pipeline.yml

# This workflow will build a Java project with Gradle and cache/restore any dependencies to improve the workflow execution time
# For more information see: https://help.github.com/actions/language-and-framework-guides/building-and-testing-java-with-gradle

name: Pipeline

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  # Allow to run this workflow manually
  workflow_dispatch:

env:
  CONTAINER_REGISTRY: ghcr.io
  CONTAINER_IMAGE_NAME: ${{ github.repository }}
  CONTAINER_IMAGE_VERSION: ${{ github.sha }}
  INFRA_REPO: kotlin-application-template-infra
  DEPLOYING_REPO: kotlin-application-template

jobs:
  validate-gradle-wrapper:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Validate gradle wrapper
        uses: gradle/wrapper-validation-action@5188e9b5527a0a094cee21e2fe9a8ca44b4629af

  build:
    runs-on: ubuntu-latest
    needs: [validate-gradle-wrapper]
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          java-version: "17.0"
          distribution: "temurin"
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@d0f2f0387e6ef0dce1fca38d0482617633e9d63a # v3.3.0
      - name: Build with Gradle
        run: ./gradlew build
      - name: Send status to Slack
        uses: digitalservicebund/notify-on-failure-gha@15dd05b628141b7bac0ad26e08c1935cb3ba6bc8 # v1.4.0
        if: ${{ failure() && github.ref == 'refs/heads/main' }}
        with:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  audit-licenses:
    runs-on: ubuntu-latest
    needs: [validate-gradle-wrapper]
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          java-version: "17.0"
          distribution: "temurin"
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@d0f2f0387e6ef0dce1fca38d0482617633e9d63a # v3.3.0
      - name: Run license scanner
        run: ./gradlew checkLicense
      - name: Send status to Slack
        uses: digitalservicebund/notify-on-failure-gha@15dd05b628141b7bac0ad26e08c1935cb3ba6bc8 # v1.4.0
        if: ${{ failure() && github.ref == 'refs/heads/main' }}
        with:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  vulnerability-scan:
    runs-on: ubuntu-latest
    needs: [validate-gradle-wrapper]
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          java-version: "17.0"
          distribution: "temurin"
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@d0f2f0387e6ef0dce1fca38d0482617633e9d63a # v3.3.0
      - name: Build container image
        run: ./gradlew bootBuildImage
      - name: Run Trivy vulnerability scanner
        # Third-party action, pin to commit SHA!
        # See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
        uses: aquasecurity/trivy-action@d710430a6722f083d3b36b8339ff66b32f22ee55
        with:
          image-ref: ${{ env.CONTAINER_REGISTRY }}/${{ env.CONTAINER_IMAGE_NAME }}:${{ env.CONTAINER_IMAGE_VERSION }}
          format: "sarif"
          output: "trivy-results.sarif"
      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        if: ${{ always() && github.ref == 'refs/heads/main' }} # Bypass non-zero exit code..
        with:
          sarif_file: "trivy-results.sarif"
      - name: Generate cosign vulnerability scan record
        # Third-party action, pin to commit SHA!
        # See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
        uses: aquasecurity/trivy-action@d710430a6722f083d3b36b8339ff66b32f22ee55
        with:
          image-ref: ${{ env.CONTAINER_REGISTRY }}/${{ env.CONTAINER_IMAGE_NAME }}:${{ env.CONTAINER_IMAGE_VERSION }}
          format: "cosign-vuln"
          output: "vuln.json"
      - name: Upload cosign vulnerability scan record
        uses: actions/upload-artifact@v4
        with:
          name: "vuln.json"
          path: "vuln.json"
          if-no-files-found: error
      - name: Send status to Slack
        uses: digitalservicebund/notify-on-failure-gha@15dd05b628141b7bac0ad26e08c1935cb3ba6bc8 # v1.4.0
        if: ${{ failure() && github.ref == 'refs/heads/main' }}
        with:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  analyze:
    runs-on: ubuntu-latest
    if: ${{ github.ref == 'refs/heads/main' }}
    needs: [validate-gradle-wrapper, build, vulnerability-scan]
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          java-version: "17.0"
          distribution: "temurin"
      - name: Cache SonarQube packages
        uses: actions/cache@v4
        with:
          path: ~/.sonar/cache
          key: ${{ runner.os }}-sonar
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@d0f2f0387e6ef0dce1fca38d0482617633e9d63a # v3.3.0
      - name: Scan with SonarQube
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        run: ./gradlew sonar --info
      - name: Check SonarQube Quality Gate
        # Third-party action, pin to commit SHA!
        # See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
        uses: sonarsource/sonarqube-quality-gate-action@d304d050d930b02a896b0f85935344f023928496
        with:
          scanMetadataReportFile: build/sonar/report-task.txt
        timeout-minutes: 3 # Force to fail step after specific time
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
      - name: Send status to Slack
        uses: digitalservicebund/notify-on-failure-gha@15dd05b628141b7bac0ad26e08c1935cb3ba6bc8 # v1.4.0
        if: ${{ failure() }}
        with:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  build-and-push-image:
    runs-on: ubuntu-latest
    if: ${{ github.ref == 'refs/heads/main' }}
    needs:
      - validate-gradle-wrapper
      - build
      - audit-licenses
      - vulnerability-scan
    permissions:
      contents: read
      id-token: write # This is used to complete the identity challenge with sigstore/fulcio..
      packages: write
    outputs:
      version: ${{ steps.set-version.outputs.version }}
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          java-version: "17.0"
          distribution: "temurin"
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@d0f2f0387e6ef0dce1fca38d0482617633e9d63a # v3.3.0
      - name: Build and publish container image
        run: CONTAINER_REGISTRY_USER=${{ github.actor }} CONTAINER_REGISTRY_PASSWORD=${{ secrets.GITHUB_TOKEN }} ./gradlew bootBuildImage --publishImage
      - name: Install cosign
        # Third-party action, pin to commit SHA!
        # See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
        uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20
      - name: Log into container registry
        # Third-party action, pin to commit SHA!
        # See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
        uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20
        with:
          registry: ${{ env.CONTAINER_REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Create SBOM
        uses: digitalservicebund/create-sbom@095884614dac5ea922dfcb09cce2e22f3d6391a3
        with:
          image_name: ${{ env.CONTAINER_IMAGE_NAME }}:${{ env.CONTAINER_IMAGE_VERSION }}
      - name: Sign the published Docker image
        run: cosign sign --yes ${{ env.CONTAINER_REGISTRY }}/${{ env.CONTAINER_IMAGE_NAME }}:${{ env.CONTAINER_IMAGE_VERSION }}
      - name: Download cosign vulnerability scan record
        uses: actions/download-artifact@v4
        with:
          name: "vuln.json"
      - name: Attest vulnerability scan
        run: cosign attest --yes --replace --predicate vuln.json --type vuln ${{ env.CONTAINER_REGISTRY }}/${{ env.CONTAINER_IMAGE_NAME }}:${{ env.CONTAINER_IMAGE_VERSION }}
      - id: set-version
        run: echo "version=$CONTAINER_IMAGE_VERSION" >> $GITHUB_OUTPUT
      - name: Send status to Slack
        uses: digitalservicebund/notify-on-failure-gha@15dd05b628141b7bac0ad26e08c1935cb3ba6bc8 # v1.4.0
        if: ${{ failure() }}
        with:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  deploy-staging:
    runs-on: ubuntu-latest
    # Remove the filter on github.repository when using this template
    if: ${{ github.ref == 'refs/heads/main' && github.repository == 'digitalservicebund/kotlin-application-template' }}
    environment: staging
    # Will only run if the push job succeded
    needs: build-and-push-image
    steps:
      - name: Deploy latest container image
        uses: digitalservicebund/argocd-deploy@4fac1bb67c92ed168f6d9b22f8779ce241a9e412 # v1.0.0
        with:
          environment: staging
          version: ${{ env.CONTAINER_IMAGE_VERSION }}
          deploying_repo: ${{ env.DEPLOYING_REPO }}
          infra_repo: ${{ env.INFRA_REPO }}
          deploy_key: ${{ secrets.DEPLOY_KEY }}
          app: kotlin-application-template-staging
          argocd_pipeline_password: ${{ secrets.ARGOCD_PIPELINE_PASSWORD }}
          argocd_server: ${{ secrets.ARGOCD_SERVER }}