docker-ci-cd.yml

name: Docker CI/CD with Bun and Snyk

on:
  push:
    branches: ["master"]
  pull_request:
    branches: ["master"]

permissions:
  contents: read
  security-events: write
  packages: write

env:
  DOCKER_BUILDKIT: 1
  COMPOSE_DOCKER_CLI_BUILD: 1
  BUILDX_NO_DEFAULT_LOAD: true
  BUILDKIT_INLINE_CACHE: 1
  BUILDX_CACHE_TTL: "168h"
  COSIGN_VERSION: "v2.2.2"
  SYFT_VERSION: "v1.0.0"
  COSIGN_YES: "true"
  COSIGN_EXPERIMENTAL: "true"
  BUILDKIT_PROGRESS: plain
  ACTIONS_RUNTIME_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  DOCKER_BUILDX_CACHE_DIR: /home/pi/.buildx-cache

jobs:
  build-and-deploy:
    runs-on: self-hosted
    steps:
      - uses: actions/checkout@v4

      - name: Install verification tools
        shell: bash
        run: |
          # Create directories first
          mkdir -p "${GITHUB_WORKSPACE}/bin"
          mkdir -p "${GITHUB_WORKSPACE}/tmp"
          
          cd "${GITHUB_WORKSPACE}/tmp"

          # Install cosign
          curl -Lo cosign "https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64"
          chmod +x cosign
          mv cosign "${GITHUB_WORKSPACE}/bin/"

          # Install syft
          SYFT_RELEASE=$(curl -s https://api.github.com/repos/anchore/syft/releases/latest | grep -o '"tag_name": ".*"' | cut -d'"' -f4)
          curl -Lo syft.tar.gz "https://github.com/anchore/syft/releases/download/${SYFT_RELEASE}/syft_${SYFT_RELEASE#v}_linux_amd64.tar.gz"
          tar xzf syft.tar.gz syft
          mv syft "${GITHUB_WORKSPACE}/bin/"

          # Add to PATH
          echo "${GITHUB_WORKSPACE}/bin" >> $GITHUB_PATH

          # Cleanup
          cd "${GITHUB_WORKSPACE}"
          rm -rf "${GITHUB_WORKSPACE}/tmp"

          # Verify installations
          "${GITHUB_WORKSPACE}/bin/cosign" version || true
          "${GITHUB_WORKSPACE}/bin/syft" --version || true

      - name: Install additional security tools
        run: |
          # Install jq if not present
          if ! command -v jq &> /dev/null; then
            sudo apt-get update && sudo apt-get install -y jq
          fi

      # Initial Setup
      - name: Set build timestamp
        id: timestamp
        run: echo "BUILD_TIMESTAMP=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_ENV

      - name: Setup environment files
        env:
          ENV_PRODUCTION: ${{ secrets.ENV_PRODUCTION }}
        run: |
          echo "$ENV_PRODUCTION" > .env.production
          cp .env.production .env

      - name: Set metadata variables
        run: |
          # Use quotes to properly handle values with special characters
          echo "IMAGE_DESCRIPTION='Capella Document Search is a web application that allows you to search for documents within Capella scopes and collections. Built with Bun, Svelte, and ELysiaJS.'" >> $GITHUB_ENV
          echo "IMAGE_LICENSE='MIT'" >> $GITHUB_ENV

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: docker.io/zx8086/capella-document-search
          labels: |
            org.opencontainers.image.title=capella-document-search
            org.opencontainers.image.description=${{ env.IMAGE_DESCRIPTION }}
            org.opencontainers.image.created=${BUILD_TIMESTAMP}
            org.opencontainers.image.version=${GITHUB_REF_NAME:-2.0.0}
            org.opencontainers.image.revision=${GITHUB_SHA}
            org.opencontainers.image.authors=Simon Owusu <simonowusupvh@gmail.com>
            org.opencontainers.image.vendor=Siobytes
            org.opencontainers.image.licenses=${{ env.IMAGE_LICENSE }}
            org.opencontainers.image.url=https://github.com/zx8086/capella-document-search
            org.opencontainers.image.source=https://github.com/zx8086/capella-document-search
            org.opencontainers.image.documentation=https://github.com/zx8086/capella-document-search/README.md
            org.opencontainers.image.base.name=oven/bun:canary-alpine
            org.opencontainers.image.source.repository=github.com/zx8086/capella-document-search
            org.opencontainers.image.source.branch=${GITHUB_REF_NAME:-master}
            org.opencontainers.image.source.commit=${GITHUB_SHA}
            com.capellaql.maintainer=Simon Owusu <simonowusupvh@gmail.com>
            com.capellaql.release-date=${BUILD_TIMESTAMP}
            com.capellaql.version.is-production=true
            org.opencontainers.image.ref.name=${GITHUB_REF_NAME:-master}
            org.opencontainers.image.version.semver=${GITHUB_REF_NAME:-2.0.0}
            org.opencontainers.image.version.major=2
            org.opencontainers.image.version.minor=0
            org.opencontainers.image.version.patch=0
          tags: |
            type=raw,value=latest,enable={{is_default_branch}}
            type=sha,format=long
            type=ref,event=branch
            type=ref,event=tag

      # Platform and runtime setup
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
        with:
          platforms: linux/amd64,linux/arm64

      - name: Set up Bun
        uses: oven-sh/setup-bun@v1
        with:
          bun-version: latest

      - name: Cache Bun dependencies
        uses: actions/cache@v3
        with:
          path: |
            ~/.bun/install/cache
            node_modules
          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lockb', '**/package.json') }}
          restore-keys: |
            ${{ runner.os }}-bun-

      # Security scanning section
      - name: Run Snyk code scan
        continue-on-error: true
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        run: |
          bun install
          bun run snyk test --file=package.json --sarif-file-output=snyk.sarif --severity-threshold=high
          bun run snyk monitor --file=package.json

      - name: Upload Snyk code scan results
        if: hashFiles('snyk.sarif') != ''
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: snyk.sarif
          category: snyk-code

      # Docker build setup
      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          platforms: linux/amd64,linux/arm64

      # Build and push section
      - name: Build and push Docker image
        id: docker_build
        uses: docker/build-push-action@v6
        with:
          context: .
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          platforms: linux/amd64,linux/arm64
          cache-from: |
            type=registry,ref=docker.io/zx8086/capella-document-search:buildcache
          cache-to: |
            type=registry,ref=docker.io/zx8086/capella-document-search:buildcache,mode=max
          outputs: ${{ github.event_name == 'pull_request' && 'type=cacheonly' || 'type=registry' }}
          provenance: false

      - name: Verify image
        if: github.event_name != 'pull_request'
        run: |
          # Wait for image to be available
          sleep 15
          
          # Verify the image and its architectures
          echo "Verifying image manifest..."
          docker buildx imagetools inspect docker.io/zx8086/capella-document-search:latest

      - name: Validate image metadata
        if: github.event_name != 'pull_request'
        run: |
          IMAGE_REF="docker.io/zx8086/capella-document-search:latest"
          echo "Validating image metadata..."
          docker buildx imagetools inspect ${IMAGE_REF} --format '{{json .}}' | jq .

      - name: Verify image attestations
        if: github.event_name != 'pull_request'
        continue-on-error: true
        run: |
          # Set results directory name first
          TIMESTAMP=$(date +%Y%m%d_%H%M%S)
          RESULTS_DIR="attestation-results-${TIMESTAMP}"
          echo "ATTESTATION_RESULTS_DIR=${RESULTS_DIR}" >> $GITHUB_ENV
          
          mkdir -p "${RESULTS_DIR}"
          
          # Get image digest and reference
          echo "Getting image digest..."
          IMAGE_REF="docker.io/zx8086/capella-document-search:latest"
          IMAGE_DIGEST=$(docker buildx imagetools inspect "${IMAGE_REF}" --raw | jq -r '.manifests[0].digest')
          IMAGE_WITH_DIGEST="${IMAGE_REF}@${IMAGE_DIGEST}"

          echo "Image reference: ${IMAGE_REF}"
          echo "Image digest: ${IMAGE_DIGEST}"

          # Additional verification methods
          echo "Attempting direct verification..."
          cosign verify-attestation \
            --certificate-identity-regexp=".*" \
            --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
            "${IMAGE_WITH_DIGEST}" > "${RESULTS_DIR}/direct-attestation.json" 2>/dev/null || true

          echo "Attempting SLSA verification..."
          cosign verify-attestation \
            --type slsaprovenance \
            --certificate-identity-regexp=".*" \
            --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
            "${IMAGE_WITH_DIGEST}" > "${RESULTS_DIR}/slsa-attestation.json" 2>/dev/null || true

          echo "Attempting predicate-less verification..."
          cosign verify-attestation \
            --certificate-identity-regexp=".*" \
            --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
            "${IMAGE_WITH_DIGEST}" > "${RESULTS_DIR}/predicate-attestation.json" 2>/dev/null || true

          # Download all attestations for analysis
          echo "Downloading attestations..."
          cosign download attestation "${IMAGE_WITH_DIGEST}" > "${RESULTS_DIR}/all-attestations.json" 2>/dev/null || true

          # Extract from manifest and save all data
          echo "Extracting from manifest..."
          docker buildx imagetools inspect "${IMAGE_WITH_DIGEST}" --raw > "${RESULTS_DIR}/manifest.json"
          jq '.manifests[].annotations | select(."org.opencontainers.image.attestations" != null)' \
            "${RESULTS_DIR}/manifest.json" > "${RESULTS_DIR}/manifest-attestations.json" 2>/dev/null || true

          # Check results
          VERIFICATION_SUCCESS=false
          for file in "${RESULTS_DIR}"/*.json; do
            if [ -s "$file" ] && jq -e . >/dev/null 2>&1 < "$file"; then
              VERIFICATION_SUCCESS=true
              echo "✅ Found valid data in $(basename "$file")"
            fi
          done

          # Generate comprehensive report
          {
            echo "### 📝 Attestation Verification Report"
            echo "- Image: ${IMAGE_REF}"
            echo "- Digest: ${IMAGE_DIGEST}"
            echo "- Timestamp: $(date -u)"
            echo ""
            echo "#### Verification Results:"

            for file in "${RESULTS_DIR}"/*.json; do
              if [ -s "$file" ]; then
                basename=$(basename "$file")
                size=$(wc -c < "$file")
                echo "- File: ${basename}"
                echo "  - Size: ${size} bytes"
                if jq -e . >/dev/null 2>&1 < "$file"; then
                  echo "  - Status: ✅ Valid JSON"
                  echo "  - Content Preview:"
                  jq -r 'try .predicateType // "No predicate type"' "$file" | head -n 1
                else
                  echo "  - Status: ⚠️ Invalid JSON"
                fi
              fi
            done

            echo ""
            echo "#### Overall Status:"
            if [ "$VERIFICATION_SUCCESS" = true ]; then
              echo "✅ Successfully found attestation data"
            else
              echo "⚠️ No attestations could be verified"
            fi
          } > "${RESULTS_DIR}/verification-report.md"

          # Set output directory for next step
          echo "VERIFICATION_SUCCESS=${VERIFICATION_SUCCESS}" >> $GITHUB_ENV

      - name: Upload attestation results
        if: github.event_name != 'pull_request'
        uses: actions/upload-artifact@v4
        with:
          name: attestation-results
          path: |
            ${{ env.ATTESTATION_RESULTS_DIR }}/*.json
            ${{ env.ATTESTATION_RESULTS_DIR }}/*.md
          retention-days: 90

      - name: Verify SBOM
        if: github.event_name != 'pull_request'
        run: |
          mkdir -p sbom-output
          syft docker.io/zx8086/capella-document-search:latest \
            -o json=sbom-output/syft-sbom.json \
            -o spdx-json=sbom-output/spdx-sbom.json \
            -o cyclonedx-json=sbom-output/cyclonedx-sbom.json

      - name: Upload SBOM Files
        if: github.event_name != 'pull_request'
        uses: actions/upload-artifact@v4
        with:
          name: sbom-files
          path: sbom-output/
          retention-days: 90

      # Testing section
      - name: Test container
        if: github.event_name != 'pull_request'
        run: |
          # Get the runner's architecture
          RUNNER_ARCH=$(uname -m)
          
          # Stop existing containers using port 3000
          docker ps -q --filter publish=3000 | xargs -r docker stop
          docker rm -f capella-search-test 2>/dev/null || true
          
          # Run container (will automatically use correct architecture)
          docker run -d \
            --name capella-search-test \
            -p 3000:3000 \
            --env-file .env \
            -e NODE_ENV=production \
            -e BUILD_VERSION=${{ github.ref_name || '0.0.1' }} \
            -e COMMIT_HASH=${{ github.sha }} \
            -e BUILD_DATE=${{ env.BUILD_TIMESTAMP }} \
            -e ENABLE_FILE_LOGGING=false \
            -e LOG_MAX_FILES=7d \
            -e LOG_MAX_SIZE=10m \
            -e LOG_LEVEL=info \
            zx8086/capella-document-search:latest
          
          # Add delay and better error handling
          sleep 15
          if ! docker ps | grep -q capella-search-test; then
            echo "Container failed to start. Showing logs:"
            docker logs capella-search-test
            exit 1
          fi

          # Capture metrics
          CONTAINER_STATUS=$(docker inspect --format='{{.State.Status}}' capella-search-test)
          echo "CONTAINER_STATUS=${CONTAINER_STATUS}" >> $GITHUB_ENV
          echo "CONTAINER_START_TIME=$(docker inspect --format='{{.State.StartedAt}}' capella-search-test)" >> $GITHUB_ENV

      # Container security scanning
      - name: Run Snyk container scan
        continue-on-error: true
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        run: |
          # Install Snyk as a project dependency
          bun add snyk

          # Run Snyk container test
          echo "Running Snyk scan..."
          bun run snyk container test docker.io/zx8086/capella-document-search:latest \
            --file=Dockerfile \
            --severity-threshold=high \
            --sarif-file-output=snyk-docker.sarif \
            --json > snyk-report.json || echo "Vulnerabilities found but continuing..."
            
          if [[ "${{ github.ref }}" == "refs/heads/master" ]]; then
            bun run snyk container monitor docker.io/zx8086/capella-document-search:latest \
              --file=Dockerfile || echo "Monitor command failed but continuing..."
          fi

      - name: Upload Docker Snyk scan results
        if: always() && hashFiles('snyk-docker.sarif') != ''
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: snyk-docker.sarif
          category: snyk-docker

      # Build Summary
      - name: Docker Build Summary
        if: always()
        run: |
          {
            echo "### 🐳 Docker Build Summary"
            echo ""
            echo "#### 📊 Build Overview"
            echo "| Metric | Value |"
            echo "|--------|-------|"
            echo "| 🆔 Build ID | \`${GITHUB_SHA::7}\` |"
            echo "| 📦 Image | capella-document-search |"
            echo "| ⚡ Status | ${CONTAINER_STATUS:-N/A} |"
            
            # Container Status
            if [ "${CONTAINER_STATUS:-}" = "running" ]; then
              STATS=$(docker stats capella-search-test --no-stream --format "{{.CPUPerc}},{{.MemUsage}},{{.NetIO}},{{.BlockIO}}")
              echo "| 🔄 Status | ✅ Running |"
              echo "| 🕒 Start Time | ${CONTAINER_START_TIME} |"
            else
              echo "| 🔄 Status | ⚠️ Not Running |"
            fi
          } >> $GITHUB_STEP_SUMMARY

      # Cleanup
      - name: Cleanup
        if: always()
        run: |
          rm -f .env .env.production
          rm -f snyk.sarif snyk-docker.sarif
          docker container rm -f capella-search-test || true
          docker image prune -f
          docker volume prune -f
          docker builder prune -a -f
          rm -rf node_modules
          rm -rf security-artifacts
          rm -rf /usr/local/bin/syft
          rm -rf ~/.sigstore
          echo "Cleanup completed"
      - name: Verify metadata
        continue-on-error: true
        shell: bash
        run: |
          echo "Verifying metadata output..."
          
          # Store metadata JSON in a file to avoid shell interpretation issues
          echo '${{ steps.meta.outputs.json }}' > metadata.json
          
          if [ -s metadata.json ]; then
            echo "Processing metadata..."
            jq -r '.labels | keys[]' metadata.json 2>/dev/null || echo "No labels found"
          else
            echo "⚠️ Warning: No metadata JSON output found"
          fi
          
          echo "Metadata verification completed"