main.yml

name: Sub - main

on:
  workflow_call:
    inputs:
      BASE_IMAGE:
        required: true
        type: string
      KOSLI_TRAIL:
        required: true
        type: string
    secrets:
      SNYK_TOKEN:
        required: true
      KOSLI_API_TOKEN:
        required: true

env:
  KOSLI_API_TOKEN: ${{ secrets.KOSLI_API_TOKEN }}
  KOSLI_AWS_BETA:  ${{ vars.KOSLI_AWS_BETA }}          # aws-beta
  KOSLI_DEBUG:     ${{ vars.KOSLI_DEBUG }}             # true/false
  KOSLI_DRY_RUN:   ${{ vars.KOSLI_DRY_RUN }}           # true/false
  KOSLI_HOST:      ${{ vars.KOSLI_HOST }}              # https://app.kosli.com
  KOSLI_ORG:       ${{ vars.KOSLI_ORG }}               # cyber-dojo
  KOSLI_FLOW:      ${{ vars.KOSLI_FLOW }}              # runner-ci
  KOSLI_TRAIL:     ${{ github.sha }}

  AWS_ECR_ID:          ${{ vars.AWS_ECR_ID }}
  AWS_REGION:          ${{ vars.AWS_REGION }}
  AWS_ACCOUNT_ID_BETA: ${{ vars.AWS_ACCOUNT_ID_BETA }}
  SERVICE_NAME:        ${{ github.event.repository.name }}  # runner
  DOCKER_API_VERSION:  ${{ vars.DOCKER_API_VERSION }}

jobs:

  setup:
    runs-on: ubuntu-latest
    outputs:
      aws_account_id_beta:      ${{ steps.vars.outputs.aws_account_id_beta }}
      ecr_registry:             ${{ steps.vars.outputs.ecr_registry }}
      aws_region:               ${{ steps.vars.outputs.aws_region }}
      gh_actions_iam_role_name: ${{ steps.vars.outputs.gh_actions_iam_role_name }}
      service_name:             ${{ steps.vars.outputs.service_name }}
      image_tag:                ${{ steps.vars.outputs.image_tag }}
      image_name:               ${{ steps.vars.outputs.image_name }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Prepare outputs for workflow jobs
        id: vars
        run: |
          ECR_REGISTRY="${AWS_ECR_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com"
          IMAGE_TAG=${GITHUB_SHA:0:7}        
          IMAGE_NAME="${ECR_REGISTRY}/${{ env.SERVICE_NAME }}:${IMAGE_TAG}"
          
          echo "aws_account_id_beta=${AWS_ACCOUNT_ID_BETA}"   >> ${GITHUB_OUTPUT}          
          echo "ecr_registry=${ECR_REGISTRY}"                 >> ${GITHUB_OUTPUT}
          echo "aws_region=${AWS_REGION}"                     >> ${GITHUB_OUTPUT}
          echo "gh_actions_iam_role_name=gh_actions_services" >> ${GITHUB_OUTPUT}
          echo "service_name=${{ env.SERVICE_NAME }}"         >> ${GITHUB_OUTPUT}
          echo "image_tag=${IMAGE_TAG}"                       >> ${GITHUB_OUTPUT}
          echo "image_name=${IMAGE_NAME}"                     >> ${GITHUB_OUTPUT}

      - name: Setup Kosli CLI
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        uses: kosli-dev/setup-cli-action@v2
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}

      # This is currently the Kosli live-docs example target for the create-flow command.
      - name: Create Kosli Flow
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        run:
          kosli create flow "${KOSLI_FLOW}"
            --description="Test runner"
            --template-file=.kosli.yml

      - name: Begin Kosli Trail
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        run:
          kosli begin trail "${KOSLI_TRAIL}"


  pull-request:
    if: ${{ github.ref == 'refs/heads/main' }}
    needs: [setup]
    runs-on: ubuntu-latest
    permissions:
      id-token:      write
      contents:      read
      pull-requests: read
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Setup Kosli CLI
        uses: kosli-dev/setup-cli-action@v2
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}

      - name: Attest pull-request evidence to Kosli
        run:
          kosli attest pullrequest github
            --github-token=${{ secrets.GITHUB_TOKEN }}
            --name=pull-request


  rubocop-lint:
    needs: [setup]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Run Rubocop lint on source
        run:
          make rubocop_lint

      - name: Setup Kosli CLI
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        uses: kosli-dev/setup-cli-action@v2
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}

      - name: Attest evidence to Kosli
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        run:
          kosli attest junit
            --name=runner.rubocop-lint
            --results-dir=./reports/rubocop


  snyk-code-scan:
    runs-on: ubuntu-latest
    needs: [setup]
    env:
      SARIF_FILENAME: snyk.code.scan.json
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Setup Snyk
        uses: snyk/actions/setup@master

      - name: Run Snyk code scan
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        run:
          snyk code test
            --policy-path=.snyk
            --sarif
            --sarif-file-output="${SARIF_FILENAME}"
            .

      - name: Setup Kosli CLI
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        uses: kosli-dev/setup-cli-action@v2
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}

      - name: Attest evidence to Kosli
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        run:
          kosli attest snyk
            --attachments=.snyk
            --name=runner.snyk-code-scan 
            --scan-results="${SARIF_FILENAME}"


  build-image:
    needs: [setup]
    uses: cyber-dojo/reusable-actions-workflows/.github/workflows/secure-docker-build.yml@main
    with:
      CHECKOUT_REPOSITORY: cyber-dojo/runner
      CHECKOUT_REF: ${{ github.sha }}
      CHECKOUT_FETCH_DEPTH: 1
      IMAGE_NAME: ${{ needs.setup.outputs.ecr_registry }}/${{ needs.setup.outputs.service_name }}
      IMAGE_TAG: ${{ needs.setup.outputs.image_tag }}
      IMAGE_BUILD_ARGS: |
        COMMIT_SHA=${{ github.sha }}
        BASE_IMAGE=${{ inputs.BASE_IMAGE }}
      ATTEST_TO_KOSLI: ${{ github.ref == 'refs/heads/main' }}
      KOSLI_FLOW: ${{ vars.KOSLI_FLOW }}
      KOSLI_TRAIL: ${{ inputs.KOSLI_TRAIL }}
      KOSLI_REFERENCE_NAME: ${{ needs.setup.outputs.service_name }}
    secrets:
      KOSLI_API_TOKEN: ${{ secrets.KOSLI_API_TOKEN }}


  unit-tests:
    runs-on: ubuntu-latest
    needs: [setup, build-image]
    permissions:
      id-token: write
      contents: read
    env:
      IMAGE_NAME:        ${{ needs.setup.outputs.image_name }}
      KOSLI_FINGERPRINT: ${{ needs.build-image.outputs.digest }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region:            ${{ needs.setup.outputs.aws_region }}
          role-duration-seconds: 900
          role-session-name:     ${{ github.event.repository.name }}
          role-to-assume:        arn:aws:iam::${{ needs.setup.outputs.aws_account_id_beta }}:role/${{ needs.setup.outputs.gh_actions_iam_role_name }}
          mask-aws-account-id:   no

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Pull image from ECR registry
        run:
          docker image pull "${IMAGE_NAME}@sha256:${KOSLI_FINGERPRINT}"

      - name: Run unit tests
        run:
          make test_server

      - name: Get unit test coverage
        id: coverage
        run:
          make coverage_server

      - name: Setup Kosli CLI
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        uses: kosli-dev/setup-cli-action@v2
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}

      - name: Attest JUnit test evidence to Kosli
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        run:
          kosli attest junit
            --name=runner.unit-test
            --results-dir=./reports/server/junit

      - name: Attest coverage evidence to Kosli
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        run: |
          KOSLI_COMPLIANT=$([ "${{ steps.coverage.outcome }}" == 'success' ] && echo true || echo false)
          kosli attest generic \
            --description="unit-test branch-coverage and metrics" \
            --name=runner.unit-test-branch-coverage \
            --user-data="./reports/server/coverage_metrics.json"


  integration-tests:
    runs-on: ubuntu-latest
    needs: [setup, build-image]
    permissions:
      id-token: write
      contents: read
    env:
      IMAGE_NAME:        ${{ needs.setup.outputs.image_name }}
      KOSLI_FINGERPRINT: ${{ needs.build-image.outputs.digest }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region:            ${{ needs.setup.outputs.aws_region }}
          role-duration-seconds: 900
          role-session-name:     ${{ github.event.repository.name }}
          role-to-assume:        arn:aws:iam::${{ needs.setup.outputs.aws_account_id_beta }}:role/${{ needs.setup.outputs.gh_actions_iam_role_name }}
          mask-aws-account-id:   no

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Pull image from ECR registry
        run:
          docker image pull "${IMAGE_NAME}@sha256:${KOSLI_FINGERPRINT}"

      - name: Run integration tests
        run:
          make image_client test_client

      - name: Get integration test coverage
        id: coverage
        run:
          make coverage_client

      - name: Setup Kosli CLI
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        uses: kosli-dev/setup-cli-action@v2
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}

      - name: Attest junit test evidence to Kosli
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        run:
          kosli attest junit
            --name=runner.integration-test
            --results-dir=./reports/client/junit

      - name: Attest coverage evidence to Kosli
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        run: |
          KOSLI_COMPLIANT=$([ "${{ steps.coverage.outcome }}" == 'success' ] && echo true || echo false)
          kosli attest generic \
            --description="integration-test branch-coverage and metrics" \
            --name=runner.integration-test-branch-coverage \
            --user-data="./reports/client/coverage_metrics.json"


  snyk-container-scan:
    runs-on: ubuntu-latest
    needs: [setup, build-image]
    permissions:
      id-token: write
      contents: read
    env:
      IMAGE_NAME:        ${{ needs.setup.outputs.image_name }}
      KOSLI_FINGERPRINT: ${{ needs.build-image.outputs.digest }}
      SARIF_FILENAME:    snyk.container.scan.json
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region:            ${{ needs.setup.outputs.aws_region }}
          role-duration-seconds: 900
          role-session-name:     ${{ github.event.repository.name }}
          role-to-assume:        arn:aws:iam::${{ needs.setup.outputs.aws_account_id_beta }}:role/${{ needs.setup.outputs.gh_actions_iam_role_name }}
          mask-aws-account-id:   no

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Pull image from ECR registry
        run:
          docker image pull "${IMAGE_NAME}@sha256:${KOSLI_FINGERPRINT}"

      - name: Setup Snyk
        uses: snyk/actions/setup@master

      - name: Run Snyk container scan
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        run:
          make snyk_container_scan

      - name: Setup Kosli CLI
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        uses: kosli-dev/setup-cli-action@v2
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}

      - name: Attest evidence to Kosli
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        run:
          kosli attest snyk 
            --attachments=.snyk          
            --name=runner.snyk-container-scan 
            --scan-results="${SARIF_FILENAME}"


  sdlc-control-gate:
    if: ${{ github.ref == 'refs/heads/main' }}
    runs-on: ubuntu-latest
    needs: [setup, build-image, pull-request, rubocop-lint, unit-tests, integration-tests, snyk-container-scan, snyk-code-scan]
    env:
      IMAGE_NAME:        ${{ needs.setup.outputs.image_name }}
      KOSLI_FINGERPRINT: ${{ needs.build-image.outputs.digest }}
    steps:
      - name: Setup Kosli CLI
        uses: kosli-dev/setup-cli-action@v2
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}

      - name: Kosli SDLC gate to short-circuit the workflow
        run:
          kosli assert artifact ${IMAGE_NAME}
            --environment=${KOSLI_AWS_BETA}


  approve-deployment-to-beta:
    needs: [setup, build-image, sdlc-control-gate]
    runs-on: ubuntu-latest
    env:
      IMAGE_NAME:        ${{ needs.setup.outputs.image_name }}
      KOSLI_FINGERPRINT: ${{ needs.build-image.outputs.digest }}
    environment:
      name: staging
      url:  https://beta.cyber-dojo.org
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Kosli CLI
        uses: kosli-dev/setup-cli-action@v2
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}

      - name: Attest approval of deployment to Kosli
        run:
          kosli report approval ${IMAGE_NAME}
            --approver="${{ github.actor }}"
            --environment=${KOSLI_AWS_BETA}


  deploy-to-beta:
    needs: [setup, build-image, approve-deployment-to-beta]
    permissions:
      id-token: write
      contents: write
    uses: fivexl/gh-workflow-tf-plan-apply/.github/workflows/base.yml@v0.0.23
    with:
      aws_region:             ${{ needs.setup.outputs.aws_region }}
      aws_role_arn:           arn:aws:iam::${{ needs.setup.outputs.aws_account_id_beta }}:role/${{ needs.setup.outputs.gh_actions_iam_role_name }}
      aws_default_region:     ${{ needs.setup.outputs.aws_region }}
      aws_role_duration:      900
      working_directory:      deployment/terraform/
      tf_apply:               true
      tf_version:             v1.9.1
      tf_additional_env_vars: '{"TF_VAR_TAGGED_IMAGE": "${{ needs.setup.outputs.ecr_registry }}/${{ needs.setup.outputs.service_name }}:${{ needs.setup.outputs.image_tag }}@sha256:${{ needs.build-image.outputs.digest }}"}'


# Deployment to aws-prod Environment is done with a Release/Promotion workflow.
# See https://github.com/cyber-dojo/aws-prod-co-promotion