main.yml

name: Sub - main

on:
  workflow_call:
    inputs:
      BASE_IMAGE:
        required: true
        type: string
      KOSLI_TRAIL:
        required: true
        type: string
    secrets:
      SNYK_TOKEN:
        required: true
      SONARCLOUD_TOKEN:
        required: true
      KOSLI_API_TOKEN:
        required: true

env:
  KOSLI_API_TOKEN: ${{ secrets.KOSLI_API_TOKEN }}
  KOSLI_AWS_BETA:  ${{ vars.KOSLI_AWS_BETA }}          # aws-beta
  KOSLI_DEBUG:     ${{ vars.KOSLI_DEBUG }}             # true/false
  KOSLI_DRY_RUN:   ${{ vars.KOSLI_DRY_RUN }}           # true/false
  KOSLI_HOST:      ${{ vars.KOSLI_HOST }}              # https://app.kosli.com
  KOSLI_ORG:       ${{ vars.KOSLI_ORG }}               # cyber-dojo
  KOSLI_FLOW:      ${{ vars.KOSLI_FLOW }}              # differ-ci
  KOSLI_TRAIL:     ${{ inputs.kosli_trail }}

  DOCKER_API_VERSION:     ${{ vars.DOCKER_API_VERSION }}
  AWS_ECR_ID:             ${{ vars.AWS_ECR_ID }}
  AWS_REGION:             ${{ vars.AWS_REGION }}
  AWS_ACCOUNT_ID_BETA:    ${{ vars.AWS_ACCOUNT_ID_BETA }}
  SERVICE_NAME:           ${{ github.event.repository.name }}  # differ
  SONARCLOUD_PROJECT_KEY: ${{ github.repository_owner }}_${{ github.event.repository.name }}  # cyber-dojo_differ

jobs:

  setup:
    runs-on: ubuntu-latest
    outputs:
      aws_account_id_beta:      ${{ steps.vars.outputs.aws_account_id_beta }}
      ecr_registry:             ${{ steps.vars.outputs.ecr_registry }}
      aws_region:               ${{ steps.vars.outputs.aws_region }}
      gh_actions_iam_role_name: ${{ steps.vars.outputs.gh_actions_iam_role_name }}
      service_name:             ${{ steps.vars.outputs.service_name }}
      image_tag:                ${{ steps.vars.outputs.image_tag }}
      image_name:               ${{ steps.vars.outputs.image_name }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Check BASE_IMAGE
        run: |
          source ./bin/lib.sh
          exit_non_zero_if_bad_base_image "${{ inputs.BASE_IMAGE }}"

      - name: Prepare outputs for workflow jobs
        id: vars
        run: |
          ECR_REGISTRY="${AWS_ECR_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com"          
          IMAGE_TAG=${GITHUB_SHA:0:7}        
          IMAGE_NAME="${ECR_REGISTRY}/${{ env.SERVICE_NAME }}:${IMAGE_TAG}"
          
          echo "aws_account_id_beta=${AWS_ACCOUNT_ID_BETA}"   >> ${GITHUB_OUTPUT}          
          echo "ecr_registry=${ECR_REGISTRY}"                 >> ${GITHUB_OUTPUT}
          echo "aws_region=${AWS_REGION}"                     >> ${GITHUB_OUTPUT}
          echo "gh_actions_iam_role_name=gh_actions_services" >> ${GITHUB_OUTPUT}
          echo "service_name=${{ env.SERVICE_NAME }}"         >> ${GITHUB_OUTPUT}
          echo "image_tag=${IMAGE_TAG}"                       >> ${GITHUB_OUTPUT}
          echo "image_name=${IMAGE_NAME}"                     >> ${GITHUB_OUTPUT}

      - name: Setup Kosli CLI
        if: ${{ github.ref == 'refs/heads/main' }}
        uses: kosli-dev/setup-cli-action@v2
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}

      - name: Begin Kosli Trail
        if: ${{ github.ref == 'refs/heads/main' }}
        run:
          kosli begin trail "${KOSLI_TRAIL}"  
            --template-file=.kosli.yml


  pull-request:
    if: ${{ github.ref == 'refs/heads/main' }}
    runs-on: ubuntu-latest
    needs: [setup]
    permissions:
      id-token:      write
      contents:      read
      pull-requests: read
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Setup Kosli CLI
        uses: kosli-dev/setup-cli-action@v2
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}

      - name: Attest pull-request evidence to Kosli
        run:
          kosli attest pullrequest github
            --github-token=${{ secrets.GITHUB_TOKEN }}
            --name=pull-request


  rubocop-lint:
    runs-on: ubuntu-latest
    needs: [setup]
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Run Rubocop linter on source
        run:
          make rubocop_lint

      - name: Setup Kosli CLI
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        uses: kosli-dev/setup-cli-action@v2
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}

      - name: Attest evidence to Kosli
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        run:
          kosli attest junit
            --name=differ.rubocop-lint
            --results-dir=./reports/rubocop


  snyk-code-scan:
    runs-on: ubuntu-latest
    needs: [setup]
    env:
      SARIF_FILENAME: snyk.code.scan.json
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Setup Snyk
        uses: snyk/actions/setup@master

      - name: Run Snyk code scan
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        run:
          snyk code test
            --policy-path=.snyk
            --sarif
            --sarif-file-output="${SARIF_FILENAME}"
            .

      - name: Setup Kosli CLI
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        uses: kosli-dev/setup-cli-action@v2
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}

      - name: Attest evidence to Kosli
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        run:
          kosli attest snyk
            --attachments=.snyk
            --name=differ.snyk-code-scan 
            --scan-results="${SARIF_FILENAME}"


  build-image:
    needs: [setup]
    uses: cyber-dojo/reusable-actions-workflows/.github/workflows/secure-docker-build.yml@main
    with:
      CHECKOUT_REPOSITORY: cyber-dojo/differ
      CHECKOUT_REF: ${{ github.sha }}
      CHECKOUT_FETCH_DEPTH: 1
      IMAGE_NAME: ${{ needs.setup.outputs.ecr_registry }}/${{ needs.setup.outputs.service_name }}
      IMAGE_TAG: ${{ needs.setup.outputs.image_tag }}
      IMAGE_BUILD_ARGS: |
        COMMIT_SHA=${{ github.sha }}
        BASE_IMAGE=${{ inputs.BASE_IMAGE }}
      ATTEST_TO_KOSLI: ${{ github.ref == 'refs/heads/main' }}
      KOSLI_FLOW: ${{ vars.KOSLI_FLOW }}
      KOSLI_TRAIL: ${{ inputs.KOSLI_TRAIL }}
      KOSLI_REFERENCE_NAME: ${{ needs.setup.outputs.service_name }}
    secrets:
      KOSLI_API_TOKEN: ${{ secrets.KOSLI_API_TOKEN }}


  unit-tests:
    runs-on: ubuntu-latest
    needs: [setup, build-image]
    permissions:
      id-token: write
      contents: read
    env:
      IMAGE_NAME:        ${{ needs.setup.outputs.image_name }}
      KOSLI_FINGERPRINT: ${{ needs.build-image.outputs.digest }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region:            ${{ needs.setup.outputs.aws_region }}
          role-duration-seconds: 900
          role-session-name:     ${{ github.event.repository.name }}
          role-to-assume:        arn:aws:iam::${{ needs.setup.outputs.aws_account_id_beta }}:role/${{ needs.setup.outputs.gh_actions_iam_role_name }}
          mask-aws-account-id:   no

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Pull image from ECR registry
        run:
          docker image pull "${IMAGE_NAME}@sha256:${KOSLI_FINGERPRINT}"

      - name: Run unit tests with metrics checks
        run:
          make test_server metrics_test_server metrics_coverage_server

      - name: Setup Kosli CLI
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        uses: kosli-dev/setup-cli-action@v2
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}

      - name: Attest junit test evidence to Kosli
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        run:
          kosli attest junit
            --name=differ.unit-test 
            --results-dir=./reports/server/junit

      - name: Attest test metrics to Kosli
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        run:
          kosli attest custom 
            --attestation-data=./reports/server/test_metrics.json 
            --name=differ.unit-test-metrics
            --type=test-metrics

      - name: Attest coverage metrics to Kosli
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        run:
          kosli attest custom 
            --attestation-data=./reports/server/coverage_metrics.json 
            --name=differ.unit-test-coverage-metrics
            --type=coverage-metrics


  integration-tests:
    runs-on: ubuntu-latest
    needs: [setup, build-image]
    permissions:
      id-token: write
      contents: read
    env:
      IMAGE_NAME:        ${{ needs.setup.outputs.image_name }}
      KOSLI_FINGERPRINT: ${{ needs.build-image.outputs.digest }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region:            ${{ needs.setup.outputs.aws_region }}
          role-duration-seconds: 900
          role-session-name:     ${{ github.event.repository.name }}
          role-to-assume:        arn:aws:iam::${{ needs.setup.outputs.aws_account_id_beta }}:role/${{ needs.setup.outputs.gh_actions_iam_role_name }}
          mask-aws-account-id:   no

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Pull image from ECR registry
        run:
          docker image pull "${IMAGE_NAME}@sha256:${KOSLI_FINGERPRINT}"

      - name: Run integration tests with metrics checks
        run:
          make image_client test_client metrics_test_client metrics_coverage_client

      - name: Setup Kosli CLI
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        uses: kosli-dev/setup-cli-action@v2
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}

      - name: Attest junit test evidence to Kosli
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        run:
          kosli attest junit
            --name=differ.integration-test 
            --results-dir=./reports/client/junit

      - name: Attest test metrics to Kosli
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        run:
          kosli attest custom 
            --attestation-data=./reports/client/test_metrics.json 
            --name=differ.integration-test-metrics
            --type=test-metrics

      - name: Attest coverage metrics to Kosli
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        run:
          kosli attest custom 
            --attestation-data=./reports/client/coverage_metrics.json 
            --name=differ.integration-test-coverage-metrics
            --type=coverage-metrics


  snyk-container-scan:
    runs-on: ubuntu-latest
    needs: [setup, build-image]
    permissions:
      id-token: write
      contents: read
    env:
      IMAGE_NAME:        ${{ needs.setup.outputs.image_name }}
      KOSLI_FINGERPRINT: ${{ needs.build-image.outputs.digest }}
      SARIF_FILENAME:    snyk.container.scan.json
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region:            ${{ needs.setup.outputs.aws_region }}
          role-duration-seconds: 900
          role-session-name:     ${{ github.event.repository.name }}
          role-to-assume:        arn:aws:iam::${{ needs.setup.outputs.aws_account_id_beta }}:role/${{ needs.setup.outputs.gh_actions_iam_role_name }}
          mask-aws-account-id:   no

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Pull image from ECR registry
        run:
          docker image pull "${IMAGE_NAME}@sha256:${KOSLI_FINGERPRINT}"

      - name: Setup Snyk
        uses: snyk/actions/setup@master

      - name: Run Snyk container scan
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        run:
          snyk container test ${IMAGE_NAME}
            --policy-path=.snyk
            --sarif
            --sarif-file-output="${SARIF_FILENAME}"

      - name: Setup Kosli CLI
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        uses: kosli-dev/setup-cli-action@v2
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}

      - name: Attest evidence to Kosli
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        run:
          kosli attest snyk
            --attachments=.snyk
            --name=differ.snyk-container-scan
            --scan-results="${SARIF_FILENAME}"


  sonarcloud-scan:
    runs-on: ubuntu-latest
    needs: [build-image]
    env:
      KOSLI_FINGERPRINT: ${{ needs.build-image.outputs.digest }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Run SonarCloud scan - report results to Kosli (in Kosli webhook)
        env:
          SONAR_TOKEN: ${{ secrets.SONARCLOUD_TOKEN }}
        uses: SonarSource/sonarqube-scan-action@v4.2.1
        with:
          args: >
            -Dsonar.analysis.kosli_flow=${{ env.KOSLI_FLOW }}
            -Dsonar.analysis.kosli_trail=${{ env.KOSLI_TRAIL }}
            -Dsonar.analysis.kosli_artifact_fingerprint=${{ env.KOSLI_FINGERPRINT }}
            -Dsonar.analysis.kosli_attestation=differ.sonarcloud-scan


  sdlc-control-gate:
    if: ${{ github.ref == 'refs/heads/main' }}
    runs-on: ubuntu-latest
    needs: [setup, build-image, pull-request, rubocop-lint, unit-tests, integration-tests, snyk-container-scan, snyk-code-scan, sonarcloud-scan]
    env:
      IMAGE_NAME:        ${{ needs.setup.outputs.image_name }}
      KOSLI_FINGERPRINT: ${{ needs.build-image.outputs.digest }}
    steps:
      - name: Setup Kosli CLI
        uses: kosli-dev/setup-cli-action@v2
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}

      - name: Kosli SDLC gate to short-circuit the workflow
        run:
          kosli assert artifact ${IMAGE_NAME}
            --environment=${KOSLI_AWS_BETA}


  approve-deployment-to-beta:
    runs-on: ubuntu-latest
    needs: [setup, build-image, sdlc-control-gate]
    env:
      IMAGE_NAME:        ${{ needs.setup.outputs.image_name }}
      KOSLI_FINGERPRINT: ${{ needs.build-image.outputs.digest }}
    environment:
      name: staging
      url:  https://beta.cyber-dojo.org
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Kosli CLI
        uses: kosli-dev/setup-cli-action@v2
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}

      - name: Attest approval of deployment to Kosli
        run:
          kosli report approval ${IMAGE_NAME} 
            --approver="${{ github.actor }}"
            --environment=${KOSLI_AWS_BETA}


  deploy-to-beta:
    needs: [setup, build-image, approve-deployment-to-beta]
    permissions:
      id-token: write
      contents: write
    uses: fivexl/gh-workflow-tf-plan-apply/.github/workflows/base.yml@v0.0.23
    with:
      aws_region: ${{ needs.setup.outputs.aws_region }}
      aws_role_arn: arn:aws:iam::${{ needs.setup.outputs.aws_account_id_beta }}:role/${{ needs.setup.outputs.gh_actions_iam_role_name }}
      aws_default_region: ${{ needs.setup.outputs.aws_region }}
      aws_role_duration: 900
      working_directory: deployment/terraform/
      tf_apply: true
      tf_version: v1.9.1
      tf_additional_env_vars: '{"TF_VAR_TAGGED_IMAGE": "${{ needs.setup.outputs.ecr_registry }}/${{ needs.setup.outputs.service_name }}:${{ needs.setup.outputs.image_tag }}@sha256:${{ needs.build-image.outputs.digest }}"}'

# Deployment to aws-prod Environment is done with a Release/Promotion workflow.
# See https://github.com/cyber-dojo/aws-prod-co-promotion