dev.yml

# This is a basic workflow to help you get started with Actions

name: Build
permissions:
  contents: read
  packages: write

# Controls when the action will run. Triggers the workflow on push or pull request
# events but only for the master branch
on:
  push:
    branches: [dev, feature/*, fix/*, renovate/*]

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  # This workflow contains a single job called "build"
  sonar-scan:
    # The type of runner that the job will run on
    runs-on: ubuntu-latest

    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
      - uses: actions/checkout@v4
        with:
          fetch-depth: 2 
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
      - name: Install deps
        run: |
          sudo apt update
          sudo apt install -y pipx git
          pipx ensurepath
          pipx install poetry

      - name: Test coverage for Gateway API
        run: |
          export PATH=/root/.local/bin:$PATH
          cd microservices/gatewayApi
          poetry env use 3.11
          poetry install --no-root --no-cache
          ENV=test GITHASH=11223344 \
          poetry run coverage run --branch -m pytest -s -v
          poetry run coverage xml

      - name: Test coverage for Scheduler API
        run: |
          export PATH=/root/.local/bin:$PATH
          cd microservices/gatewayJobScheduler
          poetry install --no-root
          SYNC_INTERVAL=1000 \
          DATA_PLANE=test-dp \
          poetry run coverage run --branch -m pytest -s -v
          poetry run coverage xml

      - name: Test coverage for Kube API
        run: |
          export PATH=/root/.local/bin:$PATH
          cd microservices/kubeApi
          poetry install --no-root
          ACCESS_USER=kubeuser ACCESS_SECRET=s3cret \
          poetry run coverage run --branch -m pytest -s -v
          poetry run coverage xml

      - name: Test coverage for Compatibility API
        run: |
          export PATH=/root/.local/bin:$PATH
          cd microservices/compatibilityApi
          poetry install --no-root
          poetry run coverage run --branch -m pytest -s -v
          poetry run coverage xml

      - uses: actions/setup-python@v6
        with:
          python-version: "3.14"
      - name: Test coverage for CSIT OAS Validation API
        run: |
          export PATH=/root/.local/bin:$PATH
          sudo apt install -y nodejs npm
          sudo npm install -g @stoplight/spectral-cli@6.14.2
          cd microservices/csitOasValidationApi
          poetry env use python3.14
          poetry install --no-root
          ./checkout-ruleset-tags.sh ruleset_tag_cache || true
          export GITHUB_TAG_CACHE_PATH="$(realpath -m ./ruleset_tag_cache)"
          poetry run coverage run --branch -m pytest -s -v
          poetry run coverage xml

      - name: SonarCloud Scan
        uses: sonarsource/sonarqube-scan-action@master
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  gwa-api:
    needs: sonar-scan
    name: Docker Image for gwa-api
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 2 
      - name: Check if build needed
        id: check
        run: |
          if git diff --name-only HEAD^ HEAD | grep -q "^microservices/gatewayApi/\|^.github/workflows/dev.yml"; then
            echo "build_needed=true" >> $GITHUB_OUTPUT
          else
            echo "build_needed=false" >> $GITHUB_OUTPUT
          fi
      - name: Skip message
        if: steps.check.outputs.build_needed == 'false'
        run: echo "No changes in gatewayApi, skipping build"
      - name: Sanitize tag name
        if: steps.check.outputs.build_needed == 'true'
        id: tag
        run: echo "tag=$(echo '${{ github.ref_name }}' | tr '/' '-')" >> $GITHUB_OUTPUT
      - name: Set up Docker Buildx
        if: steps.check.outputs.build_needed == 'true'
        uses: docker/setup-buildx-action@v3
      - name: Log in to GitHub Container Registry
        if: steps.check.outputs.build_needed == 'true'
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
          logout: false
      - uses: docker/build-push-action@v5
        if: steps.check.outputs.build_needed == 'true'
        with:
          context: microservices/gatewayApi
          file: microservices/gatewayApi/Dockerfile
          push: true
          tags: ghcr.io/bcgov/gwa-api/gwa-gateway-api:${{ steps.tag.outputs.tag }}
          labels: |
            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}

  gwa-scheduler:
    needs: sonar-scan
    name: Docker Image for gwa-scheduler
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 2 
      - name: Check if build needed
        id: check
        run: |
          if git diff --name-only HEAD^ HEAD | grep -q "^microservices/gatewayJobScheduler/\|^.github/workflows/dev.yml"; then
            echo "build_needed=true" >> $GITHUB_OUTPUT
          else
            echo "build_needed=false" >> $GITHUB_OUTPUT
          fi
      - name: Skip message
        if: steps.check.outputs.build_needed == 'false'
        run: echo "No changes in gatewayJobScheduler, skipping build"
      - name: Sanitize tag name
        if: steps.check.outputs.build_needed == 'true'
        id: tag
        run: echo "tag=$(echo '${{ github.ref_name }}' | tr '/' '-')" >> $GITHUB_OUTPUT
      - name: Set up Docker Buildx
        if: steps.check.outputs.build_needed == 'true'
        uses: docker/setup-buildx-action@v3
      - name: Log in to GitHub Container Registry
        if: steps.check.outputs.build_needed == 'true'
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
          logout: false
      - uses: docker/build-push-action@v5
        if: steps.check.outputs.build_needed == 'true'
        with:
          context: microservices/gatewayJobScheduler
          file: microservices/gatewayJobScheduler/Dockerfile
          push: true
          tags: ghcr.io/bcgov/gwa-api/gwa-scheduler:${{ steps.tag.outputs.tag }}
          labels: |
            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}

  gwa-kube-api:
    needs: sonar-scan
    name: Docker Image for gwa-kube-api
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 2 
      - name: Check if build needed
        id: check
        run: |
          if git diff --name-only HEAD^ HEAD | grep -q "^microservices/kubeApi/\|^.github/workflows/dev.yml"; then
            echo "build_needed=true" >> $GITHUB_OUTPUT
          else
            echo "build_needed=false" >> $GITHUB_OUTPUT
          fi
      - name: Skip message
        if: steps.check.outputs.build_needed == 'false'
        run: echo "No changes in kubeApi, skipping build"
      - name: Sanitize tag name
        if: steps.check.outputs.build_needed == 'true'
        id: tag
        run: echo "tag=$(echo '${{ github.ref_name }}' | tr '/' '-')" >> $GITHUB_OUTPUT
      - name: Set up Docker Buildx
        if: steps.check.outputs.build_needed == 'true'
        uses: docker/setup-buildx-action@v3
      - name: Log in to GitHub Container Registry
        if: steps.check.outputs.build_needed == 'true'
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
          logout: false
      - uses: docker/build-push-action@v5
        if: steps.check.outputs.build_needed == 'true'
        with:
          context: microservices/kubeApi
          file: microservices/kubeApi/Dockerfile
          push: true
          tags: ghcr.io/bcgov/gwa-api/gwa-kube-api:${{ steps.tag.outputs.tag }}
          labels: |
            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}

  gwa-compatibility-api:
    needs: sonar-scan
    name: Docker Image for gwa-compatibility-api
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 2 
      - name: Check if build needed
        id: check
        run: |
          if git diff --name-only HEAD^ HEAD | grep -q "^microservices/compatibilityApi/\|^.github/workflows/dev.yml"; then
            echo "build_needed=true" >> $GITHUB_OUTPUT
          else
            echo "build_needed=false" >> $GITHUB_OUTPUT
          fi
      - name: Skip message
        if: steps.check.outputs.build_needed == 'false'
        run: echo "No changes in compatibilityApi, skipping build"
      - name: Sanitize tag name
        if: steps.check.outputs.build_needed == 'true'
        id: tag
        run: echo "tag=$(echo '${{ github.ref_name }}' | tr '/' '-')" >> $GITHUB_OUTPUT
      - name: Set up Docker Buildx
        if: steps.check.outputs.build_needed == 'true'
        uses: docker/setup-buildx-action@v3
      - name: Log in to GitHub Container Registry
        if: steps.check.outputs.build_needed == 'true'
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
          logout: false
      - uses: docker/build-push-action@v5
        if: steps.check.outputs.build_needed == 'true'
        with:
          context: microservices/compatibilityApi
          file: microservices/compatibilityApi/Dockerfile
          push: true
          tags: ghcr.io/bcgov/gwa-api/gwa-compatibility-api:${{ steps.tag.outputs.tag }}
          labels: |
            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}

  gwa-csit-oas-validation-api:
    needs: sonar-scan
    name: Docker Image for gwa-csit-oas-validation-api
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 2 
      - name: Check if build needed
        id: check
        run: |
          if git diff --name-only HEAD^ HEAD | grep -q "^microservices/csitOasValidationApi/\|^.github/workflows/dev.yml"; then
            echo "build_needed=true" >> $GITHUB_OUTPUT
          else
            echo "build_needed=false" >> $GITHUB_OUTPUT
          fi
      - name: Skip message
        if: steps.check.outputs.build_needed == 'false'
        run: echo "No changes in csitOasValidationApi, skipping build"
      - name: Sanitize tag name
        if: steps.check.outputs.build_needed == 'true'
        id: tag
        run: echo "tag=$(echo '${{ github.ref_name }}' | tr '/' '-')" >> $GITHUB_OUTPUT
      - name: Set up Docker Buildx
        if: steps.check.outputs.build_needed == 'true'
        uses: docker/setup-buildx-action@v3
      - name: Log in to GitHub Container Registry
        if: steps.check.outputs.build_needed == 'true'
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
          logout: false
      - uses: docker/build-push-action@v5
        if: steps.check.outputs.build_needed == 'true'
        with:
          context: microservices/csitOasValidationApi
          file: microservices/csitOasValidationApi/Dockerfile
          push: true
          tags: ghcr.io/bcgov/gwa-api/gwa-csit-oas-validation-api:${{ steps.tag.outputs.tag }}
          labels: |
            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}