docker-publish.yml

name: ui

on:
  push:
    branches:
      - "*"
    tags:
      - v*
  pull_request:

env:
  REPOSITORY_MAIN_BRANCH: "master"
  DOCKER_IMAGE_REPOSITORY: mintproject
  DOCKER_IMAGE_NAME: mic-web
  DOCKER_FILE: ".Dockerfile-actions"

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Use Node.js
        uses: actions/setup-node@v3
        with:
          node-version: "16.x"
          cache: "yarn"
      - name: Install dependencies
        run: yarn install
      - name: Build (webpack)
        run: yarn build
      - uses: actions/upload-artifact@v2
        with:
          name: nextjs-build
          path: ./build/
          retention-days: 1

  push:
    needs: test
    runs-on: ubuntu-latest
    if: github.event_name == 'push'
    steps:
      - name: Get branch name
        id: branch-name
        uses: tj-actions/branch-names@v6

      - uses: actions/checkout@v2

      - uses: actions/download-artifact@v2
        with:
          name: nextjs-build
          path: build/

      - name: Create environment variable with the commit id
        run: |
          echo "DOCKER_TAG=${GITHUB_SHA}" >> $GITHUB_ENV

      - name: Expose the commit id
        id: exposeValue
        run: |
          echo "::set-output name=docker_tag::${{ env.DOCKER_TAG }}"

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v2

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Login to DockerHub
        uses: docker/login-action@v1
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v3.0.0
        with:
          push: true
          context: .
          tags: ${{ env.DOCKER_IMAGE_REPOSITORY }}/${{ env.DOCKER_IMAGE_NAME }}:${{ steps.branch-name.outputs.current_branch }}, ${{ env.DOCKER_IMAGE_REPOSITORY }}/${{ env.DOCKER_IMAGE_NAME }}:${{ env.DOCKER_TAG }}
          file: ${{ env.DOCKER_FILE}}
          platforms: linux/amd64,linux/arm64

      - name: Running on the default branch.
        if: steps.branch-name.outputs.is_default == 'true'
        uses: docker/build-push-action@v3.0.0
        with:
          push: true
          context: .
          tags: ${{ env.DOCKER_IMAGE_REPOSITORY }}/${{ env.DOCKER_IMAGE_NAME }}:latest
          file: ${{ env.DOCKER_FILE}}
          platforms: linux/amd64,linux/arm64

  security:
    permissions:
      contents: read
      security-events: write
      packages: write
    name: "Scan vulnerabilities in the image"
    needs: [push]
    runs-on: ubuntu-latest
    steps:
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ env.DOCKER_IMAGE_REPOSITORY }}/${{ env.DOCKER_IMAGE_NAME }}:${{ needs.build.outputs.docker_tag }}
          format: "template"
          template: "@/contrib/sarif.tpl"
          output: "trivy-results.sarif"
          severity: ${{ env.VULNERABILITY_SCAN_LEVEL }}
          exit-code: "0"
          ignore-unfixed: "true"

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        if: always()
        with:
          sarif_file: "trivy-results.sarif"
  update:
    needs: push
    runs-on: ubuntu-latest
    steps:
      - name: Create environment variable with the commit id
        run: |
          echo "DOCKER_TAG=${GITHUB_SHA}" >> $GITHUB_ENV

      - name: Expose the commit id
        id: exposeValue
        run: |
          echo "::set-output name=docker_tag::${{ env.DOCKER_TAG }}"

      - name: Checkout MINT Instances Repository
        uses: actions/checkout@v3
        with:
          repository: mintproject/mint-instances
          path: infrastructure
          token: ${{ secrets.MINT_INSTANCES }}
          ref: master

      - name: Checkout MINT Chart Repository
        uses: actions/checkout@v3
        if: github.ref == 'refs/heads/master'
        with:
          repository: mintproject/mint
          path: mint-chart
          token: ${{ secrets.MINT_INSTANCES }}
          ref: main

      - name: Update MINT ISI master
        uses: fjogeleit/yaml-update-action@main
        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
        with:
          valueFile: isi/values.yaml
          propertyPath: "MINT.components.mic_ui.image.tag"
          value: ${{ env.DOCKER_TAG }}
          message: "Update mic ui"
          repository: mintproject/mint-instances
          workDir: infrastructure
          branch: master
          token: ${{ secrets.MINT_INSTANCES }}

      - name: Update MINT ISI WIFIRE
        uses: fjogeleit/yaml-update-action@main
        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
        with:
          valueFile: wifire/values.yaml
          propertyPath: "MINT.components.mic_ui.image.tag"
          value: ${{ env.DOCKER_TAG }}
          message: "Update mic ui"
          repository: mintproject/mint-instances
          workDir: infrastructure
          branch: master
          token: ${{ secrets.MINT_INSTANCES }}

      - name: Update MINT TACC
        uses: fjogeleit/yaml-update-action@main
        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
        with:
          valueFile: tacc/values.yaml
          propertyPath: "MINT.components.mic_ui.image.tag"
          value: ${{ env.DOCKER_TAG }}
          message: "Update mic ui"
          repository: mintproject/mint-instances
          workDir: infrastructure
          branch: master
          token: ${{ secrets.MINT_INSTANCES }}

      - name: Update MINT ISI dev
        uses: fjogeleit/yaml-update-action@main
        if: github.event_name == 'push' && github.ref == 'refs/heads/dev'
        with:
          valueFile: isi-dev/values.yaml
          propertyPath: "MINT.components.mic_ui.image.tag"
          value: ${{ env.DOCKER_TAG }}
          message: "Update mic ui"
          repository: mintproject/mint-instances
          workDir: infrastructure
          branch: master
          token: ${{ secrets.MINT_INSTANCES }}

      - name: Update helm charts
        uses: fjogeleit/yaml-update-action@main
        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
        with:
          valueFile: helm/values.yaml
          propertyPath: "components.mic_ui.image.tag"
          value: ${{ env.DOCKER_TAG }}
          message: "Update mic ui"
          repository: mintproject/mint
          workDir: mint-chart/
          branch: main
          token: ${{ secrets.MINT_INSTANCES }}