ci.yml

---
name: CI
on: push
# on:
#   push:
#     branches: [main]
#   pull_request:
#     branches: [main]
#     types: [labeled, synchronize, reopened, unlabeled]
env:
  # IMAGE_NAME: ${{ github.repository }}
  IMAGE_NAME: absinthe-app
  IMAGE_OWNER: ${{ github.repository_owner }}
  AWS_ROLE_TO_ASSUME: arn:aws:iam::770916339360:role/absinthe-dev-ecr-github-action-role
  AWS_REGION: ap-northeast-1
  DOCKER_BUILDKIT: '1'
  COMPOSE_DOCKER_CLI_BUILD: '1'
jobs:
  build-test:
    name: Build test image
    runs-on: ubuntu-latest
    permissions:
      # Push to ghcr.io repository
      packages: write
    steps:
      - name: Log in to GHCR
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # https://github.com/marketplace/actions/docker-login
      - name: Log in to Docker Hub
        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Check out source
        uses: actions/checkout@v2

      - name: Set variables
        id: vars
        run: |
          echo "GITHUB_SHA_SHORT=$(echo $GITHUB_SHA | cut -c 1-7)" >> $GITHUB_ENV
          echo "::set-output name=run_id::${GITHUB_RUN_ID}"
          echo "::set-output name=run_num::${GITHUB_RUN_NUMBER}"

      - name: Get branch name for push
        if: github.event_name != 'pull_request'
        run: |
          echo "BRANCH=$(echo ${GITHUB_REF#refs/heads/})" >> $GITHUB_ENV

      - name: Get branch name for pull_request
        if: github.event_name == 'pull_request'
        run: |
          echo "BRANCH=$(echo $GITHUB_HEAD_REF | tr '//\\' '.' | cut -c -55)" >> $GITHUB_ENV

      # - name: Set up QEMU for multi-platform builds
      #   id: qemu
      #   uses: docker/setup-qemu-action@v2
      #   with:
      #     platforms: linux/amd64,linux/arm64

      # - name: Display available platforms
      #   run: echo "${{ steps.qemu.outputs.platforms }}"

      - name: Set up Docker buildx
        id: buildx
        uses: docker/setup-buildx-action@v2
        with:
          driver-opts: network=host

      # https://github.com/docker/build-push-action
      - name: Build test image
        uses: docker/build-push-action@v3
        env:
          REGISTRY: ghcr.io/
          PUBLIC_REGISTRY: ""
        with:
          context: .
          builder: ${{ steps.buildx.outputs.name }}
          push: true
          target: test-image
          # https://github.com/moby/buildkit#export-cache
          cache-from: type=gha,scope=${{ github.workflow }}-test
          cache-to: type=gha,scope=${{ github.workflow }}-test,mode=max
          tags: |
            ghcr.io/${{ env.IMAGE_OWNER }}/${{ env.IMAGE_NAME }}:test

  test:
    name: Run tests
    runs-on: ubuntu-latest
    # permissions: write-all
    permissions:
      # Interact with GitHub's OIDC Token endpoint for AWS
      id-token: write
      contents: read
      # Read from ghcr.io repository
      packages: read

      # Upload JUnit report files
      # https://github.com/EnricoMi/publish-unit-test-result-action#permissions
      checks: write
      pull-requests: write
      issues: read
    needs: [build-test]
    steps:
      - name: Log in to GHCR
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Check out source
        uses: actions/checkout@v2

      - name: Run tests
        env:
          REGISTRY: ghcr.io/
          # PUBLIC_REGISTRY: "${{ steps.login-ecr.outputs.registry }}/"
          PUBLIC_REGISTRY: ""
        run: |
          docker pull "${REGISTRY}${IMAGE_OWNER}/${IMAGE_NAME}:test"
          docker-compose -f docker-compose.gha.yml up test
          docker-compose -f docker-compose.gha.yml run test mix test
          docker-compose -f docker-compose.gha.yml run test mix do format --check-formatted, credo, deps.audit, sobelow

      - name: Publish unit test results to GitHub
        uses: EnricoMi/publish-unit-test-result-action@v2
        # Run even if tests fail
        if: always()
        with:
          # Volume mounted from local filesystem into build
          junit_files: junit-reports/*.xml

  test-dialyzer:
    name: Run Dialyzer
    runs-on: ubuntu-latest
    needs: [build-test]
    # permissions: write-all
    permissions:
      # Interact with GitHub's OIDC Token endpoint for AWS
      id-token: write
      contents: read
      # Read from ghcr.io repository
      packages: read

      # Upload JUnit report files
      # https://github.com/EnricoMi/publish-unit-test-result-action#permissions
      checks: write
      pull-requests: write
      issues: read
    steps:
      # https://github.com/marketplace/actions/docker-login
      - name: Log in to GHCR
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Check out source
        uses: actions/checkout@v2

      - name: Run Dialyzer
        env:
          REGISTRY: ghcr.io/
          # PUBLIC_REGISTRY: "${{ steps.login-ecr.outputs.registry }}/"
          PUBLIC_REGISTRY: ""
        run: |
          docker pull "${REGISTRY}${IMAGE_OWNER}/${IMAGE_NAME}:test"
          docker-compose -f docker-compose.gha.yml up test
          docker-compose -f docker-compose.gha.yml run test mix dialyzer --no-check --halt-exit-status --format github

  test-scan:
    name: Security scan code
    runs-on: ubuntu-latest
    needs: [build-test]
    # permissions: write-all
    permissions:
      # Interact with GitHub's OIDC Token endpoint for AWS
      id-token: write
      contents: read
      # Read from ghcr.io repository
      packages: read

      # Upload JUnit report files
      # https://github.com/EnricoMi/publish-unit-test-result-action#permissions
      checks: write
      pull-requests: write
      issues: read
      # Upload SARIF report files
      security-events: write
    steps:
      # https://github.com/marketplace/actions/docker-login
      - name: Log in to GHCR
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Checkout source
        uses: actions/checkout@v2

      - name: Trivy code
        env:
          REGISTRY: ghcr.io/
          # PUBLIC_REGISTRY: "${{ steps.login-ecr.outputs.registry }}/"
          PUBLIC_REGISTRY: ""
        run: |
          mkdir -p ./sarif-reports
          mkdir -p ./trivy-cache
          docker pull "${REGISTRY}${IMAGE_OWNER}/${IMAGE_NAME}:test"
          docker-compose -f docker-compose.gha.yml up test
          docker-compose -f docker-compose.gha.yml run test trivy fs --no-progress --debug --cache-dir /trivy-cache .
          docker-compose -f docker-compose.gha.yml run test trivy fs --format sarif -o /sarif-reports/trivy-code.sarif --no-progress --debug --cache-dir /trivy-cache .

        # TODO:
        # * Don't scan Elixir deps dir
        # * Scan standard deps like Yarn
        # * Scan application code and put warnings inline using JUnit?
        #   Fail build on security issues in our code
        # * Configure trivy options via file

      # https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning
      # https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github
      - name: Upload scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        if: always()
        with:
          sarif_file: './sarif-reports/'
          category: trivy

  build-prod:
    name: Build prod image
    runs-on: ubuntu-latest
    # runs-on: ubuntu-20.04
    permissions:
      # Interact with GitHub's OIDC Token endpoint for AWS
      id-token: write
      contents: read

      # Push to ghcr.io repository
      packages: write

      # Upload JUnit report files
      # https://github.com/EnricoMi/publish-unit-test-result-action#permissions
      checks: write
      pull-requests: write
      issues: read
    steps:
      # https://github.com/aws-actions/configure-aws-credentials
      # https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          role-to-assume: ${{ env.AWS_ROLE_TO_ASSUME }}
          aws-region: ${{ env.AWS_REGION }}

      # https://github.com/aws-actions/amazon-ecr-login
      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v1

      # https://github.com/marketplace/actions/docker-login
      - name: Log in to GHCR
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Log in to Docker Hub
        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Check out source
        uses: actions/checkout@v2

      - name: Set variables
        id: vars
        run: |
          echo "GITHUB_SHA_SHORT=$(echo $GITHUB_SHA | cut -c 1-7)" >> $GITHUB_ENV
          echo "::set-output name=run_id::${GITHUB_RUN_ID}"
          echo "::set-output name=run_num::${GITHUB_RUN_NUMBER}"

      - name: Get branch name for push
        if: github.event_name != 'pull_request'
        run: |
          echo "BRANCH=$(echo ${GITHUB_REF#refs/heads/})" >> $GITHUB_ENV

      - name: Get branch name for pull_request
        if: github.event_name == 'pull_request'
        run: |
          echo "BRANCH=$(echo $GITHUB_HEAD_REF | tr '//\\' '.' | cut -c -55)" >> $GITHUB_ENV

      - name: Set up Docker buildx
        id: buildx
        uses: docker/setup-buildx-action@v2
        with:
          driver-opts: network=host

      - name: Build deploy image and push
        # if: github.event_name != 'pull_request'
        uses: docker/build-push-action@v3
        env:
          REGISTRY: "${{ steps.login-ecr.outputs.registry }}/"
          PUBLIC_REGISTRY: ""
        with:
          context: .
          builder: ${{ steps.buildx.outputs.name }}
          push: true
          cache-from: type=gha,scope=${{ github.workflow }}
          cache-to: type=gha,scope=${{ github.workflow }},mode=max
          tags: |
            ${{ steps.login-ecr.outputs.registry }}/${{ env.IMAGE_NAME }}:latest
            ${{ steps.login-ecr.outputs.registry }}/${{ env.IMAGE_NAME }}:${{ github.sha }}

         # ghcr.io/${{ env.IMAGE_OWNER }}/${{ env.IMAGE_NAME }}:latest

      - name: Build scan image
        uses: docker/build-push-action@v3
        env:
          REGISTRY: ghcr.io/
        with:
          context: .
          builder: ${{ steps.buildx.outputs.name }}
          push: true
          target: deploy-scan
          # https://github.com/moby/buildkit#export-cache
          cache-from: type=gha,scope=${{ github.workflow }}-scan
          cache-to: type=gha,scope=${{ github.workflow }}-scan,mode=max
          tags: |
            ghcr.io/${{ env.IMAGE_OWNER }}/${{ env.IMAGE_NAME }}:scan

  scan:
    name: Security scan image
    runs-on: ubuntu-latest
    needs: [build-prod]
    # permissions: write-all
    permissions:
      # Interact with GitHub's OIDC Token endpoint for AWS
      id-token: write
      contents: read

      # Read from ghcr.io repository
      packages: read

      # Upload JUnit report files
      # https://github.com/EnricoMi/publish-unit-test-result-action#permissions
      checks: write
      pull-requests: write
      issues: read

      # Upload SARIF report files
      security-events: write

    steps:
      # https://github.com/marketplace/actions/docker-login
      - name: Log in to GHCR
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Check out source
        uses: actions/checkout@v2

      - name: Security scan image
        env:
          REGISTRY: ghcr.io/
          # PUBLIC_REGISTRY: "${{ steps.login-ecr.outputs.registry }}/"
          PUBLIC_REGISTRY: ""
        run: |
          mkdir -p ./sarif-reports
          mkdir -p ./trivy-cache
          docker pull "${REGISTRY}${IMAGE_OWNER}/${IMAGE_NAME}:scan"
          docker-compose -f docker-compose.gha.yml run scan trivy fs --no-progress --debug --cache-dir /trivy-cache /
          docker-compose -f docker-compose.gha.yml run scan trivy fs --format sarif -o /sarif-reports/trivy-deploy.sarif --no-progress --debug --cache-dir /trivy-cache /
          # docker-compose -f docker-compose.gha.yml run scan trivy fs --severity CRITICAL --exit-code 1 --format sarif -o /sarif-reports/trivy.sarif --no-progress /

      # https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning
      # https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github
      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        if: always()
        with:
          sarif_file: './sarif-reports/'
          category: trivy