docker.yml

name: CI
on:
  push:
    branches:
      - main
    paths:
      - "function/**"
      - "ui/**"
      - "test/**"
      - ".github/workflows/docker.yml"
  pull_request:
    branches:
      - main
    paths:
      - "function/**"
      - "ui/**"
      - "test/**"
      - ".github/workflows/docker.yml"
  workflow_dispatch:

env:
  OWNER: ${{ github.repository_owner }}
  REPO_NAME: ${{ github.event.repository.name }}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  python-test:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: true
      matrix:
        python-version: ["3.11", "3.12"]
    steps:
    - name: Check out repository code
      uses: actions/checkout@v4
    - name: Python ${{ matrix.python-version }} setup
      uses: actions/setup-python@v5
      with:
        python-version: ${{ matrix.python-version }}
    - name: pip install
      run: |
        cd function/
        pip install -r requirements.txt
        pip install flake8
        flake8 . --count --show-source --statistics --ignore=E111,E501 --exit-zero --output-file=flake8tmp.txt
  review:
    uses: saidsef/saidsef/.github/workflows/dependency-review.yaml@main
    if: ${{ github.event_name == 'pull_request' }}
  build:
    runs-on: ubuntu-latest
    needs: [python-test]
    steps:
    - name: Check out repository code
      uses: actions/checkout@v4
    - name: Set Tag Name
      run: |
        echo "TAG=$(echo ${GITHUB_REF##*/})" >> $GITHUB_ENV
        echo "DATE=v$(echo `date +'%Y.%m'`)" >> $GITHUB_ENV
    - name: Login to GHCR
      uses: docker/login-action@v3
      if: success()
      with:
        registry: ghcr.io
        username: ${{ env.OWNER }}
        password: ${{ github.token }}
    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3
      with:
        platforms: all
    - name: Set up Docker Buildx
      id: buildx
      if: success()
      uses: docker/setup-buildx-action@v3
      env:
        DOCKER_BUILDKIT: 1
    - name: Build and push container image - (Server)
      uses: docker/build-push-action@v6
      if: success()
      env:
        DOCKER_BUILDKIT: 1
      with:
        context: ./function
        file: ./function/Dockerfile.server
        platforms: linux/amd64,linux/arm64
        pull: true
        push: true
        tags: ghcr.io/${{ env.OWNER }}/${{ env.REPO_NAME }}:server-${{ env.TAG == 'main' && 'latest' || env.TAG }}
        cache-from: type=registry,ref=ghcr.io/${{ env.OWNER }}/${{ env.REPO_NAME }}:server-${{ env.TAG == 'main' && 'latest' || env.TAG }}
        cache-to: type=inline
    - name: Build and push container image - (UI)
      uses: docker/build-push-action@v6
      if: success()
      env:
        DOCKER_BUILDKIT: 1
      with:
        context: ./ui
        file: ./ui/Dockerfile
        platforms: linux/amd64,linux/arm64
        pull: true
        push: true
        tags: ghcr.io/${{ env.OWNER }}/${{ env.REPO_NAME }}:ui-${{ env.TAG == 'main' && 'latest' || env.TAG }}
        cache-from: type=registry,ref=ghcr.io/${{ env.OWNER }}/${{ env.REPO_NAME }}:ui-${{ env.TAG == 'main' && 'latest' || env.TAG }}
        cache-to: type=inline
    # - name: Delete old container images
    #   uses: actions/delete-package-versions@v5
    #   with:
    #     owner: "${{ env.OWNER }}"
    #     package-name: "${{ env.REPO_NAME }}"
    #     package-type: 'container'
    #     min-versions-to-keep: 3
    #     ignore-versions: '^ui-latest|server-latest$'
    #     delete-only-untagged-versions: 'false'
    - name: Run Trivy config vulnerability
      uses: aquasecurity/trivy-action@master
      continue-on-error: true
      if: success()
      with:
        scan-type: 'config'
        scan-ref: '.'
        format: 'github'
    - name: Run Trivy vulnerability scanner - (Server)
      uses: aquasecurity/trivy-action@master
      continue-on-error: true
      if: success()
      with:
        image-ref: ghcr.io/${{ env.OWNER }}/${{ env.REPO_NAME }}:server-${{ env.TAG == 'main' && 'latest' || env.TAG }}
        format: 'sarif'
        output: 'trivy-results.sarif'
    - name: Upload Trivy scan results to GitHub Security tab - Server
      uses: github/codeql-action/upload-sarif@v3
      continue-on-error: true
      if: success()
      with:
        sarif_file: 'trivy-results.sarif'
        category: 'Trivy'
  k8s-test:
    runs-on: ubuntu-latest
    needs: [build]
    if: ${{ ! contains(github.ref, 'main') }}
    steps:
      - name: Create k8s Kind Cluster
        uses: helm/kind-action@v1.12.0
        with:
          verbosity: "10"
          kubectl_version: "v1.29.3"
      - name: Checkout
        uses: actions/checkout@v4
      - name: Run K8s test
        run: |
          kubectl version
          export NS=`cat deployment/kustomization.yml  | grep namespace | awk '{ print $2 }'`
          if [ -z "$NS" ]; then
            export NS='data'
          fi
          kubectl create namespace $NS
          kubectl kustomize deployment/ | kubectl apply -n $NS -f -
          kubectl get all -n $NS

  auto-approve:
    runs-on: ubuntu-latest
    needs: [python-test, build, k8s-test]
    if: ${{ github.event_name == 'pull_request' }}
    steps:
    - name: Auto Approve PR
      uses: actions/github-script@v7
      with:
       script: |
        github.rest.pulls.createReview({
          owner: context.repo.owner,
          repo: context.repo.repo,
          pull_number: context.issue.number,
          event: "APPROVE"
        })

  auto-preview:
    runs-on: ubuntu-latest
    needs: [auto-approve]
    if: ${{ github.event_name == 'pull_request' }}
    steps:
    - name: Add Preview Label
      uses: actions/github-script@v7
      with:
        script: |
          github.rest.issues.addLabels({
            issue_number: context.issue.number,
            owner: context.repo.owner,
            repo: context.repo.repo,
            labels: ['preview']
          })