policy-engine.yml

name: '@app/policy-engine CI'

on:
  push:
    paths:
      - packages/**
      - apps/policy-engine/**
      - .github/workflows/policy-engine.yml
      - jest.config.ts
      - jest.preset.js
      - .eslintrc.json
      - .prettierrc
      - package.json
      - package-lock.json
      - policy-engine.dockerfile
      - charts/policy-engine/**

jobs:
  test:
    name: test
    runs-on: ubuntu-latest

    services:
      postgres:
        image: postgres:14
        ports:
          - '5432:5432'
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Add private .npmrc
        run: echo "${{ secrets.NPMRC }}" > .npmrc

      - name: Install Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '21'
          cache: 'npm'

      - name: Install Open Policy Agent CLI
        uses: open-policy-agent/setup-opa@v2
        with:
          version: latest

      - name: Install dependencies
        run: |
          make install/ci

      - name: Code format
        shell: bash
        run: |
          make policy-engine/format/check
          make policy-engine/lint/check

      - name: Setup database and Prisma types
        shell: bash
        run: |
          make policy-engine/copy-default-env
          make policy-engine/test/db/setup
          make policy-engine/db/generate-types

      - name: Test types
        shell: bash
        run: |
          make policy-engine/test/type

      - name: Test unit
        shell: bash
        run: |
          make policy-engine/test/unit

      - name: Test integration
        shell: bash
        run: |
          make policy-engine/test/integration

      - name: Test E2E
        shell: bash
        run: |
          make policy-engine/test/e2e

      - name: Send Slack notification on failure
        if: failure() && github.ref == 'refs/heads/main'
        uses: 8398a7/action-slack@v3
        with:
          username: GitHub
          author_name: '@app/policy-engine CI failed'
          status: ${{ job.status }}
          fields: message,commit,author
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

  opa-rego:
    name: Open Agent Policy CI

    runs-on: ubuntu-latest

    steps:
      - name: Check out repository code
        uses: actions/checkout@v4

      - name: Setup OPA
        uses: open-policy-agent/setup-opa@v2
        with:
          version: latest

      - name: Test rego
        run: make policy-engine/rego/test

  build:
    name: buildpush
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest

    # Only run if the Test jobs succeed
    needs: [test, opa-rego]

    permissions:
      id-token: write
      contents: write

    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ vars.ACTIONS_ECR_ROLE_ARN }} # Organization variable
          aws-region: ${{ vars.ACTIONS_ECR_REGION }} # Organization variable

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Get short SHA
        id: slug
        run: echo "sha7=${GITHUB_SHA::7}" >> $GITHUB_ENV

      - name: Add private .npmrc
        run: echo "${{ secrets.NPMRC }}" > .npmrc

      - name: Build, tag, and push docker image to Amazon ECR
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./policy-engine.dockerfile
          push: true
          tags: |
            ${{ steps.login-ecr.outputs.registry }}/armory/policy-engine:${{ env.sha7 }}
            ${{ steps.login-ecr.outputs.registry }}/armory/policy-engine:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Update Image Version in the worker HelmChart values.yaml
        uses: fjogeleit/yaml-update-action@master
        with:
          valueFile: 'charts/policy-engine/values.yaml'
          propertyPath: 'image.tag'
          value: ${{ env.sha7 }}
          branch: main
          message: 'Update policy-engine Image Version to ${{ env.sha7 }}'

      - name: Send Slack notification on failure
        if: failure() && github.ref == 'refs/heads/main'
        uses: 8398a7/action-slack@v3
        with:
          username: GitHub
          author_name: '@app/policy-engine CI buildpush failed'
          status: ${{ job.status }}
          fields: message,commit,author
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}