.github/workflows/main.yml

name: Sub - main

on:
  workflow_call:
    inputs:
      BASE_IMAGE:
        required: true
        type: string
      KOSLI_TRAIL:
        required: true
        type: string
    secrets:
      DOCKER_USER:
        required: true
      DOCKER_PASS:
        required: true
      SNYK_TOKEN:
        required: true
      KOSLI_API_TOKEN:
        required: true

env:
  KOSLI_API_TOKEN: ${{ secrets.KOSLI_API_TOKEN }}
  KOSLI_AWS_BETA:  ${{ vars.KOSLI_AWS_BETA }}          # aws-beta
  KOSLI_AWS_PROD:  ${{ vars.KOSLI_AWS_PROD }}          # aws-prod
  KOSLI_DEBUG:     ${{ vars.KOSLI_DEBUG }}             # true/false
  KOSLI_DRY_RUN:   ${{ vars.KOSLI_DRY_RUN }}           # false
  KOSLI_HOST:      ${{ vars.KOSLI_HOST }}              # https://app.kosli.com
  KOSLI_ORG:       ${{ vars.KOSLI_ORG }}               # cyber-dojo
  KOSLI_FLOW:      ${{ vars.KOSLI_FLOW }}              # runner-ci
  KOSLI_TRAIL:     ${{ github.sha }}

  AWS_ECR_ID:          ${{ vars.AWS_ECR_ID }}
  AWS_REGION:          ${{ vars.AWS_REGION }}
  AWS_ACCOUNT_ID_BETA: ${{ vars.AWS_ACCOUNT_ID_BETA }}
  AWS_ACCOUNT_ID_PROD: ${{ vars.AWS_ACCOUNT_ID_PROD }}
  SERVICE_NAME:        ${{ github.event.repository.name }}  # runner
  IMAGE_TAR_FILENAME:  /tmp/${{ github.event.repository.name }}:${{ github.sha }}.tar
  DOCKER_API_VERSION:  ${{ vars.DOCKER_API_VERSION }}

jobs:

  setup:
    runs-on: ubuntu-latest
    outputs:
      aws_account_id_beta:      ${{ steps.vars.outputs.aws_account_id_beta }}
      aws_account_id_prod:      ${{ steps.vars.outputs.aws_account_id_prod }}
      ecr_registry:             ${{ steps.vars.outputs.ecr_registry }}
      aws_region:               ${{ steps.vars.outputs.aws_region }}
      gh_actions_iam_role_name: ${{ steps.vars.outputs.gh_actions_iam_role_name }}
      service_name:             ${{ steps.vars.outputs.service_name }}
      image_tag:                ${{ steps.vars.outputs.image_tag }}
      image_name:               ${{ steps.vars.outputs.image_name }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Prepare outputs for workflow jobs
        id: vars
        run: |
          ECR_REGISTRY="${AWS_ECR_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com"
          IMAGE_TAG=${GITHUB_SHA:0:7}        
          IMAGE_NAME="${ECR_REGISTRY}/${{ env.SERVICE_NAME }}:${IMAGE_TAG}"
          
          echo "aws_account_id_beta=${AWS_ACCOUNT_ID_BETA}"   >> ${GITHUB_OUTPUT}          
          echo "aws_account_id_prod=${AWS_ACCOUNT_ID_PROD}"   >> ${GITHUB_OUTPUT}                              
          echo "ecr_registry=${ECR_REGISTRY}"                 >> ${GITHUB_OUTPUT}
          echo "aws_region=${AWS_REGION}"                     >> ${GITHUB_OUTPUT}
          echo "gh_actions_iam_role_name=gh_actions_services" >> ${GITHUB_OUTPUT}
          echo "service_name=${{ env.SERVICE_NAME }}"         >> ${GITHUB_OUTPUT}
          echo "image_tag=${IMAGE_TAG}"                       >> ${GITHUB_OUTPUT}
          echo "image_name=${IMAGE_NAME}"                     >> ${GITHUB_OUTPUT}

      - name: Setup Kosli CLI
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        uses: kosli-dev/setup-cli-action@v2
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}

      # This is currently the Kosli live-docs example target for the create-flow command.
      - name: Create Kosli Flow
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        run:
          kosli create flow "${KOSLI_FLOW}"
            --description="Test runner"
            --template-file=.kosli.yml

      - name: Begin Kosli Trail
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        run:
          kosli begin trail "${KOSLI_TRAIL}"


  pull-request:
    if: ${{ github.ref == 'refs/heads/main' }}
    needs: [setup]
    runs-on: ubuntu-latest
    permissions:
      id-token:      write
      contents:      read
      pull-requests: read
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Setup Kosli CLI
        uses: kosli-dev/setup-cli-action@v2
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}

      - name: Attest pull-request evidence to Kosli
        run:
          kosli attest pullrequest github
            --github-token=${{ secrets.GITHUB_TOKEN }}
            --name=pull-request


  rubocop-lint:
    needs: [setup]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Run Rubocop lint on source
        run:
          make rubocop_lint

      - name: Setup Kosli CLI
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        uses: kosli-dev/setup-cli-action@v2
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}

      - name: Attest evidence to Kosli
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        run:
          kosli attest junit
            --name=runner.rubocop-lint
            --results-dir=./reports/rubocop


  snyk-code-scan:
    runs-on: ubuntu-latest
    needs: [setup]
    env:
      SARIF_FILENAME: snyk.code.scan.json
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Setup Snyk
        uses: snyk/actions/setup@master

      - name: Run Snyk code scan
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        run:
          snyk code test
            --policy-path=.snyk
            --sarif
            --sarif-file-output="${SARIF_FILENAME}"
            .

      - name: Setup Kosli CLI
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        uses: kosli-dev/setup-cli-action@v2
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}

      - name: Attest evidence to Kosli
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        run:
          kosli attest snyk
            --attachments=.snyk
            --name=runner.snyk-code-scan 
            --scan-results="${SARIF_FILENAME}"


  build-image:
    runs-on: ubuntu-latest
    needs: [setup]
    env:
      IMAGE_NAME: ${{ needs.setup.outputs.image_name }}
    permissions:
      id-token: write
      contents: write
    outputs:
      digest: ${{ steps.variables.outputs.digest }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region:            ${{ needs.setup.outputs.aws_region }}
          role-duration-seconds: 900
          role-session-name:     ${{ github.event.repository.name }}
          role-to-assume:        arn:aws:iam::${{ needs.setup.outputs.aws_account_id_beta }}:role/${{ needs.setup.outputs.gh_actions_iam_role_name }}
          mask-aws-account-id:   no

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build and push Docker image to ECR
        id: docker_build
        uses: docker/build-push-action@v5
        with:
          context: .
          no-cache: true
          push: true
          tags: ${{ env.IMAGE_NAME }}
          build-args: |
            COMMIT_SHA=${{ github.sha }}
            BASE_IMAGE=${{ inputs.base_image }}

      - name: Tar Docker image
        run:
          docker image save ${IMAGE_NAME} 
            --output ${IMAGE_TAR_FILENAME}

      - name: Cache Docker image
        uses: actions/cache@v4
        with:
          path: ${{ env.IMAGE_TAR_FILENAME }}
          key:  ${{ env.IMAGE_NAME }}

      - name: Make image digest available to following jobs
        id: variables
        run: |
          DIGEST=$(echo ${{ steps.docker_build.outputs.digest }} | sed 's/.*://')          
          echo "digest=${DIGEST}" >> ${GITHUB_OUTPUT}

      - name: Setup Kosli CLI
        if: ${{ github.ref == 'refs/heads/main' }}
        uses: kosli-dev/setup-cli-action@v2
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}

      - name: Attest image evidence to Kosli
        if: ${{ github.ref == 'refs/heads/main' }}
        run:
          kosli attest artifact "${IMAGE_NAME}"
            --artifact-type=docker   
            --name=runner


  unit-tests:
    runs-on: ubuntu-latest
    needs: [setup, build-image]
    env:
      IMAGE_NAME:        ${{ needs.setup.outputs.image_name }}
      KOSLI_FINGERPRINT: ${{ needs.build-image.outputs.digest }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Retrieve Docker image from cache
        uses: actions/cache@v4
        with:
          path: ${{ env.IMAGE_TAR_FILENAME }}
          key:  ${{ env.IMAGE_NAME }}

      - name: Load Docker image
        run:
          docker image load
            --input ${IMAGE_TAR_FILENAME}

      - name: Run unit tests
        run:
          make test_server

      - name: Get unit test coverage
        id: coverage
        run:
          make coverage_server

      - name: Setup Kosli CLI
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        uses: kosli-dev/setup-cli-action@v2
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}

      - name: Attest JUnit test evidence to Kosli
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        run:
          kosli attest junit
            --name=runner.unit-test
            --results-dir=./reports/server/junit

      - name: Attest coverage evidence to Kosli
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        run: |
          KOSLI_COMPLIANT=$([ "${{ steps.coverage.outcome }}" == 'success' ] && echo true || echo false)
          kosli attest generic \
            --description="unit-test branch-coverage and metrics" \
            --name=runner.unit-test-branch-coverage \
            --user-data="./reports/server/coverage_metrics.json"


  integration-tests:
    runs-on: ubuntu-latest
    needs: [setup, build-image]
    env:
      IMAGE_NAME:        ${{ needs.setup.outputs.image_name }}
      KOSLI_FINGERPRINT: ${{ needs.build-image.outputs.digest }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Retrieve Docker image from cache
        uses: actions/cache@v4
        with:
          path: ${{ env.IMAGE_TAR_FILENAME }}
          key:  ${{ env.IMAGE_NAME }}

      - name: Load Docker image
        run:
          docker image load
            --input ${IMAGE_TAR_FILENAME}

      - name: Run integration tests
        run:
          make image_client test_client

      - name: Get integration test coverage
        id: coverage
        run:
          make coverage_client

      - name: Setup Kosli CLI
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        uses: kosli-dev/setup-cli-action@v2
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}

      - name: Attest junit test evidence to Kosli
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        run:
          kosli attest junit
            --name=runner.integration-test
            --results-dir=./reports/client/junit

      - name: Attest coverage evidence to Kosli
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        run: |
          KOSLI_COMPLIANT=$([ "${{ steps.coverage.outcome }}" == 'success' ] && echo true || echo false)
          kosli attest generic \
            --description="integration-test branch-coverage and metrics" \
            --name=runner.integration-test-branch-coverage \
            --user-data="./reports/client/coverage_metrics.json"


  snyk-container-scan:
    runs-on: ubuntu-latest
    needs: [setup, build-image]
    env:
      IMAGE_NAME:        ${{ needs.setup.outputs.image_name }}
      KOSLI_FINGERPRINT: ${{ needs.build-image.outputs.digest }}
      SARIF_FILENAME:    snyk.container.scan.json
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Retrieve Docker image from cache
        uses: actions/cache@v4
        with:
          path: ${{ env.IMAGE_TAR_FILENAME }}
          key:  ${{ needs.setup.outputs.image_name }}

      - name: Load Docker image
        run:
          docker image load
            --input ${IMAGE_TAR_FILENAME}

      - name: Setup Snyk
        uses: snyk/actions/setup@master

      - name: Run Snyk container scan
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        run:
          make snyk_container_scan

      - name: Setup Kosli CLI
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        uses: kosli-dev/setup-cli-action@v2
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}

      - name: Attest evidence to Kosli
        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
        run:
          kosli attest snyk 
            --attachments=.snyk          
            --name=runner.snyk-container-scan 
            --scan-results="${SARIF_FILENAME}"


  sdlc-control-gate:
    if: ${{ github.ref == 'refs/heads/main' }}
    runs-on: ubuntu-latest
    needs: [setup, build-image, pull-request, rubocop-lint, unit-tests, integration-tests, snyk-container-scan, snyk-code-scan]
    env:
      IMAGE_NAME:        ${{ needs.setup.outputs.image_name }}
      KOSLI_FINGERPRINT: ${{ needs.build-image.outputs.digest }}
    steps:
      - name: Setup Kosli CLI
        uses: kosli-dev/setup-cli-action@v2
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}

      - name: Kosli SDLC gate to short-circuit the workflow
        run:
          kosli assert artifact ${IMAGE_NAME}
            --environment=${KOSLI_AWS_BETA}


  approve-deployment-to-beta:
    needs: [setup, build-image, sdlc-control-gate]
    runs-on: ubuntu-latest
    env:
      IMAGE_NAME:        ${{ needs.setup.outputs.image_name }}
      KOSLI_FINGERPRINT: ${{ needs.build-image.outputs.digest }}
    environment:
      name: staging
      url:  https://beta.cyber-dojo.org
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Kosli CLI
        uses: kosli-dev/setup-cli-action@v2
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}

      - name: Attest approval of deployment to Kosli
        run:
          kosli report approval ${IMAGE_NAME}
            --approver="${{ github.actor }}"
            --environment=${KOSLI_AWS_BETA}


  deploy-to-beta:
    needs: [setup, build-image, approve-deployment-to-beta]
    permissions:
      id-token: write
      contents: write
    uses: fivexl/gh-workflow-tf-plan-apply/.github/workflows/base.yml@v0.0.23
    with:
      aws_region:             ${{ needs.setup.outputs.aws_region }}
      aws_role_arn:           arn:aws:iam::${{ needs.setup.outputs.aws_account_id_beta }}:role/${{ needs.setup.outputs.gh_actions_iam_role_name }}
      aws_default_region:     ${{ needs.setup.outputs.aws_region }}
      aws_role_duration:      900
      working_directory:      deployment/terraform/
      tf_apply:               true
      tf_version:             v1.9.1
      tf_additional_env_vars: '{"TF_VAR_TAGGED_IMAGE": "${{ needs.setup.outputs.ecr_registry }}/${{ needs.setup.outputs.service_name }}:${{ needs.setup.outputs.image_tag }}@sha256:${{ needs.build-image.outputs.digest }}"}'


# Deployment to aws-prod Environment is done with a Promotion workflow.
# See https://github.com/cyber-dojo/aws-prod-co-promotion