Skip to content

Publish main

Publish main #127

Workflow file for this run

# SPDX-FileCopyrightText: 2024 PNED G.I.E.
#
# SPDX-License-Identifier: Apache-2.0
name: Publish main
on:
workflow_run:
workflows: ["Run Tests"]
branches: [main]
types:
- completed
env:
REGISTRY: ghcr.io
IMAGE_NAME: ghcr.io/genomicdatainfrastructure/gdi-userportal-dataset-discovery-service
AZURE_WEBAPP_NAME: dataset-discovery-service-test
jobs:
ort:
strategy:
fail-fast: false
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: oss-review-toolkit/ort-ci-github-action@v1
with:
allow-dynamic-versions: "true"
fail-on: "issues"
run: "cache-dependencies,cache-scan-results,labels,analyzer,evaluator,advisor,reporter,upload-results"
publish-docker-image:
runs-on: ubuntu-latest
needs: ort
permissions:
contents: read
packages: write
steps:
- name: Log in to the Container registry
uses: docker/login-action@v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Set up GraalVM JDK 21
uses: graalvm/setup-graalvm@v1
with:
java-version: "21"
- name: Checkout repository
uses: actions/checkout@v4
- name: Build project
run: mvn package -Dnative
- name: Extract metadata (tags, labels) for Docker
id: meta
uses: docker/metadata-action@v5
with:
images: ${{ env.IMAGE_NAME }}
tags: |
type=schedule,priority=400
type=ref,event=branch,priority=600
type=ref,event=pr,priority=500
type=semver,pattern={{version}},priority=700
type=semver,pattern={{major}}.{{minor}},priority=900
type=semver,pattern={{major}},priority=800
type=sha,priority=1000
- name: Extract last tag
id: tag
run: |
IFS=',' read -ra TAGS <<< "${{ steps.meta.outputs.tags }}"
LAST_INDEX=$((${#TAGS[@]} - 1))
echo "last_tag=${TAGS[LAST_INDEX]}" >> $GITHUB_OUTPUT
- name: Build Docker image
uses: docker/build-push-action@v6
with:
context: .
push: false
tags: ${{ steps.tag.outputs.last_tag }}
labels: ${{ steps.meta.outputs.labels }}
load: true
- name: Run Trivy vulnerability scanner
uses: aquasecurity/[email protected]
with:
image-ref: "${{ steps.tag.outputs.last_tag }}"
format: "table"
exit-code: "1"
ignore-unfixed: true
vuln-type: "os,library"
severity: "CRITICAL"
env:
TRIVY_SKIP_DB_UPDATE: true
TRIVY_SKIP_JAVA_DB_UPDATE: true
- name: Push Docker image
uses: docker/build-push-action@v6
with:
context: .
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
- name: Deploy to Azure Web App
id: deploy-to-webapp
uses: azure/webapps-deploy@v3
with:
app-name: ${{ env.AZURE_WEBAPP_NAME }}
publish-profile: ${{ secrets.AZURE_WEBAPP_PUBLISH_PROFILE }}
images: "${{ steps.tag.outputs.last_tag }}"