publish-gcp-oidc-enclave-docker.yaml

name: Publish GCP OIDC Operator
run-name: ${{ format('Publish {0} GCP OIDC Operator', inputs.release_type) }}
on:
  workflow_dispatch:
    inputs:
      release_type:
        type: choice
        description: The type of release
        options:
        - Major
        - Minor
        - Patch
        - Snapshot
      version_number_input:
        description: If set, the version number will not be incremented and the given number will be used.
        type: string
        default: ''
      vulnerability_severity:
        description: The severity to fail the workflow if such vulnerability is detected. DO NOT override it unless a Jira ticket is raised. Must be one of ['CRITICAL', 'CRITICAL,HIGH' or 'CRITICAL,HIGH,MEDIUM'] (without space in between).
        type: string
        default: 'CRITICAL,HIGH'
  workflow_call:
    inputs:
      release_type:
        description: The type of version number to return. Must be one of [Snapshot, Patch, Minor or Major]
        required: true
        type: string
      version_number_input:
        description: If set, the version number will not be incremented and the given number will be used.
        type: string
        default: ''
      vulnerability_severity:
        description: The severity to fail the workflow if such vulnerability is detected. DO NOT override it unless a Jira ticket is raised. Must be one of ['CRITICAL', 'CRITICAL,HIGH' or 'CRITICAL,HIGH,MEDIUM'] (without space in between).
        type: string
        default: 'CRITICAL,HIGH'

    outputs:
      image_tag:
        description: The tag used to describe the image in Docker
        value: ${{ jobs.buildImage.outputs.image_tag }}

env:
  REGISTRY: ghcr.io
  GCP_REGISTRY: us-docker.pkg.dev
  GCP_GAR_PROJECT: uid2-prod-project
  MAVEN_PROFILE: gcp
  ENCLAVE_PROTOCOL: gcp-oidc
  IMAGE_NAME: ${{ github.repository }}
  DOCKER_CONTEXT_PATH: scripts/gcp-oidc
  ARTIFACTS_OUTPUT_DIR: ${{ github.workspace }}/deployment-artifacts
  MANIFEST_OUTPUT_DIR: ${{ github.workspace }}/manifests

jobs:
  buildImage:
    name: Build Image
    runs-on: ubuntu-latest
    permissions:
      contents: write
      security-events: write
      packages: write
      id-token: write
      pull-requests: write
    outputs:
      jar_version: ${{ steps.version.outputs.new_version }}
      image_tag: ${{ steps.updatePom.outputs.image_tag }}
    steps:
      - name: Check branch and release type
        id: checkRelease
        uses: IABTechLab/uid2-shared-actions/actions/check_branch_and_release_type@v2.2.2
        with:
          release_type: ${{ inputs.release_type }}

      - name: Show Context
        run: |
          printenv
          echo "$GITHUB_CONTEXT"
        shell: bash
        env: 
            GITHUB_CONTEXT: ${{ toJson(github) }}
            IS_RELEASE: ${{ steps.checkRelease.outputs.is_release }}

      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '11'

      - name: Checkout full history on Main
        uses: actions/checkout@v4
        if: ${{ inputs.version_number_input == ''}}
        with:
          # git-restore-mtime requires full git history. The default fetch-depth value (1) creates a shallow checkout.
          fetch-depth: 0

      - name: Checkout full history at tag v${{ inputs.version_number_input }}
        uses: actions/checkout@v4
        if: ${{ inputs.version_number_input != ''}}
        with:
          ref: v${{ inputs.version_number_input }}
          # git-restore-mtime requires full git history. The default fetch-depth value (1) creates a shallow checkout.
          fetch-depth: 0

      - name: Restore timestamps
        uses: thetradedesk/git-restore-mtime-action@v1.3

      - name: Set version number
        id: version
        uses: IABTechLab/uid2-shared-actions/actions/version_number@main
        with:
          type: ${{ inputs.release_type }}
          version_number: ${{ inputs.version_number_input }}
          branch_name: ${{ github.ref }}

      - name: Update pom.xml
        id: updatePom
        run: |
          current_version=$(grep -o '<version>.*</version>' pom.xml | head -1 | sed 's/<version>\(.*\)<\/version>/\1/')
          new_version=${{ steps.version.outputs.new_version }} 
          sed -i "0,/$current_version/s/$current_version/$new_version/" pom.xml
          echo "Version number updated from $current_version to $new_version"
          echo "image_tag=${{ steps.version.outputs.new_version }}-${{ env.ENCLAVE_PROTOCOL }}" >> $GITHUB_OUTPUT

      - name: Package JAR
        id: package
        run: |
          mvn -B package -P ${{ env.MAVEN_PROFILE }} 
          echo "jar_version=$(mvn help:evaluate -Dexpression=project.version | grep -e '^[1-9][^\[]')" >> $GITHUB_OUTPUT
          echo "git_commit=$(git show --format="%h" --no-patch)" >> $GITHUB_OUTPUT
          cp -r target ${{ env.DOCKER_CONTEXT_PATH }}/

      - name: Commit pom.xml and version.json
        if: ${{ inputs.version_number_input == '' && steps.checkRelease.outputs.is_release != 'true' }} 
        uses: IABTechLab/uid2-shared-actions/actions/commit_pr_and_merge@v2
        with:
          add: 'pom.xml version.json'
          message: 'Released ${{ inputs.release_type }} version: ${{ steps.version.outputs.new_version }}'

      - name: Commit pom.xml, version.json and set tag
        if: ${{ inputs.version_number_input == '' && steps.checkRelease.outputs.is_release == 'true' }} 
        uses: IABTechLab/uid2-shared-actions/actions/commit_pr_and_merge@v2
        with:
          add: 'pom.xml version.json'
          message: 'Released ${{ inputs.release_type }} version: ${{ steps.version.outputs.new_version }}'
          tag: v${{ steps.version.outputs.new_version }}

      - name: Log in to the Docker container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Authenticate with Google Cloud
        id: gcp_auth
        uses: google-github-actions/auth@v2
        with:
          token_format: access_token
          workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER_ID }}
          service_account: ${{ vars.GCP_SERVICE_ACCOUNT }}
          access_token_lifetime: 300s

      - name: Log in to the GCP Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.GCP_REGISTRY }}
          username: oauth2accesstoken
          password: ${{ steps.gcp_auth.outputs.access_token }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=raw,value=${{ steps.updatePom.outputs.image_tag }}

      - name: Extract metadata (tags, labels) for GCP image
        id: meta-gcp
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.GCP_REGISTRY }}/${{ env.GCP_GAR_PROJECT }}/${{ env.IMAGE_NAME }}
          tags: |
            type=raw,value=${{ steps.updatePom.outputs.image_tag }}

      - name: Extract metadata (tags, labels) for all Docker images
        id: meta-all
        uses: docker/metadata-action@v5
        with:
          images: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
            ${{ env.GCP_REGISTRY }}/${{ env.GCP_GAR_PROJECT }}/${{ env.IMAGE_NAME }}
          tags: |
            type=raw,value=${{ steps.version.outputs.new_version }}-${{ env.ENCLAVE_PROTOCOL }}

      - name: Build and export to Docker
        uses: docker/build-push-action@v5
        with:
          context: ${{ env.DOCKER_CONTEXT_PATH }}
          load: true
          tags: ${{ steps.meta-all.outputs.tags }}
          labels: ${{ steps.meta-all.outputs.labels }}
          build-args: |
            JAR_VERSION=${{ steps.version.outputs.new_version }}
            IMAGE_VERSION=${{ steps.version.outputs.new_version }}
            BUILD_TARGET=${{ env.ENCLAVE_PROTOCOL }}

      - name: Generate Trivy vulnerability scan report
        uses: aquasecurity/trivy-action@0.14.0
        with:
          image-ref: ${{ steps.meta.outputs.tags }}
          format: 'sarif'
          exit-code: '0'
          ignore-unfixed: true
          severity: 'CRITICAL,HIGH'
          output: 'trivy-results.sarif'
          hide-progress: true

      - name: Upload Trivy scan report to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'

      - name: Test with Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@0.14.0
        with:
          image-ref: ${{ steps.meta.outputs.tags }}
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          severity: ${{ inputs.vulnerability_severity }}
          hide-progress: true

      - name: Push to Docker
        id: push-to-docker
        uses: docker/build-push-action@v5
        with:
          context: ${{ env.DOCKER_CONTEXT_PATH }}
          push: true
          tags: ${{ steps.meta-all.outputs.tags }}
          labels: ${{ steps.meta-all.outputs.labels }}
          build-args: |
            JAR_VERSION=${{ steps.version.outputs.new_version }}
            IMAGE_VERSION=${{ steps.version.outputs.new_version }}

      - name: Generate GCP deployment artifacts
        env:
          IMAGE: ${{ steps.meta-gcp.outputs.tags }}
          IMAGE_DIGEST: ${{ steps.push-to-docker.outputs.digest }}
          OUTPUT_DIR: ${{ env.ARTIFACTS_OUTPUT_DIR }}
          MANIFEST_DIR: ${{ env.MANIFEST_OUTPUT_DIR}}
          VERSION_NUMBER: ${{ steps.version.outputs.new_version }}
        run: |
          bash ./scripts/gcp-oidc/generate-deployment-artifacts.sh

      - name: Upload deployment artifacts
        uses: actions/upload-artifact@v4
        with:
          name: gcp-oidc-deployment-files-${{ steps.meta.outputs.version }}
          path: ${{ env.ARTIFACTS_OUTPUT_DIR }}
          if-no-files-found: error

      - name: Upload manifest artifacts
        uses: actions/upload-artifact@v4
        with:
          name: gcp-oidc-enclave-ids-${{ steps.meta.outputs.version }}
          path: ${{ env.MANIFEST_OUTPUT_DIR }}
          if-no-files-found: error

      - name: Generate release archive
        if: ${{ inputs.version_number_input == '' && steps.checkRelease.outputs.is_release == 'true' }}
        run: |
            zip -j ${{ env.ARTIFACTS_OUTPUT_DIR }}/uid2-operator-deployment-artifacts-${{ steps.meta.outputs.version }}.zip ${{ env.ARTIFACTS_OUTPUT_DIR }}/*

      - name: Build changelog
        id: github_release
        if: ${{ inputs.version_number_input == '' && steps.checkRelease.outputs.is_release == 'true' }}
        uses: mikepenz/release-changelog-builder-action@v4
        with:
          configurationJson: |
            {
              "template": "#{{CHANGELOG}}\n## Installation\n```\ndocker pull ${{ steps.meta.outputs.tags }}\n```\n\n## Image reference to deploy: \n```\n${{ steps.updatePom.outputs.image_tag }}\n```\n\n## Changelog\n#{{UNCATEGORIZED}}",
              "pr_template": " - #{{TITLE}} - ( PR: ##{{NUMBER}} )"
            }
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Create release
        if: ${{ inputs.version_number_input == '' && steps.checkRelease.outputs.is_release == 'true' }}
        uses: softprops/action-gh-release@v2
        with:
          name: ${{ steps.version.outputs.new_version }}
          body: ${{ steps.github_release.outputs.changelog }}
          draft: true
          files: |
            ${{ env.ARTIFACTS_OUTPUT_DIR }}/uid2-operator-deployment-artifacts-${{ steps.meta.outputs.version }}.zip
            ${{ env.MANIFEST_OUTPUT_DIR }}/enclave_id_${{ steps.meta.outputs.version }}.txt
            ${{ env.MANIFEST_OUTPUT_DIR }}/enclave_id_debug_${{ steps.meta.outputs.version }}.txt

  e2e:
    name: E2E
    uses: ./.github/workflows/run-e2e-tests-on-operator.yaml
    needs: buildImage
    with:
      operator_type: gcp
      operator_image_version: ${{ needs.buildImage.outputs.image_tag }}
    secrets: inherit