build.yml

# This workflow will build a docker container, publish it to Azure Container Registry, and deploy it to Azure Kubernetes Service using a helm chart.
#
# https://github.com/Azure/actions-workflow-samples/tree/master/Kubernetes
#
# To configure this workflow:
#
# 1. Set up the following secrets in your workspace:
#     a. REGISTRY_USERNAME with ACR username
#     b. REGISTRY_PASSWORD with ACR Password
#     c. AZURE_CREDENTIALS with the output of `az ad sp create-for-rbac --sdk-auth`
#
# 2. Change the values for the REGISTRY_NAME, CLUSTER_NAME, CLUSTER_RESOURCE_GROUP and NAMESPACE environment variables (below).
name: build
on: 
  pull_request:
  schedule: 
    - cron: '0 23 * * *'

# Environment variables available to all jobs and steps in this workflow
env:
  REGISTRY_NAME: k8scc01covidacr
  CLUSTER_NAME: k8s-cancentral-01-covid-aks
  CLUSTER_RESOURCE_GROUP: k8s-cancentral-01-covid-aks
  TRIVY_VERSION: "v0.57.0"
  TRIVY_DATABASES: '"ghcr.io/aquasecurity/trivy-db:2","public.ecr.aws/aquasecurity/trivy-db"'
  TRIVY_JAVA_DATABASES: '"ghcr.io/aquasecurity/trivy-java-db:1","public.ecr.aws/aquasecurity/trivy-java-db"'
  TRIVY_MAX_RETRIES: 5
  TRIVY_RETRY_DELAY: 20
  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
jobs:
  build:
    runs-on: ubuntu-latest
    services:
      registry:
        image: registry:2
        ports:
          - 5000:5000
    steps:
    - uses: actions/checkout@master

    # Container build
    - run: |
        docker build -f Dockerfile -t localhost:5000/prob-notebook-controller:${{ github.sha }} .
        docker push localhost:5000/prob-notebook-controller:${{ github.sha }}
        docker image prune

    # Scan image for vulnerabilities
    - name: Aqua Security Trivy image scan
      run: |
        curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin ${{ env.TRIVY_VERSION }}
        
        set +e # Lets trivy return an error without it being fatal

        for ((i=0; i<${{ env.TRIVY_MAX_RETRIES }}; i++)); do
          echo "Attempt $((i + 1)) of ${{ env.TRIVY_MAX_RETRIES }}..."

          trivy image \
            --db-repository ${{ env.TRIVY_DATABASES }} \
            --java-db-repository ${{ env.TRIVY_JAVA_DATABASES }} \
            localhost:5000/prob-notebook-controller:${{ github.sha }} \
            --exit-code 10 --timeout=20m --scanners vuln --severity CRITICAL \
          EXIT_CODE=$?

          if [[ $EXIT_CODE -eq 0 ]]; then
            echo "Trivy scan completed successfully."
            exit 0
          elif [[ $EXIT_CODE -eq 10 ]]; then
            echo "Trivy scan completed successfully. Some vulnerabilities were found."
            exit 10
          elif [[ $i -lt $(( ${{ env.TRIVY_MAX_RETRIES }} - 1))  ]]; then
            echo "Encountered unexpected error. Retrying in ${{ env.TRIVY_RETRY_DELAY }} seconds..."
            sleep ${{ env.TRIVY_RETRY_DELAY }}
          else
            echo "Unexpected error persists after ${{ env.TRIVY_MAX_RETRIES }} attempts. Exiting."
            exit 1
          fi
        done

    # Run Dockle
    - name: Run dockle
      uses: goodwithtech/dockle-action@main
      with:
        image: localhost:5000/prob-notebook-controller:${{ github.sha }}
        format: 'list'
        exit-code: '1'
        exit-level: 'fatal'
        ignore: 'DKL-DI-0006'

    - name: Slack Notification
      if: failure() && github.event_name=='schedule'
      uses: act10ns/slack@v1
      with: 
        status: failure
        message: prob-notebook-controller build failed. https://github.com/StatCan/aaw-prob-notebook-controller/actions/runs/${{github.run_id}}