docker.yml

---
name: CI
on:
  push:
    branches:
      - main
    paths:
      - "Dockerfile"
      - "groovy/**"
      - "files/**"
      - "test/**"
      - ".github/workflows/docker.yml"
  pull_request:
    branches:
      - main
    paths:
      - "Dockerfile"
      - "groovy/**"
      - "files/**"
      - "test/**"
      - ".github/workflows/docker.yml"
  schedule:
    - cron: '0 7 * */1 1'
  workflow_dispatch:

env:
  REGISTRY: docker.io
  OWNER: ${{ github.repository_owner }}

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      actions: read
      contents: read
    steps:
    - name: Check out repository code
      uses: actions/checkout@v4
    - name: Set Tag Names
      run: |
        echo "TAG=$(echo ${GITHUB_REF##*/})" >> $GITHUB_ENV
        echo "DATE=v$(echo `date +'%Y.%m'`)" >> $GITHUB_ENV
        echo "REPO_NAME=$(echo ${PWD##*/})" >> $GITHUB_ENV
    - name: Login to DockerHub
      uses: docker/login-action@v3
      if: success()
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ secrets.DOCKER_USERNAME }}
        password: ${{ secrets.DOCKER_PASSWORD }}

    - name: Build and push Docker image - (MAIN)
      uses: docker/build-push-action@v6
      if: success()
      env:
        DOCKER_BUILDKIT: 1
      with:
        context: .
        file: ./Dockerfile
        platforms: linux/amd64
        build-args: |
          BUILD_ID=${{ env.DATE }}
        pull: true
        push: true
        tags: ${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_NAME }}:${{ env.TAG == 'main' && 'latest' || env.TAG }}
        cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_NAME }}:${{ env.TAG == 'main' && 'latest' || env.TAG }}
        cache-to: type=inline

    - name: Build and push Docker image - (DATE)
      uses: docker/build-push-action@v6
      if: ${{ github.event_name == 'schedule' || contains(github.ref, 'main') }}
      env:
        DOCKER_BUILDKIT: 1
      with:
        context: .
        file: ./Dockerfile
        platforms: linux/amd64
        build-args: |
          BUILD_ID=${{ env.DATE }}
        pull: true
        push: true
        tags: ${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_NAME }}:${{ env.DATE }}
        cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_NAME }}:${{ env.DATE }}
        cache-to: type=inline

    - name: Run Trivy vulnerability scanner
      uses: aquasecurity/trivy-action@master
      if: success()
      with:
        scan-type: 'config'
        scan-ref: '.'
        format: 'table'

    - name: Run Trivy vulnerability scanner
      uses: aquasecurity/trivy-action@master
      continue-on-error: true
      if: success()
      with:
        image-ref: ${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_NAME }}:${{ env.TAG == 'main' && 'latest' || env.TAG }}
        format: 'sarif'
        output: 'trivy-results.sarif'

    - name: Upload Trivy scan results to GitHub Security tab
      uses: github/codeql-action/upload-sarif@v3
      continue-on-error: true
      if: success()
      with:
        sarif_file: 'trivy-results.sarif'
        category: 'Trivy'

  k8s-test:
    runs-on: ubuntu-latest
    needs: [build]
    if: ${{ ! contains(github.ref, 'main') && github.event_name != 'schedule' }}
    steps:
      - name: Create k8s Kind Cluster
        uses: helm/kind-action@v1.10.0
      - name: Checkout
        uses: actions/checkout@v4
      - name: Run K8s test
        run: |
          kubectl cluster-info
          export NS=`cat deployment/kustomization.yml  | grep namespace | awk '{ print $2 }'`
          if [ -z "$NS" ]; then
            export NS='cicd'
          fi
          kubectl create namespace $NS
          kubectl apply -n $NS -k deployment/
          kubectl get all -A

  auto-approve:
    runs-on: ubuntu-latest
    needs: [build, k8s-test]
    if: ${{ github.event_name == 'pull_request' }}
    steps:
    - name: Auto Approve PR
      uses: actions/github-script@v7
      with:
       script: |
        github.rest.pulls.createReview({
          owner: context.repo.owner,
          repo: context.repo.repo,
          pull_number: context.issue.number,
          event: "APPROVE"
        })

  auto-preview:
    runs-on: ubuntu-latest
    needs: [auto-approve]
    if: ${{ github.event_name == 'pull_request' }}
    steps:
    - name: Add Preview Label
      uses: actions/github-script@v7
      with:
        script: |
          github.rest.issues.addLabels({
            issue_number: context.issue.number,
            owner: context.repo.owner,
            repo: context.repo.repo,
            labels: ['preview']
          })