ci.yml

---
name: CI Bmeme NG-CLI container images
on:
  push:
    branches:
      - "*"
      - "*/*"
      - "**"
      - "!main"

env:
  registry: docker.io
  repository: bmeme/ng-cli

jobs:

  configure:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - 
        name: Checkout to repository
        uses: actions/checkout@v3
      -
        name: Set matrix data
        id: set-matrix
        run: echo "matrix=$(jq -c . < ./config.json)" >> $GITHUB_OUTPUT

  build:
    name: Build and test Bmeme NG-CLI container images using Docker
    runs-on: ubuntu-latest
    needs: configure
    strategy:
      matrix: ${{ fromJson(needs.configure.outputs.matrix) }}
    steps:
      -
        name: Check out the codebase.
        uses: actions/checkout@v3
      -
        name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      -
        name: Lint Dockerfile
        id: lint
        uses: hadolint/hadolint-action@v3.1.0
        with:
          dockerfile: ./Dockerfile
          config: .hadolint.yaml
      -
        name: Build images
        id: build
        env:
          NG_CLI_MAJOR_VERSION: ${{ matrix.ng_cli_major_version }}
          NODE_MAJOR_VERSION: ${{ matrix.node_major_version }}
          PRETTY_TAG: ${{ matrix.name }}
        run: |
          {
            docker build \
              --build-arg NODE_MAJOR_VERSION=${NODE_MAJOR_VERSION} \
              --build-arg NG_CLI_MAJOR_VERSION=${NG_CLI_MAJOR_VERSION} \
              -t ${{ env.registry}}/${{ env.repository }}:${PRETTY_TAG} \
              -f ./Dockerfile .;
          }
      -
        name: Get NG_CLI_VERSION value
        id: get-versions
        env:
          PRETTY_TAG: ${{ matrix.name }}
        run: |
          {
            echo "ng_cli_version=$(docker run --rm ${{ env.registry}}/${{ env.repository }}:${PRETTY_TAG} /bin/bash -c \
              'cat /home/node/.ng_cli_version')" >> "$GITHUB_OUTPUT"; \

            echo "node_version=$(docker run --rm ${{ env.registry}}/${{ env.repository }}:${PRETTY_TAG} /bin/bash -c \
              'cat /home/node/.node_version')" >> "$GITHUB_OUTPUT"; \
          }
      -
        name: Tag images
        id: tag
        env: 
          NODE_VERSION: ${{ steps.get-versions.outputs.node_version }}
          PRETTY_TAG: ${{ matrix.name }}
          NG_CLI_VERSION: ${{ steps.get-versions.outputs.ng_cli_version }}
        run: |
          {
            docker tag ${{ env.registry}}/${{ env.repository }}:${PRETTY_TAG} \
              ${{ env.registry}}/${{ env.repository }}:${NG_CLI_VERSION}-${NODE_VERSION}; \

            if ${{ matrix.latest }}; then
              docker tag ${{ env.registry}}/${{ env.repository }}:${PRETTY_TAG} ${{ env.registry}}/${{ env.repository }}:latest; \
            fi
          }
      - 
        name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        id: trivy
        with:
          image-ref: ${{ env.registry }}/${{ env.repository }}:${{ matrix.name }}
          format: 'sarif'
          exit-code: '0'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL'
          output: 'trivy-results-${{ matrix.name }}.sarif'
      -
        name: Upload Trivy scan results to GitHub Security tab
        id: trivy-upload
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results-${{ matrix.name }}.sarif'
      -
        name: Scan image
        id: scan
        uses: anchore/scan-action@v3
        with:
          image: ${{ env.registry }}/${{ env.repository }}:${{ matrix.name }}
          severity-cutoff: critical
          fail-build: false
      - 
        name: upload Anchore scan SARIF report
        id: scan-upload
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: ${{ steps.scan.outputs.sarif }}