-
Notifications
You must be signed in to change notification settings - Fork 22
185 lines (163 loc) · 6.37 KB
/
irs-build.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
name: IRS build
on:
workflow_dispatch: # Trigger manually
pull_request:
paths-ignore:
- '**/*.md'
- '**/*.txt'
- 'charts/**'
- '.config/**'
- 'docs/**'
- '!docs/src/api/**'
- 'local/**'
- 'CHANGELOG.md'
push:
branches:
- main
tags:
- '**'
jobs:
build:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Set up JDK 17
uses: actions/setup-java@v4
with:
java-version: '17'
distribution: 'temurin'
- name: Cache maven packages
uses: actions/cache@v4
with:
path: ~/.m2
key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
restore-keys: ${{ runner.os }}-m2
- name: Build with Maven
run: |
mvn clean verify --batch-mode
analyze_with_Sonar:
# No need to run if we cannot use the sonar token
if: >-
(github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
github.actor != 'dependabot[bot]'
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of sonar analysis
- name: Set up JDK 17
uses: actions/setup-java@v4
with:
java-version: '17'
distribution: 'temurin'
- name: Cache maven packages
uses: actions/cache@v4
with:
path: ~/.m2
key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
restore-keys: ${{ runner.os }}-m2
- name: Cache SonarCloud packages
uses: actions/cache@v4
with:
path: ~/.sonar/cache
key: ${{ runner.os }}-sonar
restore-keys: ${{ runner.os }}-sonar
- name: Analyze with Sonar
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
run: |
mvn --batch-mode --update-snapshots verify \
org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \
-Dsonar.projectKey=${{ secrets.SONAR_PROJECT_KEY }} -Dsonar.organization=${{ secrets.SONAR_ORGANIZATION }} \
-Dcheckstyle.skip -Dpmd.skip=true
build_images:
strategy:
matrix:
image:
- irs-api
runs-on: ubuntu-latest
outputs:
image-tag: ${{ steps.version.outputs.image_tag }}
steps:
- uses: actions/checkout@v4
- name: Build image to make sure Dockerfile is valid
run: |
# RUN --mount=type=cache is used in the IRS Dockerfile to cache directories for maven.
# And the --mount option requires BuildKit.
DOCKER_BUILDKIT=1 docker build --build-arg BUILD_TARGET=${{ matrix.image }} --target ${{ matrix.image }} -t ${{ matrix.image }}:latest .
- name: Set image version
id: version
run: |
# Strip git ref prefix from version
VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
# Strip "v" prefix from tag name
[[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
# Support PR ref versions
[[ "${{ github.ref }}" == "refs/pull/"* ]] && VERSION=PR-$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\)/merge,\1,')
# Use Docker `latest` tag convention
[ "$VERSION" == "main" ] && VERSION=latest
echo VERSION=$VERSION
echo "::set-output name=image_tag::$VERSION"
- name: Log in to registry
env:
DOCKER_HUB_USER: ${{ secrets.DOCKER_HUB_USER }}
if: >-
env.DOCKER_HUB_USER == '' &&
(github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
github.actor != 'dependabot[bot]'
# This is where you will update the PAT to GITHUB_TOKEN
run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
- name: Push image (GHCR)
env:
DOCKER_HUB_USER: ${{ secrets.DOCKER_HUB_USER }}
if: >-
env.DOCKER_HUB_USER == '' &&
(github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
github.actor != 'dependabot[bot]'
run: |
IMAGE_ID=ghcr.io/${{ github.repository_owner }}/${{ matrix.image }}
# Change all uppercase to lowercase
IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
echo IMAGE_ID=$IMAGE_ID
docker tag ${{ matrix.image }} $IMAGE_ID:${{ steps.version.outputs.image_tag }}
docker push $IMAGE_ID:${{ steps.version.outputs.image_tag }}
docker tag ${{ matrix.image }} $IMAGE_ID:$GITHUB_SHA
docker push $IMAGE_ID:$GITHUB_SHA
- name: Login to Docker Hub
env:
DOCKER_HUB_USER: ${{ secrets.DOCKER_HUB_USER }}
if: env.DOCKER_HUB_USER != ''
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKER_HUB_USER }}
password: ${{ secrets.DOCKER_HUB_TOKEN }}
- name: Push image (DockerHub)
env:
DOCKER_HUB_USER: ${{ secrets.DOCKER_HUB_USER }}
IMAGE_NAMESPACE: tractusx
IMAGE_NAME: irs-api
if: env.DOCKER_HUB_USER != ''
run: |
docker tag ${{ matrix.image }} ${{ env.IMAGE_NAMESPACE }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.image_tag }}
docker push ${{ env.IMAGE_NAMESPACE }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.image_tag }}
# https://github.com/peter-evans/dockerhub-description
- name: Update Docker Hub description
env:
DOCKER_HUB_USER: ${{ secrets.DOCKER_HUB_USER }}
IMAGE_NAMESPACE: tractusx
IMAGE_NAME: irs-api
if: env.DOCKER_HUB_USER != '' && github.event_name != 'pull_request'
uses: peter-evans/dockerhub-description@v4
with:
username: ${{ secrets.DOCKER_HUB_USER }}
password: ${{ secrets.DOCKER_HUB_TOKEN }}
repository: ${{ env.IMAGE_NAMESPACE }}/${{ env.IMAGE_NAME }}
readme-filepath: ./DOCKER_NOTICE.md
trigger-trivy-image-scan:
if: >-
github.event_name != 'pull_request'
needs:
- build_images
uses: ./.github/workflows/trivy-docker-hub-scan.yml