test-and-build-docker-images.yml

name: Build Container Images
on:
  workflow_call:
    inputs:
      artifact:
        type: string
        required: true
      tags:
        type: string
        required: true
      should-run:
        type: string
        required: true
      should-push-image:
        type: string
        required: true
      docker-test-target:
        type: string
        required: true
      working-dir: 
        type: string
        required: true
      version:
        type: string
        required: true
      datetime:
        type: string
        required: false
        default: ''
      gitSha: 
        type: string
        required: true
        default: ''
      build-everything:
        type: string
        required: false
        default: 'false'
      build-installer:
        type: string
        required: false
        default: 'false'
      release-build:
        type: string
        required: false
        default: 'false'
defaults:
  run:
    shell: bash
env:
  GO_VERSION: "~1.20"
jobs:
  test_and_build:
    name: Test and Build
    runs-on: ubuntu-22.04
    permissions:
      id-token: write # Needed for cosign OIDC authentication against Github
    steps:
    - name: Check out code
      uses: actions/checkout@v4

    - name: Set up Go 1.x
      if: inputs.artifact != 'bridge2'
      uses: actions/setup-go@v4
      with:
        go-version: ${{ env.GO_VERSION }}
        cache: true
        check-latest: true
        cache-dependency-path: '${{ inputs.working-dir }}go.sum'

    - name: Set up gotestsum
      if: inputs.artifact != 'bridge2'
      run: go install gotest.tools/gotestsum@v1.8.1

    - name: Install libgit2
      if: inputs.artifact == 'resource-service'
      id: install-libgit2
      run: |
        git clone --branch v1.5.0 --single-branch https://github.com/libgit2/libgit2.git
        cd libgit2
        mkdir build && cd build
        cmake ..
        sudo cmake --build . --target install

    - name: Download Go dependencies
      if: inputs.artifact != 'bridge2'
      working-directory: ./${{ inputs.artifact }}
      run: go mod download

    - name: Test ${{ inputs.artifact }} # TODO add --race #8486
      if: inputs.artifact != 'bridge2' && ((inputs.build-everything == 'true') || (inputs.should-run == 'true'))
      working-directory: ./${{ inputs.artifact }}
      run: |
        LD_LIBRARY_PATH=${LD_LIBRARY_PATH}:/usr/local/lib/ gotestsum --no-color=false --format=testname -- -tags=static,system_libgit2 -coverprofile=coverage.txt -covermode=atomic -v ./...

    #######################################################################
          # TESTS FOR BRIDGE
    ######################################################################
    - name: Get yarn cache directory path
      id: yarn-cache-dir-path
      if: inputs.artifact == 'bridge2'
      working-directory: bridge
      run: echo "dir=$(yarn cache dir)" >> $GITHUB_OUTPUT

    - name: Setup yarn cache
      uses: actions/cache@v3
      id: yarn-cache
      if: inputs.artifact == 'bridge2'
      with:
        path: |
          ${{ inputs.working-dir }}node_modules
          ${{ inputs.working-dir }}server/node_modules
          ${{ steps.yarn-cache-dir-path.outputs.dir }}
          /home/runner/.cache/Cypress
        key: ${{ runner.os }}-yarn-${{ inputs.docker-test-target }}-${{ hashFiles('**/yarn.lock') }}

    - name: Install yarn
      if: inputs.artifact == 'bridge2'
      working-directory: bridge
      run: |
        if [[ '${{ inputs.docker-test-target }}' == 'bridge-server-test' ]]; then
          cd ./server
        fi
        yarn install --frozen-lockfile

    - name: Bridge lint checks
      if: inputs.artifact == 'bridge2' && inputs.docker-test-target == 'builder-code-style'
      working-directory: bridge
      run: yarn prettier:check && yarn lint:check

    - name: UI-Test
      if: inputs.docker-test-target == 'builder-test-ui'
      working-directory: bridge
      env:
        NODE_OPTIONS: '--openssl-legacy-provider'
      run: ./cypress/run-tests.sh

    - name: Bridge unit test
      if: inputs.artifact == 'bridge2' && inputs.docker-test-target != 'builder-test-ui'
      working-directory: bridge
      run: |
        if [[ '${{ inputs.docker-test-target }}' == 'bridge-server-test' ]]; then
          cd ./server
        fi
        yarn test

    - name: Report test coverage for bridge-server
      if: inputs.should-push-image == 'false' && inputs.artifact == 'bridge2' && inputs.docker-test-target == 'bridge-server-test'
      uses: codecov/codecov-action@v3
      with:
        fail_ci_if_error: false
        flags: bridge-server

    - name: Upload Test Screenshots
      if: always() && inputs.artifact == 'bridge2' && inputs.docker-test-target == 'builder-test-ui'
      uses: actions/upload-artifact@v3
      with:
        name: bridge-e2e-screenshots
        path: ./bridge/shared/screenshots

    # REPORT COVERAGE
    - name: Report test coverage for ${{ inputs.artifact }}
      if: inputs.should-push-image == 'true'
      uses: codecov/codecov-action@v3
      with:
          fail_ci_if_error: false
          flags: ${{ inputs.artifact }}

#######################################################################
# BUILD PRODUCTION IMAGES
#######################################################################
    - name: Set up Docker Buildx
      id: buildx
      uses: docker/setup-buildx-action@v2
      with:
          install: true

    - name: Set up Cosign
      uses: sigstore/cosign-installer@v3.1.2
      if: inputs.should-push-image == 'true'

    - name: Login to GitHub Container Registry
      uses: docker/login-action@v2
      # only run docker login on pushes; also for PRs, but only if this is not a fork
      if: inputs.should-push-image == 'true' || inputs.release-build == 'true'
      # note: GH does not allow to access secrets for PRs from a forked repositories due to security reasons
      # that's fine, but it means we can't push images to ghcr
      with:
        registry: "ghcr.io"
        username: "keptn-bot"
        password: ${{ secrets.KEPTN_BOT_TOKEN }}

    - name: Login to Quay.io
      uses: docker/login-action@v2
      if: inputs.release-build == 'true'
      with:
        registry: "quay.io"
        username: ${{ secrets.QUAY_USER }}
        password: ${{ secrets.QUAY_TOKEN }}

    - name: "Build keptn/${{ inputs.artifact }} container image"
      id: build_container_image
      if: inputs.should-push-image == 'true'
      uses: docker/build-push-action@v4
      with:
        context: ${{ inputs.working-dir }}
        tags: ${{ inputs.tags }}
        build-args: |
          version=${{ inputs.version }}
          buildTime=${{ inputs.datetime }}
          gitSha=${{ inputs.gitSha }}
        push: ${{ inputs.should-push-image == 'true' }}
        pull: true
        builder: ${{ steps.buildx.outputs.name }}
        cache-from: type=gha,scope=${{ github.ref_name }}-${{ inputs.artifact }}
        cache-to: type=gha,scope=${{ github.ref_name }}-${{ inputs.artifact }}

    - name: Write container image digest to file
      if: inputs.should-push-image == 'true'
      env:
        IMAGE_DIGEST: ${{ steps.build_container_image.outputs.digest }}
        IMAGE_DIGEST_FILENAME: "./digest-${{ inputs.artifact }}.txt"
      run: |
        echo "${{ inputs.artifact }},$IMAGE_DIGEST" > "$IMAGE_DIGEST_FILENAME"

    - name: Upload Digest file as artifact
      if: inputs.should-push-image == 'true'
      uses: actions/upload-artifact@v3
      env:
        IMAGE_DIGEST_FILENAME: "./digest-${{ inputs.artifact }}.txt"
      with:
        name: image-digests
        path: ${{ env.IMAGE_DIGEST_FILENAME }}

    - name: Sign and verify container images
      if: inputs.should-push-image == 'true' && inputs.release-build == 'true'
      env:
        TAGS: ${{ inputs.tags }}
        IMAGE_NAME: ${{ inputs.artifact }}
        IMAGE_DIGEST: ${{ steps.build_container_image.outputs.digest }}
      run: |
        # cosign sign $IMAGE_NAME:$IMAGE_DIGEST
        echo $TAGS
        for tag in $TAGS
        do
          REMOVE=:${tag##*:} # remove everything from the last ":"
          IMAGE_TO_SIGN=${tag%$REMOVE}@$IMAGE_DIGEST
          echo "Signing $IMAGE_TO_SIGN"
          cosign sign --yes $IMAGE_TO_SIGN
          echo "Verify identity"
          cosign verify --certificate-identity-regexp="https://github.com/keptn/keptn/.*" --certificate-oidc-issuer="https://token.actions.githubusercontent.com" $IMAGE_TO_SIGN
        done