build-docker-image.yml

# This file is maintained by velocitas CLI, do not modify manually. Change settings in .velocitas.json
# Copyright (c) 2022 Robert Bosch GmbH and Microsoft Corporation
#
# This program and the accompanying materials are made available under the
# terms of the Apache License, Version 2.0 which is available at
# https://www.apache.org/licenses/LICENSE-2.0.
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
# SPDX-License-Identifier: Apache-2.0

name: Build Docker Image for single arch

on:
  workflow_call:
    inputs:
      platform:
        required: true
        type: string
      deployment-matrix-str:
        required: true
        type: string
      multiarch:
        required: false
        type: boolean
        default: false
    outputs:
      imageid:
        value: ${{ jobs.build-image.outputs.imageid }}
      imagedigest:
        value: ${{ jobs.build-image.outputs.digest }}

jobs:
  build-image:
    name: "Building image (${{ matrix.component.name }})"
    runs-on: ubuntu-latest
    container: ghcr.io/eclipse-velocitas/devcontainer-base-images/python:v0.1
    strategy:
      matrix:
        component: ${{ fromJson(inputs.deployment-matrix-str) }}
    outputs:
      imageid: ${{ steps.image_build.outputs.imageid }}
      imagedigest: ${{ steps.image_build.outputs.imagedigest }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
        with:
          submodules: "recursive"

      - name: Clone Release Documentation Action repository
        uses: actions/checkout@v3
        with:
          repository: eclipse-velocitas/release-documentation-action
          path: "./.github/actions"

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v2

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - id: github-repository-name-case-adjusted
        name: Prepare repository name in lower case for docker upload. This supports repository names in mixed case
        uses: ASzc/change-string-case-action@v5
        with:
          string: ${{ github.repository }}

      - uses: de-vri-es/setup-git-credentials@v2
        with:
          credentials: https://user:${{ secrets.GITHUB_TOKEN }}@github.com/

      - name: Init velocitas project
        run: |
          velocitas init

      - name: Setup git config
        shell: bash
        run: |
          git config --global user.email "github-automation@users.noreply.github.com"
          git config --global user.name "Github Automation"

      - name: Set Arguments for next step
        id: set_args
        run: |
          if [ ${{ inputs.multiarch }} == true ]; then
            echo "Build Multiarch"
            echo "platforms=linux/amd64, linux/arm64" >> $GITHUB_OUTPUT
            echo "type=oci,dest=./${{ matrix.component.name }}.tar" >> $GITHUB_OUTPUT
          else
            echo "Build ${{inputs.platform}}"
            echo "platforms=linux/${{ inputs.platform }}" >> $GITHUB_OUTPUT
            echo "type=docker,dest=./${{ matrix.component.name }}.tar" >> $GITHUB_OUTPUT
          fi
        shell: bash

      - name: "${{ matrix.component.name }} -- Build image"
        id: image_build
        uses: docker/build-push-action@v4
        with:
          provenance: false
          pull: true
          push: false
          outputs: |
            type=${{ steps.set_args.outputs.type }}
          file: ./app/Dockerfile
          context: .
          platforms: ${{ steps.set_args.outputs.platforms }}
          secrets: |
            "github_token=user:${{ secrets.GITHUB_TOKEN }}"
          tags: ${{ github.sha }}
          labels: |
            org.opencontainers.image.source=https://github.com/${{steps.github-repository-name-case-adjusted.outputs.lowercase}}

      - name: "Install skopeo"
        run: |
          sudo apt-get update
          sudo apt-get -y install skopeo

      - name: "${{ matrix.component.name }} -- Inspect tar image with skopeo"
        run: |
          skopeo inspect --raw oci-archive:${{ matrix.component.name }}.tar | jq
          skopeo inspect oci-archive:${{ matrix.component.name }}.tar
          skopeo copy oci-archive:${{ matrix.component.name }}.tar docker-archive:${{ matrix.component.name }}-arch.tar

      - name: "${{ matrix.component.name }} -- Scan docker image for vulnerabilities"
        uses: aquasecurity/trivy-action@0.8.0
        with:
          input: ${{ matrix.component.name }}-arch.tar
          exit-code: "0"
          ignore-unfixed: true
          severity: "CRITICAL,HIGH"
          format: "template"
          template: "@.github/scripts/junit.tpl"
          output: "junit.xml"

      - name: "${{ matrix.component.name }} -- Show scan results"
        if: ${{ always() }}
        run: cat ./junit.xml

      - name: "${{ matrix.component.name }} -- Package vulnerability scan files"
        uses: ./.github/actions/package
        with:
          name: "VulnerabilityScan-${{ matrix.component.name }}"
          type: "VulnerabilityScan"
          schema: "JUnit"
          sourcePath: ./junit.xml
          packagePath: results/Documentation/renderer

      - name: "${{ matrix.component.name }} -- Upload trivy report as artifacts"
        if: ${{ always() && steps.image_build.outcome == 'success' }}
        uses: actions/upload-artifact@v3
        with:
          name: test-results
          path: |
            results/Documentation/renderer/*

      - name: "${{ matrix.component.name }} -- Publish Trivy Scan Results"
        uses: mikepenz/action-junit-report@v3
        if: ${{ always() && steps.image_build.outcome == 'success' }}
        with:
          check_name: Trivy Scan Results (${{ matrix.component.name }})
          report_paths: ./junit.xml
          summary: true
          update_check: true
          annotate_only: true

      - name: "${{ matrix.component.name }} -- Upload image to artifacts"
        if: ${{ steps.image_build.outcome == 'success' }}
        uses: actions/upload-artifact@v3
        env:
          VAPP_IMAGE: ${{ matrix.component.name }}-${{ inputs.platform }}
        with:
          name: ${{ env.VAPP_IMAGE }}
          path: ./${{ matrix.component.name }}.tar
          if-no-files-found: error

      - name: "${{ matrix.component.name }} -- Upload AppManifest.json to artifacts"
        if: ${{ steps.image_build.outcome == 'success' }}
        uses: actions/upload-artifact@v3
        with:
          name: AppManifest
          path: ./app/AppManifest.json
          if-no-files-found: error

      - name: Generate podspec.yaml
        run: |
          velocitas exec runtime-k3d generate-podspec

      - name: "${{ matrix.component.name }} -- Upload generated podspec.yaml"
        if: ${{ steps.image_build.outcome == 'success' }}
        uses: actions/upload-artifact@v3
        with:
          name: Podspec
          path: ./podspec.yaml
          if-no-files-found: error

      - name: Generate helm chart
        run: |
          velocitas exec runtime-k3d generate-helm

      - name: "${{ matrix.component.name }} -- Upload generated helm chart"
        if: ${{ steps.image_build.outcome == 'success' }}
        uses: actions/upload-artifact@v3
        with:
          name: HelmChart
          path: ./helm
          if-no-files-found: error