publish-gcp-oidc-enclave-docker.yaml

name: Publish GCP OIDC Operator
run-name: ${{ format('Publish {0} GCP OIDC Operator', inputs.release_type) }}
on:
  workflow_dispatch:
    inputs:
      release_type:
        type: choice
        description: The type of release
        options:
        - Snapshot
        - Patch
        - Minor
        - Major
      version_number_input:
        description: If set, the version number will not be incremented and the given number will be used.
        type: string
        default: ''
      vulnerability_severity:
        description: The severity to fail the workflow if such vulnerability is detected. DO NOT override it unless a Jira ticket is raised.
        type: choice
        options:
        - CRITICAL,HIGH
        - CRITICAL,HIGH,MEDIUM
        - CRITICAL (DO NOT use if JIRA ticket not raised)
  workflow_call:
    inputs:
      release_type:
        description: The type of version number to return. Must be one of [Snapshot, Patch, Minor or Major]
        required: true
        type: string
      version_number_input:
        description: If set, the version number will not be incremented and the given number will be used.
        type: string
        default: ''
      commit_sha:
        description: The commit SHA for committing the new version for pom.xml.
        type: string
        default: ''
      vulnerability_severity:
        description: The severity to fail the workflow if such vulnerability is detected. DO NOT override it unless a Jira ticket is raised. Must be one of ['CRITICAL', 'CRITICAL,HIGH' or 'CRITICAL,HIGH,MEDIUM'] (without space in between).
        type: string
        default: 'CRITICAL,HIGH'

    outputs:
      image_tag:
        description: The tag used to describe the image in Docker
        value: ${{ jobs.buildImage.outputs.image_tag }}

env:
  REGISTRY: ghcr.io
  GCP_REGISTRY: us-docker.pkg.dev
  GCP_GAR_PROJECT: uid2-prod-project
  MAVEN_PROFILE: gcp
  ENCLAVE_PROTOCOL: gcp-oidc
  IMAGE_NAME: ${{ github.repository }}
  DOCKER_CONTEXT_PATH: scripts/gcp-oidc
  ARTIFACTS_OUTPUT_DIR: ${{ github.workspace }}/deployment-artifacts
  MANIFEST_OUTPUT_DIR: ${{ github.workspace }}/manifests

jobs:
  buildImage:
    name: Build Image
    runs-on: ubuntu-latest
    permissions:
      contents: write
      security-events: write
      packages: write
      id-token: write
      pull-requests: write
    outputs:
      jar_version: ${{ steps.update_version.outputs.new_version }}
      image_tag: ${{ steps.update_version.outputs.image_tag }}
    steps:
      - name: Update Operator Version
        id: update_version
        uses: IABTechLab/uid2-operator/.github/actions/update_operator_version@main
        with:
          release_type: ${{ inputs.release_type }}
          version_number_input: ${{ inputs.version_number_input }}
          image_tag_suffix: ${{ env.ENCLAVE_PROTOCOL }}
          commit_sha: ${{ inputs.commit_sha }}

      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '21'

      - name: Package JAR
        id: package
        run: |
          mvn -B package -P ${{ env.MAVEN_PROFILE }} 
          echo "jar_version=$(mvn help:evaluate -Dexpression=project.version | grep -e '^[1-9][^\[]')" >> $GITHUB_OUTPUT
          echo "git_commit=$(git show --format="%h" --no-patch)" >> $GITHUB_OUTPUT
          cp -r target ${{ env.DOCKER_CONTEXT_PATH }}/

      - name: Log in to the Docker container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Authenticate with Google Cloud
        id: gcp_auth
        uses: google-github-actions/auth@v2
        with:
          token_format: access_token
          workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER_ID }}
          service_account: ${{ vars.GCP_SERVICE_ACCOUNT }}
          access_token_lifetime: 300s

      - name: Log in to the GCP Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.GCP_REGISTRY }}
          username: oauth2accesstoken
          password: ${{ steps.gcp_auth.outputs.access_token }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=raw,value=${{ steps.update_version.outputs.image_tag }}

      - name: Extract metadata (tags, labels) for GCP image
        id: meta-gcp
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.GCP_REGISTRY }}/${{ env.GCP_GAR_PROJECT }}/${{ env.IMAGE_NAME }}
          tags: |
            type=raw,value=${{ steps.update_version.outputs.image_tag }}

      - name: Extract metadata (tags, labels) for all Docker images
        id: meta-all
        uses: docker/metadata-action@v5
        with:
          images: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
            ${{ env.GCP_REGISTRY }}/${{ env.GCP_GAR_PROJECT }}/${{ env.IMAGE_NAME }}
          tags: |
            type=raw,value=${{ steps.update_version.outputs.new_version }}-${{ env.ENCLAVE_PROTOCOL }}

      - name: Build and export to Docker
        uses: docker/build-push-action@v5
        with:
          context: ${{ env.DOCKER_CONTEXT_PATH }}
          load: true
          tags: ${{ steps.meta-all.outputs.tags }}
          labels: ${{ steps.meta-all.outputs.labels }}
          build-args: |
            JAR_VERSION=${{ steps.update_version.outputs.new_version }}
            IMAGE_VERSION=${{ steps.update_version.outputs.new_version }}
            BUILD_TARGET=${{ env.ENCLAVE_PROTOCOL }}

      - name: Generate Trivy vulnerability scan report
        uses: aquasecurity/trivy-action@0.14.0
        with:
          image-ref: ${{ steps.meta.outputs.tags }}
          format: 'sarif'
          exit-code: '0'
          ignore-unfixed: true
          severity: 'CRITICAL,HIGH'
          output: 'trivy-results.sarif'
          hide-progress: true

      - name: Upload Trivy scan report to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'

      - name: Test with Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@0.14.0
        with:
          image-ref: ${{ steps.meta.outputs.tags }}
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          severity: ${{ inputs.vulnerability_severity }}
          hide-progress: true

      - name: Push to Docker
        id: push-to-docker
        uses: docker/build-push-action@v5
        with:
          context: ${{ env.DOCKER_CONTEXT_PATH }}
          push: true
          tags: ${{ steps.meta-all.outputs.tags }}
          labels: ${{ steps.meta-all.outputs.labels }}
          build-args: |
            JAR_VERSION=${{ steps.update_version.outputs.new_version }}
            IMAGE_VERSION=${{ steps.update_version.outputs.new_version }}

      - name: Generate GCP deployment artifacts
        env:
          IMAGE: ${{ steps.meta-gcp.outputs.tags }}
          IMAGE_DIGEST: ${{ steps.push-to-docker.outputs.digest }}
          OUTPUT_DIR: ${{ env.ARTIFACTS_OUTPUT_DIR }}
          MANIFEST_DIR: ${{ env.MANIFEST_OUTPUT_DIR}}
          VERSION_NUMBER: ${{ steps.update_version.outputs.new_version }}
        run: |
          bash ./scripts/gcp-oidc/generate-deployment-artifacts.sh

      - name: Upload deployment artifacts
        uses: actions/upload-artifact@v4
        with:
          name: gcp-oidc-deployment-files-${{ steps.update_version.outputs.new_version }}
          path: ${{ env.ARTIFACTS_OUTPUT_DIR }}
          if-no-files-found: error

      - name: Upload manifest artifacts
        uses: actions/upload-artifact@v4
        with:
          name: gcp-oidc-enclave-ids-${{ steps.update_version.outputs.new_version }}
          path: ${{ env.MANIFEST_OUTPUT_DIR }}
          if-no-files-found: error

      - name: Generate release archive
        if: ${{ inputs.version_number_input == '' && steps.update_version.outputs.is_release == 'true' }}
        run: |
            zip -j ${{ env.ARTIFACTS_OUTPUT_DIR }}/gcp-oidc-deployment-files-${{ steps.update_version.outputs.new_version }}.zip ${{ env.ARTIFACTS_OUTPUT_DIR }}/*

      - name: Build changelog
        id: github_release
        if: ${{ inputs.version_number_input == '' && steps.update_version.outputs.is_release == 'true' }}
        uses: mikepenz/release-changelog-builder-action@v4
        with:
          configurationJson: |
            {
              "template": "#{{CHANGELOG}}\n## Installation\n```\ndocker pull ${{ steps.meta.outputs.tags }}\n```\n\n## Image reference to deploy: \n```\n${{ steps.update_version.outputs.image_tag }}\n```\n\n## Changelog\n#{{UNCATEGORIZED}}",
              "pr_template": " - #{{TITLE}} - ( PR: ##{{NUMBER}} )"
            }
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Create release
        if: ${{ inputs.version_number_input == '' && steps.update_version.outputs.is_release == 'true' }}
        uses: softprops/action-gh-release@v2
        with:
          name: ${{ steps.update_version.outputs.new_version }}
          body: ${{ steps.github_release.outputs.changelog }}
          draft: true
          files: |
            ${{ env.ARTIFACTS_OUTPUT_DIR }}/gcp-oidc-deployment-files-${{ steps.update_version.outputs.new_version }}.zip
            ${{ env.MANIFEST_OUTPUT_DIR }}/gcp-oidc-enclave-id-${{ steps.update_version.outputs.new_version }}.txt
            ${{ env.MANIFEST_OUTPUT_DIR }}/gcp-oidc-enclave-id-debug-${{ steps.update_version.outputs.new_version }}.txt

  e2e:
    name: E2E
    uses: ./.github/workflows/run-e2e-tests-on-operator.yaml
    needs: buildImage
    with:
      operator_type: gcp
      operator_image_version: ${{ needs.buildImage.outputs.image_tag }}
    secrets: inherit