push_container.yml

---
name: mmmm_cookies-push-container

# Workflow Secrets:
# SLACK_WEBHOOK              (Required, for slack notifications...)

on:
  push:
  schedule:
    - cron: "0 6 * * 1"
  workflow_dispatch:

env:
  PROJECT_NAME: "mmmm_cookies"
  USERNAME: "niall-byrne"
  VERBOSE_NOTIFICATIONS: 0

jobs:

  _start_notification:
    runs-on: ubuntu-latest

    steps:
      - name: Start -- Checkout Repository
        uses: actions/checkout@v3

      - name: Start -- Setup Environment
        run: |
          source ./.github/scripts/setup.sh
        env:
          WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

      - name: Start -- Report Job Status on Success
        run: |
          ./.github/scripts/notifications.sh "${NOTIFICATION}" ":white_check_mark: workflow has started!"

      - name: Start -- Report Job Status on Failure
        if: failure()
        run: |
          ./.github/scripts/notifications.sh "${NOTIFICATION}" ":x: error reporting job status!"

  _success_notification:
    needs: [create_release]

    runs-on: ubuntu-latest

    steps:
      - name: Success -- Checkout Repository
        uses: actions/checkout@v3

      - name: Success -- Setup Environment
        run: |
          source .github/scripts/setup.sh
        env:
          WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

      - name: Success -- Report Job Status on Success
        run: |
          ./.github/scripts/notifications.sh "${NOTIFICATION}" ":white_check_mark: all checks were successful!"

      - name: Success -- Report Job Status on Failure
        if: failure()
        run: |
          ./.github/scripts/notifications.sh "${NOTIFICATION}" ":x: error reporting job status!"

  build:

    runs-on: ubuntu-latest
    strategy:
      max-parallel: 4
      matrix:
        include:
          - python-version: 3.7

    steps:
      - name: Build -- Checkout
        uses: actions/checkout@v3

      - name: Build -- Setup Environment
        run: |
          source .github/scripts/setup.sh
        env:
          WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}
          PYTHON_VERSION: ${{ matrix.python-version }}

      - name: Build -- Create Docker Mounted Content
        run: |
          echo | ssh-keygen
          touch ${HOME}/.gitconfig
          touch ${HOME}/.gitconfig_global

      - name: Build -- Build Container
        run: |
          source .github/scripts/build_container.sh

      - name: Build -- Run TOML Linter
        run: |
          docker-compose exec -T "${PROJECT_NAME}" tomll /app/pyproject.toml

      - name: Build -- Run Linter
        run: |
          docker-compose exec -T "${PROJECT_NAME}" dev lint

      - name: Build -- Run Sec Test
        run: |
          docker-compose exec -T "${PROJECT_NAME}" dev sectest

      - name: Build -- Run Unit Tests
        run: |
          docker-compose exec -T "${PROJECT_NAME}" dev coverage

      - name: Build -- Run Release Validation
        run: |
          docker-compose exec -T "${PROJECT_NAME}" ./scripts/utilities/check_release.sh

      - name: Build -- Report Job Status (Success)
        if: env.VERBOSE_NOTIFICATIONS == '1'
        run: |
          ./.github/scripts/notifications.sh "${NOTIFICATION}" ":white_check_mark: build for Python ${PYTHON_VERSION} was successful"

      - name: Build -- Report Job Status (Failure)
        if: failure()
        run: |
          ./.github/scripts/notifications.sh "${NOTIFICATION}" ":x: build for Python ${PYTHON_VERSION} failed!"

  create_release:
    needs: [_start_notification, build, dockerfile_test, documentation_test, security_test, shellcheck_test, workflow_lint_test]

    runs-on: ubuntu-latest

    steps:
      - name: Create Release -- Branch Filter
        id: branch_filter
        run: |
          MATCH="FALSE"
          [[ "${{ github.event.ref }}" =~ /tags/v\.* ]] && MATCH="TRUE"
          echo "MATCH=${MATCH}" >> $GITHUB_OUTPUT

      - name: Create Release -- Checkout
        if: steps.branch_filter.outputs.match == 'TRUE'
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Create Release -- Setup Environment
        if: steps.branch_filter.outputs.match == 'TRUE'
        run: |
          source .github/scripts/setup.sh
        env:
          WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

      - name: Create Release -- Generate Changelog
        if: steps.branch_filter.outputs.match == 'TRUE'
        run: |
          source .github/scripts/changelog.sh

      - name: Create Release -- Generate Github Release Draft
        if: steps.branch_filter.outputs.match == 'TRUE'
        id: create_release
        uses: actions/github-script@v6
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            try {
              const result = await github.rest.repos.createRelease({
                body: process.env.CHANGE_LOG_CONTENT,
                draft: true,
                name: "Release " + process.env.BRANCH_OR_TAG,
                owner: context.repo.owner,
                prerelease: false,
                repo: context.repo.repo,
                tag_name: process.env.BRANCH_OR_TAG,
              });
              return result.upload_url
            } catch (error) {
              core.setFailed(error.message);
            }

      - name: Create Release -- Report Success
        if: steps.branch_filter.outputs.match == 'TRUE'
        run: |
          ./.github/scripts/notifications.sh "${NOTIFICATION}" ":white_check_mark: automated release has been created:\nhttps://github.com/${USERNAME}/${PROJECT_NAME}/releases"

      - name: Create Release -- Report Failure
        if: failure()
        run: |
          ./.github/scripts/notifications.sh "${NOTIFICATION}" ":x: automated release generation failed!"

  dockerfile_test:

    runs-on: ubuntu-latest

    steps:
      - name: Dockerfile Test -- Checkout Repository
        uses: actions/checkout@v3

      - name: Dockerfile Test -- Setup Environment
        run: |
          source .github/scripts/setup.sh
        env:
          WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

      - name: Dockerfile Test -- Documentation Validation
        uses: hadolint/hadolint-action@v3.0.0
        with:
          dockerfile: assets/Dockerfile
          failure-threshold: error
          config: ./.hadolint.yml

      - name: Dockerfile Test -- Build the container image
        run: docker build . --file assets/Dockerfile --tag test:latest --target development

      - name: Dockerfile Test -- Scan image
        id: scan
        uses: anchore/scan-action@v3
        with:
          image: "test:latest"
          fail-build: false
          acs-report-enable: true
          severity-cutoff: critical

      - name: Dockerfile Test -- Upload Anchore scan SARIF report
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: ${{ steps.scan.outputs.sarif }}

      - name: Dockerfile Test -- Report Success
        if: env.VERBOSE_NOTIFICATIONS == '1'
        run: |
          ./.github/scripts/notifications.sh "${NOTIFICATION}" ":white_check_mark: dockerfile linting was successful!"

      - name: Dockerfile Test -- Report Failure
        if: failure()
        run: |
          ./.github/scripts/notifications.sh "${NOTIFICATION}" ":x: dockerfile linting failed!"

  documentation_test:

    runs-on: ubuntu-latest

    steps:
      - name: Documentation Test -- Checkout Repository
        uses: actions/checkout@v3

      - name: Documentation Test -- Setup Environment
        run: |
          source .github/scripts/setup.sh
        env:
          WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

      - name: Documentation Test -- Documentation Validation
        uses: gaurav-nelson/github-action-markdown-link-check@1.0.13
        with:
          config-file: './.github/config/markdown.link.check.json'
          use-quiet-mode: 'no'
          use-verbose-mode: 'yes'

      - name: Documentation Test -- Report Success
        if: env.VERBOSE_NOTIFICATIONS == '1'
        run: |
          ./.github/scripts/notifications.sh "${NOTIFICATION}" ":white_check_mark: documentation checks were successful!"

      - name: Documentation Test -- Report Failure
        if: failure()
        run: |
          ./.github/scripts/notifications.sh "${NOTIFICATION}" ":x: documentation checks failed!"

  security_test:

    runs-on: ubuntu-latest

    steps:

      - name: Security Test -- Checkout Repository
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Security Test -- Setup Environment
        run: |
          source ./.github/scripts/setup.sh
          source ./.github/scripts/pushed_commit_range.sh
        env:
          WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}
          GITHUB_CONTEXT: ${{ toJson(github) }}

      - name: Security Test -- Run Trufflehog
        uses: trufflesecurity/trufflehog@v3.20.0
        with:
          path: .
          base: ${{ env.PUSHED_COMMIT_RANGE }}
          head: ${{ env.BRANCH_OR_TAG }}

      - name: Security Test -- Report Success
        if: env.VERBOSE_NOTIFICATIONS == '1'
        run: |
          ./.github/scripts/notifications.sh "${NOTIFICATION}" ":white_check_mark: security checks were successful!"

      - name: Security Test -- Report Failure
        if: failure()
        run: |
          ./.github/scripts/notifications.sh "${NOTIFICATION}" ":x: security checks failed!"

  shellcheck_test:

    runs-on: ubuntu-latest

    steps:
      - name: Shellcheck -- Checkout Repository
        uses: actions/checkout@v3

      - name: Shellcheck -- Setup Environment
        run: |
          source .github/scripts/setup.sh
        env:
          WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

      - name: Shellcheck -- Check Scripts
        run: |
          source ./.github/scripts/lint_shellcheck.sh

      - name: Shellcheck -- Report Job Status on Success
        if: env.VERBOSE_NOTIFICATIONS == '1'
        run: |
          ./.github/scripts/notifications.sh "${NOTIFICATION}" ":white_check_mark: shellcheck checks were successful!"

      - name: Shellcheck -- Report Job Status on Failure
        if: failure()
        run: |
          ./.github/scripts/notifications.sh "${NOTIFICATION}" ":x: shellcheck checks failed!"

  workflow_lint_test:

    runs-on: ubuntu-latest

    steps:
      - name: Workflow Lint -- Checkout Repository
        uses: actions/checkout@v3

      - name: Workflow Lint -- Setup Environment
        run: |
          source ./.github/scripts/setup.sh
        env:
          WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

      - name: Workflow Lint -- Run Linter
        uses: ibiqlik/action-yamllint@v3
        with:
          format: standard
          file_or_dir: ./.github/workflows
          config_file: .yamllint.yml

      - name: Workflow Lint -- Report Job Status on Success
        if: env.VERBOSE_NOTIFICATIONS == '1'
        run: |
          ./.github/scripts/notifications.sh "${NOTIFICATION}" ":white_check_mark: workflow linting was successful!"

      - name: Workflow Lint -- Report Job Status on Failure
        if: failure()
        run: |
          ./.github/scripts/notifications.sh "${NOTIFICATION}" ":x: workflow linting has failed!"