image-and-helm-publish-check-deploy-on-push-scheduled.yml

# Scan & Publish image and helm chart on push, deployment on push, delete deployment on branch deletion, scheduled trivy scanner
name: 'Dev Pipeline'

# All triggers have to be in one file, so that the trivy results can be compared to identify introduced vulnerabilities
# See DBP-340
on:
  push:
    branches:
      - '*'
  schedule:
    - cron: '0 2 * * *'
  delete:

concurrency:
  group: schulportal-client-${{ github.event.ref }}
  cancel-in-progress: true

jobs:

  check_deployment_clearance:
      name: "Check deployment clearance"
      runs-on: ubuntu-latest
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      outputs:
        deployment_clearance: ${{ steps.determine_deployment_clearance.outputs.deployment_clearance }}
      steps:
        - name: Checkout code
          uses: actions/checkout@v2

        - name: Get PR number
          id: get_pr_number
          run: |
            PR_NUMBER=$(gh pr list --state open --head ${{ github.ref_name }} --json number --jq '.[0].number')
            if [ -z "$PR_NUMBER" ]; then
              echo "No existing PR found for ${{ github.ref_name }} "
            else
              echo "PR_NUMBER=$PR_NUMBER" >> $GITHUB_ENV
            fi

        - name: Get PR labels
          id: get_pr_labels
          if: ${{ env.PR_NUMBER != ''  }}
          run: |
            PR_LABELS=$(gh pr view ${{ env.PR_NUMBER }} --json labels --jq '.labels | map(.name) | join(",")')
            echo "PR_LABELS=$PR_LABELS" >> $GITHUB_ENV

        - name: Determine deployment clearance
          id: determine_deployment_clearance
          run: |
            if [ -z "$env.PR_NUMBER" ] || [[ ${{ ! contains(env.PR_LABELS, 'prevent_auto_deployment') }} == true ]]; then
              echo "Deployment clearance: true"
              echo "deployment_clearance=true" >> "$GITHUB_OUTPUT"
            else
              echo "Deployment clearance: false"
              echo "deployment_clearance=false" >> "$GITHUB_OUTPUT"
            fi

  codeql_analyze:
    name: 'CodeQL'
    if: ${{ github.event_name == 'push' }}
    uses: dBildungsplattform/dbp-github-workflows/.github/workflows/check-codeql.yaml@5
    permissions:
      actions: read
      contents: read
      security-events: write

  nest_lint:
    name: 'Linting'
    if: ${{ github.event_name == 'push' }}
    uses: dBildungsplattform/dbp-github-workflows/.github/workflows/check-nest-lint.yaml@5
    with:
      node_version: '18'
    permissions:
      contents: read

  tests_and_sonarcloud:
    name: 'Tests and Sonarcloud'
    if: ${{ github.event_name == 'push' }}
    uses: dBildungsplattform/dbp-github-workflows/.github/workflows/check-nest-test-sonarcloud.yaml@5
    with:
      node_version: '18'
    permissions:
      contents: read
    secrets: inherit

  build_image_on_push:
    needs:
      - check_deployment_clearance
      - create_branch_identifier
    name: 'Publish image and scan with trivy'
    if: ${{ github.event_name == 'push' && needs.check_deployment_clearance.outputs.deployment_clearance == 'true' }}
    permissions:
      packages: write
      security-events: write
      contents: read
    uses: dBildungsplattform/dbp-github-workflows/.github/workflows/image-publish-trivy.yaml@7
    with:
      image_name: 'schulportal-client'
      run_trivy_scan: true
      image_tag_generation: ${{ github.ref_name == 'main' && 'commit_hash' || 'specified' }}
      image_tag: ${{ github.ref_name == 'main' && '' || needs.create_branch_identifier.outputs.image_tag_from_branch }}
      add_latest_tag: ${{ github.ref_name == 'main' }}
      container_registry: 'ghcr.io'
      fail_on_vulnerabilites: false
      report_location: 'Dockerfile'

  scan_helm:
    uses: dBildungsplattform/dbp-github-workflows/.github/workflows/check-helm-kics.yaml@5
    permissions:
      contents: read

  select_helm_version_generation_and_image_tag_generation:
    needs:
      - check_deployment_clearance
    if: ${{ github.event_name == 'push' && !startsWith(github.ref_name,'dependabot/') && needs.check_deployment_clearance.outputs.deployment_clearance == 'true' }}
    runs-on: ubuntu-latest
    outputs:
      SELECT_HELM_VERSION_GENERATION: ${{ steps.select_generation.outputs.SELECT_HELM_VERSION_GENERATION }}
      SELECT_IMAGE_TAG_GENERATION: ${{ steps.select_generation.outputs.SELECT_IMAGE_TAG_GENERATION }}
    steps:
      - id: select_generation
        shell: bash
        run: |
          if ${{ github.ref_name == 'main' }}; then
            echo "SELECT_HELM_VERSION_GENERATION=timestamp" >> "$GITHUB_OUTPUT"
            echo "SELECT_IMAGE_TAG_GENERATION=commit_hash" >> "$GITHUB_OUTPUT"
          else
            echo "SELECT_HELM_VERSION_GENERATION=specified" >> "$GITHUB_OUTPUT"
            echo "SELECT_IMAGE_TAG_GENERATION=specified" >> "$GITHUB_OUTPUT"
          fi

  release_helm:
    uses: dBildungsplattform/dbp-github-workflows/.github/workflows/chart-release.yaml@7
    needs:
      - create_branch_identifier
      - select_helm_version_generation_and_image_tag_generation
    secrets: inherit
    with:
      chart_name: schulportal-client
      image_tag_generation: ${{ needs.select_helm_version_generation_and_image_tag_generation.outputs.SELECT_IMAGE_TAG_GENERATION }}
      image_tag: ${{ github.ref_name == 'main' && '' || needs.create_branch_identifier.outputs.image_tag_from_branch }}
      helm_chart_version_generation: ${{ needs.select_helm_version_generation_and_image_tag_generation.outputs.SELECT_HELM_VERSION_GENERATION }}
      helm_chart_version: ${{ github.ref_name == 'main' && '' || needs.create_branch_identifier.outputs.chart_version_from_branch }}

  wait_for_helm_chart_to_get_published:
    needs:
      - release_helm
    runs-on: ubuntu-latest
    steps:
      - shell: bash
        run: sleep 1m 

  branch_meta:
    if: ${{ github.event_name == 'push' && !startsWith(github.ref_name,'dependabot/') }}
    uses: dBildungsplattform/spsh-app-deploy/.github/workflows/get-branch-meta.yml@6

  create_branch_identifier:
    if: ${{ github.event_name == 'push' && !startsWith(github.ref_name,'dependabot/') }}
    needs:
      - branch_meta
    uses: dBildungsplattform/spsh-app-deploy/.github/workflows/convert-branch-name.yml@6
    with:
      branch: ${{ needs.branch_meta.outputs.branch }}

  deploy:
    if: ${{ github.event_name == 'push' && !startsWith(github.ref_name,'dependabot/') }}
    needs:
      - branch_meta
      - create_branch_identifier
      - wait_for_helm_chart_to_get_published
      - build_image_on_push
    uses: dBildungsplattform/spsh-app-deploy/.github/workflows/deploy.yml@7
    with:
      dbildungs_iam_server_branch: ${{ needs.branch_meta.outputs.ticket }}
      schulportal_client_branch: ${{ needs.branch_meta.outputs.ticket }}
      dbildungs_iam_keycloak_branch: ${{ needs.branch_meta.outputs.ticket }}
      dbildungs_iam_ldap_branch: ${{ needs.branch_meta.outputs.ticket }}
      namespace: ${{ needs.create_branch_identifier.outputs.namespace_from_branch }}
      database_recreation: "true" # to prevent database recreation this has to be set to false
    secrets: inherit

  # On Delete
  create_branch_identifier_for_deletion:
    if: ${{ github.event_name == 'delete' && github.event.ref_type == 'branch' }}
    uses: dBildungsplattform/spsh-app-deploy/.github/workflows/convert-branch-name.yml@6
    with:
      branch: ${{ github.event.ref }}

  delete_namespace:
    if: ${{ github.event_name == 'delete' && github.event.ref_type == 'branch'}}
    needs:
      - create_branch_identifier_for_deletion
    uses: dBildungsplattform/spsh-app-deploy/.github/workflows/delete-namespace.yml@5
    with:
      namespace: ${{ needs.create_branch_identifier_for_deletion.outputs.namespace_from_branch }}
    secrets:
      SPSH_DEV_KUBECONFIG: ${{ secrets.SPSH_DEV_KUBECONFIG }}

  delete_successful:
    if: ${{ github.event_name == 'delete' && github.event.ref_type == 'branch' }}
    needs:
      - delete_namespace
      - create_branch_identifier_for_deletion
    runs-on: ubuntu-latest
    steps:
      - run: echo "Deletion of namespace" ${{ needs.create_branch_identifier_for_deletion.outputs.namespace_from_branch }} "done"
  
  # Scheduled
  scheduled_trivy_scan:
    name: 'Scheduled trivy scan of latest image'
    if: ${{ github.event_name == 'schedule' }}
    permissions:
      packages: read
      security-events: write
    uses: dBildungsplattform/dbp-github-workflows/.github/workflows/check-trivy.yaml@7
    with:
      image_ref: 'ghcr.io/${{ github.repository_owner }}/schulportal-client:latest'
      fail_on_vulnerabilites: true
      report_location: 'Dockerfile'
      trivyignores: '.trivyignore'

  trivy_scan_rocketchat_notification:
    if: ${{ github.event_name == 'schedule' }} && failure()
    needs:
    - scheduled_trivy_scan
    runs-on: 'ubuntu-latest'
    steps:
    - name: Send Notification to Rocket Chat
      uses: RocketChat/Rocket.Chat.GitHub.Action.Notification@1.1.1
      with:
        type: failure
        job_name: 'Daily nightly image check failed - CVEs found so check'
        url: ${{ secrets.RC_WEBHOOK_SPSH_DEVELOPER_CHANNEL }}