commit-stage.yml

name: Commit Stage
on: push

jobs:
  build:
    name: Build and Test
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Checkout source code
        uses: actions/checkout@v4
      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 17
          cache: gradle
      - name: Code vulnerability scanning
        uses: anchore/scan-action@v3
        id: scan
        with:
          path: "${{ github.worspace }}"
          fail-build: false
          severity-cutoff: high
          acs-report-enable: true
      - name: Upload vulnerability report
        uses: github/codeql-action/upload-sarif@v3
        if: success() || failure()
        with:
          sarif_file: "${{ steps.scan.outputs.sarif }}"
      - name: Build, unit tests and integration tests
        run: |
          chmod +x gradlew
          ./gradlew build
      - name: Validate Kubernetes manifests
        uses: stefanprodan/kube-tools@v1
        with:
          kubectl: 1.28.3
          kubeval: 0.16.1
          command: |
            kubeval --strict -d mall-catalog/k8s


  package:
    name: Package and Publish
    if: ${{ github.ref == 'refs/heads/main' }}
    needs: [ build ]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      security-events: write
    steps:
      - name: checkout source code
        uses: actions/checkout@v4
      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 17
          cache: gradle
      - name: Build container image
        run: |
          chmod +x gradlew
          ./gradlew :mall-catalog:bootBuildImage \
          --imageName ghcr.io/${{ github.actor }}/catalog-service:latest
      - name: OCI image vulnerability scanning
        uses: anchore/scan-action@v3
        id: scan
        with:
          image: ghcr.io/${{ github.actor }}/catalog-service:latest
          fail-build: false
          severity-cutoff: high
          acs-report-enable: true
      - name: Upload vulnerability report
        uses: github/codeql-action/upload-sarif@v3
        if: success() || failure()
        with:
          sarif_file: "${{ steps.scan.outputs.sarif }}"
#      - name: Log into container registry
#        uses: docker/login-action@v3
#        with:
#          registry: ghcr.io
#          username: ${{ github.actor }}
#          password: ${{ secrets.GITHUB_TOKEN }}
#      - name: Publish container image
#        run: docker push ghcr.io/${{ github.actor }}/catalog-service:latest