publish-azure-cc-enclave-docker.yaml

name: Publish Azure CC Operator
run-name: ${{ format('Publish {0} Azure CC Operator', inputs.release_type) }}
on:
  workflow_dispatch:
    inputs:
      release_type:
        type: choice
        description: The type of release
        options:
        - Snapshot
        - Patch
        - Minor
        - Major
      version_number_input:
        description: If set, the version number will not be incremented and the given number will be used.
        type: string
        default: ''
      vulnerability_severity:
        description: The severity to fail the workflow if such vulnerability is detected. DO NOT override it unless a Jira ticket is raised.
        type: choice
        options:
        - CRITICAL,HIGH
        - CRITICAL,HIGH,MEDIUM
        - CRITICAL (DO NOT use if JIRA ticket not raised)

  workflow_call:
    inputs:
      release_type:
        description: The type of version number to return. Must be one of [Snapshot, Patch, Minor or Major]
        required: true
        type: string
      version_number_input:
        description: If set, the version number will not be incremented and the given number will be used.
        type: string
        default: ''
      commit_sha:
        description: The commit SHA for committing the new version for pom.xml.
        type: string
        default: ''
      vulnerability_severity:
        description: The severity to fail the workflow if such vulnerability is detected. DO NOT override it unless a Jira ticket is raised. Must be one of ['CRITICAL', 'CRITICAL,HIGH' or 'CRITICAL,HIGH,MEDIUM'] (without space in between).
        type: string
        default: 'CRITICAL,HIGH'

    outputs:
      image_tag:
        description: The tag used to describe the image in Docker
        value: ${{ jobs.buildImage.outputs.image_tag }}

env:
  REGISTRY: ghcr.io
  MAVEN_PROFILE: azure
  ENCLAVE_PROTOCOL: azure-cc
  IMAGE_NAME: ${{ github.repository }}
  DOCKER_CONTEXT_PATH: scripts/azure-cc
  ARTIFACTS_OUTPUT_DIR: ${{ github.workspace }}/deployment-artifacts
  MANIFEST_OUTPUT_DIR: ${{ github.workspace }}/manifest

jobs:
  buildImage:
    name: Build Image
    runs-on: ubuntu-latest
    permissions:
      contents: write
      security-events: write
      packages: write
      id-token: write
      pull-requests: write
    outputs:
      jar_version: ${{ steps.update_version.outputs.new_version }}
      image_tag: ${{ steps.update_version.outputs.image_tag }}
      is_release: ${{ steps.update_version.outputs.is_release }}
      docker_version: ${{ steps.meta.outputs.version }}
      tags: ${{ steps.meta.outputs.tags }}
    steps:
      - name: Update Operator Version
        id: update_version
        uses: IABTechLab/uid2-operator/.github/actions/update_operator_version@main
        with:
          release_type: ${{ inputs.release_type }}
          version_number_input: ${{ inputs.version_number_input }}
          image_tag_suffix: ${{ env.ENCLAVE_PROTOCOL }}
          commit_sha: ${{ inputs.commit_sha }}

      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '21'

      - name: Package JAR
        id: package
        run: |
          mvn -B package -P ${{ env.MAVEN_PROFILE }} 
          echo "jar_version=$(mvn help:evaluate -Dexpression=project.version | grep -e '^[1-9][^\[]')" >> $GITHUB_OUTPUT
          echo "git_commit=$(git show --format="%h" --no-patch)" >> $GITHUB_OUTPUT
          cp -r target ${{ env.DOCKER_CONTEXT_PATH }}/
          cp scripts/confidential_compute.py ${{ env.DOCKER_CONTEXT_PATH }}/

      - name: Log in to the Docker container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=raw,value=${{ steps.update_version.outputs.image_tag }}

      - name: Build and export to Docker
        uses: docker/build-push-action@v5
        with:
          context: ${{ env.DOCKER_CONTEXT_PATH }}
          load: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            JAR_VERSION=${{ steps.update_version.outputs.new_version }}
            IMAGE_VERSION=${{ steps.update_version.outputs.new_version }}
            BUILD_TARGET=${{ env.ENCLAVE_PROTOCOL }}

      - name: Generate Trivy vulnerability scan report
        uses: aquasecurity/trivy-action@0.14.0
        with:
          image-ref: ${{ steps.meta.outputs.tags }}
          format: 'sarif'
          exit-code: '0'
          ignore-unfixed: true
          severity: 'CRITICAL,HIGH'
          output: 'trivy-results.sarif'
          hide-progress: true

      - name: Upload Trivy scan report to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'

      - name: Test with Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@0.14.0
        with:
          image-ref: ${{ steps.meta.outputs.tags }}
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          severity: ${{ inputs.vulnerability_severity }}
          hide-progress: true

      - name: Push to Docker
        id: push-to-docker
        uses: docker/build-push-action@v5
        with:
          context: ${{ env.DOCKER_CONTEXT_PATH }}
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            JAR_VERSION=${{ steps.update_version.outputs.new_version }}
            IMAGE_VERSION=${{ steps.update_version.outputs.new_version }}

  azureCc:
    name: Create Azure CC artifacts
    runs-on: ubuntu-latest
    permissions: {}
    needs: buildImage
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Azure CLI
        uses: ./.github/actions/install_az_cli

      - name: check azure-cli version
        run: |
          az --version

      - name: Generate Azure deployment artifacts
        env:
          IMAGE: ${{ needs.buildImage.outputs.tags }}
          OUTPUT_DIR: ${{ env.ARTIFACTS_OUTPUT_DIR }}
          MANIFEST_DIR: ${{ env.MANIFEST_OUTPUT_DIR }}
          VERSION_NUMBER: ${{ needs.buildImage.outputs.jar_version }}
        run: |
          bash ./scripts/azure-cc/deployment/generate-deployment-artifacts.sh

      - name: Upload deployment artifacts
        uses: actions/upload-artifact@v4
        with:
          name: azure-cc-deployment-files-${{ needs.buildImage.outputs.jar_version }}
          path: ${{ env.ARTIFACTS_OUTPUT_DIR }}
          if-no-files-found: error

      - name: Upload manifest
        uses: actions/upload-artifact@v4
        with:
          name: azure-cc-enclave-id-${{ needs.buildImage.outputs.jar_version }}
          path: ${{ env.MANIFEST_OUTPUT_DIR }}
          if-no-files-found: error

  e2eAzureCc:
    name: E2E Azure CC
    uses: ./.github/workflows/run-e2e-tests-on-operator.yaml
    needs: [buildImage, azureCc]
    with:
      operator_type: azure
      operator_image_version: ${{ needs.buildImage.outputs.image_tag }}
    secrets: inherit

  azureAks:
    name: Create Azure AKS artifacts
    runs-on: ubuntu-latest
    permissions: {}
    needs: buildImage
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Azure CLI
        uses: ./.github/actions/install_az_cli

      - name: check azure-cli version
        run: |
          az --version

      - name: Generate Azure deployment artifacts
        env:
          IMAGE: ${{ needs.buildImage.outputs.tags }}
          OUTPUT_DIR: ${{ env.ARTIFACTS_OUTPUT_DIR }}
          MANIFEST_DIR: ${{ env.MANIFEST_OUTPUT_DIR }}
          VERSION_NUMBER: ${{ needs.buildImage.outputs.jar_version }}
        run: |
          bash ./scripts/azure-aks/deployment/generate-deployment-artifacts.sh

      - name: Upload deployment artifacts
        uses: actions/upload-artifact@v4
        with:
          name: azure-aks-deployment-files-${{ needs.buildImage.outputs.jar_version }}
          path: ${{ env.ARTIFACTS_OUTPUT_DIR }}
          if-no-files-found: error

      - name: Upload manifest
        uses: actions/upload-artifact@v4
        with:
          name: azure-aks-enclave-id-${{ needs.buildImage.outputs.jar_version }}
          path: ${{ env.MANIFEST_OUTPUT_DIR }}
          if-no-files-found: error

  e2eAzureAks:
    name: E2E Azure AKS
    uses: ./.github/workflows/run-e2e-tests-on-operator.yaml
    needs: [buildImage, azureAks]
    with:
      operator_type: aks
      operator_image_version: ${{ needs.buildImage.outputs.image_tag }}
    secrets: inherit