backend_workflow.yml

name: "backend workflow that builds, tests, scans for vulnerabilities, creates a release, pushes a docker image to ECR, and updates infrastructure as code with the new image tag"
run-name: "backend workflow for environment: ${{ inputs.environment }}"
permissions:
  contents: write
  pull-requests: write
  id-token: write
  issues: write
on:
  workflow_call:
    inputs:
      semver-app-id:
        description: "GitHub App ID used for semantic versioning, must have write permissions to the repo"
        required: true
        type: string
      environment:
        description: "Deployment environment used to resolve secrets (e.g., dev, int)"
        required: true
        type: string
      aws-region:
        type: string
        required: true
        description: "AWS region for deployment and AWS CLI commands"
      ecr-repository-name:
        type: string
        required: true
        description: "ECR repository name for pushing built images"
      gitleaks-app-id:
        description: "GitHub App ID used by gitleaks to authenticate with the GitHub API (must have read permissions to the repo and prs"
        required: true
        type: string
      deployment-app-id:
        description: "GitHub App ID used for deployment authentication, must have permissions to create PRs on the infrastructure repository"
        required: true
        type: string
      application-name:
        description: "Name of the application being built and deployed, used for tagging docker images and identifying the correct infrastructure as code to update in the infrastructure repository"
        required: true
        type: string
      github-organization:
        description: 'GitHub organization that owns the infrastructure repository'
        required: true
        type: string
      infrastructure_repo:
        description: 'Name Infrastructure repository'
        required: true
        type: string
      infrastructure_base_branch:
        description: 'Base branch for PR'
        required: false
        default: 'main'
        type: string
    secrets:
      SEMVER_PRIVATE_KEY:
        description: "GitHub App private key matching the semantic-release-app-id input, used for semantic-release authentication"
        required: true
      AWS_OIDC_ROLE_ARN:
        description: "OIDC role ARN for AWS credentials"
        required: true
      AWS_DEPLOYMENT_ROLE_ARN:
        description: "Deployment role ARN for AWS credentials"
        required: true
      GH_ORG_GITLEAKS_PRIVATE_KEY:
        description: "GitHub App private key matching the gitleaks-app-id input, used for gitleaks authentication"
        required: true
      LICENSE_KEY_GITLEAKS:
        description: "Gitleaks license key"
        required: true
      SONAR_TOKEN:
        description: "SonarQube authentication token"
        required: true
      NIST_OWASP_API_KEY:
        description: "API Key for the national vulnerability database used by OWASP Dependency Check"
        required: true
      DEPLOYMENT_APP_PRIVATE_KEY:
        description: "GitHub App private key matching the deployment-app-id input, used for deployment authentication and creating PRs on the infrastructure repository"
        required: true
jobs:
  checkstyle:
    name: "."
    uses: ./.github/workflows/backend_checkstyle.yml

  gitleaks:
    name: '.'
    uses: ./.github/workflows/gitleaks.yml
    secrets:
      GH_ORG_GITLEAKS_PRIVATE_KEY: ${{ secrets.GH_ORG_GITLEAKS_PRIVATE_KEY }}
      LICENSE_KEY_GITLEAKS: ${{ secrets.LICENSE_KEY_GITLEAKS }}
    with:
      gitleaks-app-id: ${{ inputs.gitleaks-app-id }}

  owasp-dependency-check:
    name: "."
    uses: ./.github/workflows/backend_owasp_dependency_check.yml
    needs: [ checkstyle, gitleaks ]
    secrets:
      NIST_OWASP_API_KEY: ${{ secrets.NIST_OWASP_API_KEY }}

  unit-test-sonarqube:
    name: "."
    uses: ./.github/workflows/backend_unit_test_sonarqube.yml
    needs: [ checkstyle, gitleaks ]
    secrets:
      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  trivy-scan:
    name: "."
    uses: ./.github/workflows/trivy_scan.yml
    needs: [ checkstyle, gitleaks ]

  semantic-release:
    name: '.'
    needs: [ checkstyle, gitleaks, owasp-dependency-check, unit-test-sonarqube, trivy-scan ]
    if: ${{ github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop') }}

    uses: ./.github/workflows/semantic_release.yml
    secrets:
      SEMVER_PRIVATE_KEY: ${{ secrets.SEMVER_PRIVATE_KEY}}
    with:
      app-id: ${{ inputs.semver-app-id}}

  build-and-push:
    name: '.'
    if: ${{ github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop') }}
    uses: ./.github/workflows/backend_build_push_image.yml
    needs: [ semantic-release ]
    with:
      aws-region: ${{ inputs.aws-region }}
      ecr-repository-name: ${{ inputs.ecr-repository-name }}
      environment: ${{ inputs.environment }}
      version: ${{needs.semantic-release.outputs.version }}
    secrets:
      AWS_OIDC_ROLE_ARN: ${{ secrets.AWS_OIDC_ROLE_ARN }}
      AWS_DEPLOYMENT_ROLE_ARN: ${{ secrets.AWS_DEPLOYMENT_ROLE_ARN }}

  update-infrastructure:
    name: Update Infrastructure
    needs: [ semantic-release, build-and-push ]
    if: needs.build-and-push.result == 'success'
    uses: ./.github/workflows/update_infrastructure.yml
    with:
      image_tag: ${{ needs.semantic-release.outputs.version }}
      application_name: ${{inputs.application-name}}
      infrastructure_repo: ${{inputs.infrastructure_repo}}
      tfvars_path: 'terraform/terraform.auto.tfvars.json'
      base_branch: ${{inputs.infrastructure_base_branch}}
      app-id: ${{inputs.deployment-app-id}}
      github-organization: 'blw-ofag-ufag'
    secrets:
      GH_APP_PRIVATE_KEY: ${{ secrets.DEPLOYMENT_APP_PRIVATE_KEY }}

  merge-main-develop:
    name: '.'
    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
    uses: ./.github/workflows/merge_main_develop.yml
    needs: [ semantic-release ]
    secrets:
      SEMVER_PRIVATE_KEY: ${{ secrets.SEMVER_PRIVATE_KEY }}
    with:
      app-id: ${{ inputs.app-id }}