows/main.yml') }}
          restore-keys: |
            ${{ runner.os }}-pip-cfn-lint-checkov-
            ${{ runner.os }}-pip-
      
      - name: Setup Ruby
        uses: ruby/setup-ruby@d5f787ce339eb0767271bc01d922e85644c2c8ab # v1.280.0
        with:
          ruby-version: '3.3'
      
      - name: Cache Ruby gems
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
        with:
          path: vendor/bundle
          key: ${{ runner.os }}-gems-cfn-nag-${{ hashFiles('.github/workflows/main.yml') }}
          restore-keys: |
            ${{ runner.os }}-gems-cfn-nag-
            ${{ runner.os }}-gems-
      
      - name: Testing with CFN Lint Command
        uses: scottbrenner/cfn-lint-action@25ee47d1ab3146bda904df745511735cc0b9a970 # v2.5.2
        with:
          command: cfn-lint -t cloudformation/template.yml
      - name: Testing route53 with CFN Lint
        uses: scottbrenner/cfn-lint-action@25ee47d1ab3146bda904df745511735cc0b9a970 # v2.5.2
        with:
          command: cfn-lint -t cloudformation/route53.yml
      - name: Testing disaster-recovery with CFN Lint
        uses: scottbrenner/cfn-lint-action@25ee47d1ab3146bda904df745511735cc0b9a970 # v2.5.2
        with:
          command: cfn-lint -t cloudformation/disaster-recovery.yml
      - name: Run cfn-nag
        uses: stelligent/cfn_nag@8b5f03da74202ba323a145e9d037ddce6cab9dec # master
        with:
          input_path: cloudformation
      - name: Testing app with CFN Lint
        uses: scottbrenner/cfn-lint-action@25ee47d1ab3146bda904df745511735cc0b9a970 # v2.5.2
        with:
          command: cfn-lint -t cloudformation/app.yml
      - name: Run cfn-nag
        uses: stelligent/cfn_nag@8b5f03da74202ba323a145e9d037ddce6cab9dec # master
        with:
          input_path: cloudformation
      - name: Run Checkov action
        id: checkov
        uses: bridgecrewio/checkov-action@8f61ce5b8a3afb4ca94d236b75201878ded6d2cd # master
        with:
          file: cloudformation/template.yml
          skip_check: CKV_AWS_59,CKV_AWS_120,CKV2_AWS_71
          framework: cloudformation
          output_format: sarif
          output_file_path: reports/results.sarif 
          download_external_modules: true
      - name: configure aws credentials
        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1
        with:
          role-to-assume: arn:aws:iam::172017021075:role/GithubWorkFlowRole
          role-session-name: githubworkflowrolesessiont2
          aws-region: ${{ env.AWS_REGION }}
      - name: Deploy to AWS CloudFormation Irland
        uses: aws-actions/aws-cloudformation-github-deploy@33527b83bddcf6b3f0b135d9550bde8475325c73 # v1
        with:
          name: lambda-vpc
          template: cloudformation/template.yml
          capabilities: CAPABILITY_NAMED_IAM
          no-fail-on-empty-changeset: "1"
          parameter-overrides: "DomainNamePrefix=api"
      - name: Get Output Irland
        run: |
            GlobalTableZoneFrankfurt=`aws cloudformation describe-stacks --stack-name lambda-vpc --query "Stacks[0].Outputs[?OutputKey == 'GlobalTableZoneFrankfurt'].OutputValue" | grep arn | xargs`
            echo "GlobalTableZoneFrankfurt=$GlobalTableZoneFrankfurt"  >> $GITHUB_ENV
            HealthCheckId=`aws cloudformation describe-stacks --stack-name lambda-vpc --query "Stacks[0].Outputs[?OutputKey == 'HealthCheckId'].OutputValue" | grep -v '\[' | grep -v '\]' | xargs`
            echo "HealthCheckId=$HealthCheckId"  >> $GITHUB_ENV
            AliasTargetHostedZoneId=`aws cloudformation describe-stacks --stack-name lambda-vpc --query "Stacks[0].Outputs[?OutputKey == 'AliasTargetHostedZoneId'].OutputValue" | grep -v '\[' | grep -v '\]' | xargs`
            echo "AliasTargetHostedZoneId=$AliasTargetHostedZoneId"  >> $GITHUB_ENV 
            AliasTargetDNSName=`aws cloudformation describe-stacks --stack-name lambda-vpc --query "Stacks[0].Outputs[?OutputKey == 'AliasTargetDNSName'].OutputValue" | grep aws | xargs`
            echo "AliasTargetDNSName=$AliasTargetDNSName"  >> $GITHUB_ENV
            StackId=`aws cloudformation describe-stacks --stack-name lambda-vpc --query "Stacks[0].Outputs[?OutputKey == 'StackId'].OutputValue" | grep aws | xargs`
            echo "StackId=$StackId"  >> $GITHUB_ENV
      - name: Show Output Irland
        run: |
            echo "${{ env.GlobalTableZoneFrankfurt }}"
            echo "${{ env.HealthCheckId }}"
            echo "${{ env.AliasTargetHostedZoneId }}"
            echo "${{ env.AliasTargetDNSName }}"            
      - name: configure aws credentials Frankfurt region
        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1
        with:
          role-to-assume: arn:aws:iam::172017021075:role/GithubWorkFlowRole
          role-session-name: githubworkflowrolesessiont2
          aws-region: ${{ env.AWS_REGION_ZONE }}

      - name: Deploy to AWS CloudFormation Frankfurt
        uses: aws-actions/aws-cloudformation-github-deploy@33527b83bddcf6b3f0b135d9550bde8475325c73 # v1
        with:
          name: lambda-vpc
          template: cloudformation/template.yml
          capabilities: CAPABILITY_NAMED_IAM
          no-fail-on-empty-changeset: "1"
          parameter-overrides: "VpcCidrPrefix=10.5,DomainNamePrefix=api,GlobalTableArn=${{ env.GlobalTableZoneFrankfurt }}"
      - name: Get Output Frankfurt
        run: |
            HealthCheckId=`aws cloudformation describe-stacks --stack-name lambda-vpc --query "Stacks[0].Outputs[?OutputKey == 'HealthCheckId'].OutputValue" | grep -v '\[' | grep -v '\]' | xargs`
            echo "HealthCheckId2=$HealthCheckId"  >> $GITHUB_ENV
            AliasTargetHostedZoneId=`aws cloudformation describe-stacks --stack-name lambda-vpc --query "Stacks[0].Outputs[?OutputKey == 'AliasTargetHostedZoneId'].OutputValue" | grep -v '\[' | grep -v '\]' | xargs`
            echo "AliasTargetHostedZoneId2=$AliasTargetHostedZoneId"  >> $GITHUB_ENV
            AliasTargetDNSName=`aws cloudformation describe-stacks --stack-name lambda-vpc --query "Stacks[0].Outputs[?OutputKey == 'AliasTargetDNSName'].OutputValue" | grep aws | xargs`
            echo "AliasTargetDNSName2=$AliasTargetDNSName"  >> $GITHUB_ENV
            ApiRoleName=`aws cloudformation describe-stacks --stack-name lambda-vpc --query "Stacks[0].Outputs[?OutputKey == 'ApiRoleName'].OutputValue" | grep -v '\[' | grep -v '\]' | xargs`
            echo "ApiRoleName=$ApiRoleName"  >> $GITHUB_ENV
            StackId=`aws cloudformation describe-stacks --stack-name lambda-vpc --query "Stacks[0].Outputs[?OutputKey == 'StackId'].OutputValue" | grep aws | xargs`
            echo "StackId2=$StackId"  >> $GITHUB_ENV
      - name: Show Output Irland
        run: |
            echo "${{ env.HealthCheckId }}"
            echo "${{ env.AliasTargetHostedZoneId }}"
            echo "${{ env.AliasTargetDNSName }}"            
      - name: Deploy to AWS CloudFormation Route53
        uses: aws-actions/aws-cloudformation-github-deploy@33527b83bddcf6b3f0b135d9550bde8475325c73 # v1
        with:
          name: lambda-vpc-route53
          template: cloudformation/route53.yml
          capabilities: CAPABILITY_NAMED_IAM
          no-fail-on-empty-changeset: "1"
          parameter-overrides: "DomainNamePrefix=api,HealthCheckId=${{ env.HealthCheckId }},RestApiDomainNameRegionalHostedZoneId=${{ env.AliasTargetHostedZoneId }},RestApiDomainNameRegionalDomainName=${{ env.AliasTargetDNSName }},HealthCheckId2=${{ env.HealthCheckId2 }},RestApiDomainNameRegionalHostedZoneId2=${{ env.AliasTargetHostedZoneId2 }},RestApiDomainNameRegionalDomainName2=${{ env.AliasTargetDNSName2 }}"          
      - name: Deploy to AWS CloudFormation Disaster Recovery
        uses: aws-actions/aws-cloudformation-github-deploy@33527b83bddcf6b3f0b135d9550bde8475325c73 # v1
        with:
          name: lambda-vpc-disaster-recovery
          template: cloudformation/disaster-recovery.yml
          capabilities: CAPABILITY_NAMED_IAM
          no-fail-on-empty-changeset: "1"
          parameter-overrides: "ApiRole=${{ env.ApiRoleName }}"
      - name: Deploy to AWS CloudFormation Resilience hub App and Policy
        uses: aws-actions/aws-cloudformation-github-deploy@33527b83bddcf6b3f0b135d9550bde8475325c73 # v1
        with:
          name: lambda-vpc-resiliencehub-app
          template: cloudformation/app.yml
          capabilities: CAPABILITY_NAMED_IAM
          no-fail-on-empty-changeset: "1"
          parameter-overrides: "StackIrland=${{ env.StackId }},StackFrankfurt=${{ env.StackId2 }}"
      
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
      
      - name: Cache Docker layers
        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
        with:
          path: /tmp/.buildx-cache
          key: ${{ runner.os }}-docker-zap-${{ hashFiles('.github/workflows/main.yml') }}
          restore-keys: |
            ${{ runner.os }}-docker-zap-
            ${{ runner.os }}-docker-
      
      - name: ZAP API Scan
        uses: zaproxy/action-api-scan@5158fe4d9d8fcc75ea204db81317cce7f9e5453d # v0.10.0
        with:
          docker_name: "ghcr.io/zaproxy/zaproxy:stable"
          target: 'https://api.hack23.com/v1/healthcheck'
      - name: Bump version and push tag
        id: tag_version
        uses: mathieudutour/github-tag-action@a22cf08638b34d5badda920f9daf6e72c477b07b # v6.2
        with:
          github_token: ${{ github.token }}
      - name: Create a GitHub release
        uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b # v1.20.0
        with:
          tag: ${{ steps.tag_version.outputs.new_tag }}
          name: Release ${{ steps.tag_version.outputs.new_tag }}
          body: ${{ steps.tag_version.outputs.changelog }}
          generateReleaseNotes: false
          immutableCreate: true