docker.yml

---
name: CI
on:
  push:
    branches:
      - main
    paths:
      - "bump-api.py"
      - "Dockerfile"
      - "test/**"
      - "Pipfile"
      - "Pipfile.lock"
      - "requirements.txt"
      - ".github/workflows/docker.yml"
  pull_request:
    branches:
      - main
    paths:
      - "bump-api.py"
      - "Dockerfile"
      - "test/**"
      - "Pipfile"
      - "Pipfile.lock"
      - "requirements.txt"
      - ".github/workflows/docker.yml"
  workflow_dispatch:

env:
  REGISTRY: docker.io
  OWNER: ${{ github.repository_owner }}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  python-test:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: true
      matrix:
        python-version: ["3.10", "3.11", "3.12"]
    steps:
    - name: Check out repository code
      uses: actions/checkout@v4
    - name: Python ${{ matrix.python-version }} setup
      uses: actions/setup-python@v4
      with:
        python-version: ${{ matrix.python-version }}
    - name: pip install
      run: |
        pip install -r requirements.txt
        pip install flake8
        flake8 . --count --show-source --statistics --ignore=E111,E501 --exit-zero --output-file=flake8tmp.txt

  build:
    runs-on: ubuntu-latest
    needs: [python-test]
    steps:
    - name: Check out repository code
      uses: actions/checkout@v4
    - name: Set Tag Names
      run: |
        echo "TAG=$(echo ${GITHUB_REF##*/})" >> $GITHUB_ENV
        echo "DATE=v$(echo `date +'%Y.%m'`)" >> $GITHUB_ENV
        echo "REPO_NAME=$(echo ${PWD##*/})" >> $GITHUB_ENV
    - name: Login to DockerHub
      uses: docker/login-action@v3
      if: success()
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ secrets.DOCKER_USERNAME }}
        password: ${{ secrets.DOCKER_PASSWORD }}

    - name: Build and push Docker image - (MAIN)
      uses: docker/build-push-action@v5
      if: success()
      env:
        DOCKER_BUILDKIT: 1
      with:
        context: .
        file: ./Dockerfile
        platforms: linux/amd64
        build-args: |
          BUILD_ID=${{ env.DATE }}
        pull: true
        push: true
        tags: ${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_NAME }}:${{ env.TAG == 'main' && 'latest' || env.TAG }}

    - name: Build and push Docker image - (DATE)
      uses: docker/build-push-action@v5
      if: ${{ github.event_name == 'schedule' || contains(github.ref, 'main') }}
      env:
        DOCKER_BUILDKIT: 1
      with:
        context: .
        file: ./Dockerfile
        platforms: linux/amd64
        build-args: |
          BUILD_ID=${{ env.DATE }}
        pull: true
        push: true
        tags: ${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_NAME }}:${{ env.DATE }}

    - name: Run Trivy vulnerability scanner
      uses: aquasecurity/trivy-action@master
      if: success()
      with:
        image-ref: ${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.REPO_NAME }}:${{ env.TAG == 'main' && 'latest' || env.TAG }}
        format: 'sarif'
        output: 'trivy-results.sarif'

    - name: Upload Trivy scan results to GitHub Security tab
      uses: github/codeql-action/upload-sarif@v2
      if: success()
      with:
        sarif_file: 'trivy-results.sarif'

  k8s-test:
    runs-on: ubuntu-latest
    needs: [build]
    if: ${{ ! contains(github.ref, 'main') && github.event_name != 'schedule' }}
    steps:
      - name: Create k8s Kind Cluster
        uses: helm/kind-action@v1.8.0
      - name: Checkout
        uses: actions/checkout@v4
      - name: Run K8s test
        run: |
          kubectl cluster-info
          kubectl version --short
          export NS=`cat deployment/kustomization.yml  | grep namespace | awk '{ print $2 }'`
          if [ -z "$NS" ]; then
            export NS='cicd'
          fi
          kubectl create namespace $NS
          kubectl apply -n $NS -k deployment/
          kubectl get all -A

  auto-approve:
    runs-on: ubuntu-latest
    needs: [build, k8s-test]
    if: ${{ github.event_name == 'pull_request' }}
    steps:
    - name: Auto Approve PR
      uses: actions/github-script@v6
      with:
       script: |
        github.rest.pulls.createReview({
          owner: context.repo.owner,
          repo: context.repo.repo,
          pull_number: context.issue.number,
          event: "APPROVE"
        })

  auto-preview:
    runs-on: ubuntu-latest
    needs: [auto-approve]
    if: ${{ github.event_name == 'pull_request' }}
    steps:
    - name: Add Preview Label
      uses: actions/github-script@v6
      with:
        script: |
          github.rest.issues.addLabels({
            issue_number: context.issue.number,
            owner: context.repo.owner,
            repo: context.repo.repo,
            labels: ['preview']
          })