merge-to-master.yaml

name: Merge to master

on:
  push:
    branches:
      - master

env:
  SDK_VERSION: "1.17.0"
  GO111MODULE: on
  K8S_VERSION: "1.19.2"
  CONTAINER_RUNTIME: "docker"

jobs:
  release:
    name: Release operator on Quay.io
    runs-on: ubuntu-latest

    steps:
      - name: Checkout Git Repository
        uses: actions/checkout@v4

      - name: Set up PATH
        run: |
          mkdir -p $GITHUB_WORKSPACE/bin/
          echo "PATH=$PATH:$GITHUB_WORKSPACE/bin/" >> $GITHUB_ENV

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: "^1.18"

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          architecture: "x64"

      - name: Setup CLI
        uses: ./.github/actions/setup-cli
        with:
          operator-sdk: true
          kubectl: true

      - name: Release operator on Quay.io
        env:
          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
          QUAY_TOKEN: ${{ secrets.QUAY_TOKEN }}
        run: make release-operator

  unit-tests-with-coverage:
    name: Unit tests with code coverage for merge-to-master commits
    runs-on: ubuntu-latest

    steps:
      - name: Checkout Git Repository
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: "^1.18"

      - name: Unit Tests with Code Coverage
        run: |
          make test

      - name: Upload Code Coverage Report
        uses: codecov/codecov-action@v3
        with:
          file: cover.out
          verbose: true
          fail_ci_if_error: true

  publish-website:
    name: Publish website
    runs-on: ubuntu-20.04

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: generate website
        env:
          SITE_SOURCE: github
        run: |
          make site
          touch ./out/site/.nojekyll

      - name: Publish to GitHub Pages
        uses: peaceiris/actions-gh-pages@v3
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          publish_dir: ./out/site
          destination_dir: docs

  security-scan:
    name: Security vulnerability scan
    runs-on: ubuntu-20.04
    needs: ["release"]
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Extract operator image ref
        id: operator-image-ref
        run: |
          export OIR=$(make operator-image-ref)
          echo "operator-image-ref=${OIR}" >> $GITHUB_OUTPUT

      - name: Run Trivy vulnerability scanner in IaC mode
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ steps.operator-image-ref.outputs.operator-image-ref }}
          format: 'sarif'
          severity: 'CRITICAL,HIGH'
          ignore-unfixed: true
          output: 'trivy-results.sarif'

      - name: Upload Trivy scan results to GitHub Security tab
        if: always()
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results.sarif'