Skip to content

Commit 7de0b50

Browse files
Ti8m-BigATi8m-BigA
committed
feat(backend-workflow): adds backend workflow
1 parent 045df3d commit 7de0b50

21 files changed

Lines changed: 869 additions & 102 deletions

‎.github/examples/backend_default_workflow.yml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
name: "backend default workflow"
2+
3+
permissions:
4+
contents: write
5+
pull-requests: write
6+
id-token: write
7+
issues: write
8+
9+
on:
10+
pull_request:
11+
branches: [ main, develop ]
12+
push:
13+
branches: [ main, develop ]
14+
merge_group:
15+
branches: [ main, develop ]
16+
jobs:
17+
# maps the branch to an environment and sets it as output for the rest of the workflow
18+
set-env:
19+
runs-on: ubuntu-latest
20+
outputs:
21+
environment: ${{ steps.map-branch-to-env.outputs.environment }}
22+
23+
steps:
24+
- id: map-branch-to-env
25+
shell: bash
26+
run: |
27+
if [[ "${GITHUB_REF}" == "refs/heads/develop" ]]; then
28+
echo "environment=dev" >> "$GITHUB_OUTPUT"
29+
elif [[ "${GITHUB_REF}" == "refs/heads/main" ]]; then
30+
echo "environment=int" >> "$GITHUB_OUTPUT"
31+
else
32+
echo "unable to set environment for ref ${GITHUB_REF}"
33+
fi
34+
35+
36+
backend-workflow:
37+
name: "."
38+
uses: ./.github/workflows/backend_workflow.yml
39+
needs: [ set-env ]
40+
secrets:
41+
GH_ORG_GITLEAKS_PRIVATE_KEY: ${{ secrets.GH_ORG_GITLEAKS_PRIVATE_KEY }}
42+
LICENSE_KEY_GITLEAKS: ${{ secrets.LICENSE_KEY_GITLEAKS }}
43+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
44+
AWS_OIDC_ROLE_ARN: ${{ secrets.AWS_OIDC_ROLE_ARN }}
45+
AWS_DEPLOYMENT_ROLE_ARN: ${{ secrets.AWS_DEPLOYMENT_ROLE_ARN }}
46+
SEMVER_PRIVATE_KEY: ${{secrets.SEMVER_PRIVATE_KEY}}
47+
NIST_OWASP_API_KEY: ${{ secrets.NIST_OWASP_API_KEY }}
48+
DEPLOYMENT_APP_PRIVATE_KEY: ${{ secrets.PC_CORE_BLW_AGATE_DEV_DEPLOY_PRIVATE_KEY }}
49+
with:
50+
environment: ${{ needs.set-env.outputs.environment }}
51+
semver-app-id: ${{vars.SEMVER_APP_ID}}
52+
gitleaks-app-id: ${{ vars.GH_ORG_GITLEAKS_APP_ID }}
53+
aws-region: ${{ vars.AWS_REGION }}
54+
ecr-repository-name: 'agate-test-backend'
55+
deployment-app-id: ${{ vars.PC_CORE_BLW_AGATE_DEV_DEPLOY_APP_ID}}
56+
application-name: 'agate-test-backend'
57+
infrastructure_repo: 'pc-core-blw-agate-dev'
58+
github-organization: 'blw-ofag-ufag'

‎.github/examples/frontend_trigger_default_workflow.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ jobs:
5555
uses: blw-ofag-ufag/atlas-code-github-workflows/.github/workflows/frontend_workflow.yml@v1.4.0
5656
needs: [set-env, resolve-env-vars]
5757
secrets:
58-
GH_ORG_PRIVATE_KEY: ${{ secrets.GH_ORG_PRIVATE_KEY }}
58+
SEMVER_PRIVATE_KEY: ${{ secrets.SEMVER_PRIVATE_KEY }}
5959
GH_ORG_GITLEAKS_PRIVATE_KEY: ${{ secrets.GH_ORG_GITLEAKS_PRIVATE_KEY }}
6060
LICENSE_KEY_GITLEAKS: ${{ secrets.LICENSE_KEY_GITLEAKS }}
6161
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

‎.github/workflows/backend_build_push_image.yml‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
name: Build and Push Backend Docker Image to ECR
2+
run-name: Build and Push to ECR - ${{ inputs.environment }} - ${{ inputs.version }}
3+
on:
4+
workflow_call:
5+
inputs:
6+
environment:
7+
type: string
8+
required: true
9+
description: "environment to deploy to, used for selecting correct AWS credentials and CloudFront distribution based on environment specific secrets and variables"
10+
aws-region:
11+
type: string
12+
required: true
13+
description: "AWS region for deployment and AWS CLI commands"
14+
ecr-repository-name:
15+
required: true
16+
type: string
17+
version:
18+
required: true
19+
type: string
20+
description: "Version tag for the Docker image"
21+
secrets:
22+
AWS_OIDC_ROLE_ARN:
23+
description: "OIDC role ARN for AWS credentials"
24+
required: true
25+
AWS_DEPLOYMENT_ROLE_ARN:
26+
description: "Deployment role ARN for AWS credentials"
27+
required: true
28+
outputs:
29+
image:
30+
value: ${{ jobs.build-push-image.outputs.image }}
31+
32+
jobs:
33+
build-push-image:
34+
name: Build and push docker image
35+
runs-on: ubuntu-latest
36+
environment: ${{ inputs.environment }}
37+
timeout-minutes: 5
38+
outputs:
39+
image: ${{ steps.push-image.outputs.image }}
40+
env:
41+
AWS_REGION: ${{ inputs.aws-region }}
42+
ECR_REPOSITORY: ${{inputs.ecr-repository-name}}
43+
permissions:
44+
id-token: write
45+
contents: read
46+
steps:
47+
- name: Print GitHub Context Safely
48+
run: |
49+
echo "--- GitHub Context ---"
50+
echo "${GITHUB_REPOSITORY}"
51+
echo "${GITHUB_REF}"
52+
echo "${GITHUB_SHA}"
53+
- name: Validate deployment inputs
54+
env:
55+
VERSION: ${{ inputs.version }}
56+
run: |
57+
set -euo pipefail
58+
[[ "$VERSION" =~ ^[0-9]+(\.[0-9]+){2}([.-][0-9A-Za-z]+)*$ ]] || { echo "Invalid version"; exit 1; }
59+
echo "VERSION=$VERSION" >> "$GITHUB_ENV"
60+
- name: Checkout
61+
uses: actions/checkout@v6
62+
with:
63+
ref: ${{ format('v{0}', inputs.version) }}
64+
65+
- name: Set up JDK
66+
uses: actions/setup-java@v5
67+
with:
68+
java-version: '25'
69+
distribution: 'corretto'
70+
71+
- name: Restore Maven Cache
72+
uses: actions/cache/restore@v5
73+
with:
74+
path: ~/.m2/repository
75+
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
76+
restore-keys: |
77+
${{ runner.os }}-maven-
78+
79+
- name: Maven package
80+
run: mvn -B clean package -DskipTests -T 1C
81+
82+
- name: Set image tag to GITHUB_ENV
83+
run: echo "IMAGE_TAG=${VERSION}" >> $GITHUB_ENV
84+
85+
- name: Configure AWS credentials
86+
uses: aws-actions/configure-aws-credentials@v6
87+
with:
88+
role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
89+
aws-region: ${{ env.AWS_REGION }}
90+
91+
# activate once blueprint is ready
92+
# - name: Assume deployment role
93+
# uses: aws-actions/configure-aws-credentials@v4
94+
# with:
95+
# role-to-assume: ${{ secrets.AWS_DEPLOYMENT_ROLE_ARN }}
96+
# aws-region: ${{ env.AWS_REGION }}
97+
# role-chaining: true
98+
# role-skip-session-tagging: true
99+
100+
- name: Login to AWS ECR
101+
id: login-ecr
102+
uses: aws-actions/amazon-ecr-login@v2
103+
104+
- name: Set up QEMU
105+
uses: docker/setup-qemu-action@v4
106+
107+
- name: Set up Docker Buildx
108+
uses: docker/setup-buildx-action@v4
109+
110+
- name: Generate Docker metadata
111+
id: meta
112+
uses: docker/metadata-action@v6
113+
with:
114+
images: ${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}
115+
tags: |
116+
type=raw,value=${{ env.VERSION }}
117+
type=sha
118+
119+
- name: Build and push to ECR
120+
id: build
121+
uses: docker/build-push-action@v7
122+
with:
123+
context: .
124+
file: ./Dockerfile
125+
platforms: linux/amd64,linux/arm64
126+
push: true
127+
tags: ${{ steps.meta.outputs.tags }}
128+
# Caching makes subsequent builds much faster
129+
cache-from: type=gha
130+
cache-to: type=gha,mode=max
131+
provenance: false
132+
sbom: true
133+

‎.github/workflows/backend_checkstyle.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
name: Backend Checkstyle ensures correct style and formatting of the codebase
2+
run-name: Checkstyle
3+
on:
4+
workflow_call:
5+
6+
jobs:
7+
checkstyle:
8+
name: Checkstyle
9+
runs-on: ubuntu-latest
10+
timeout-minutes: 5
11+
steps:
12+
- name: Checkout
13+
uses: actions/checkout@v6
14+
with:
15+
fetch-depth: 0
16+
17+
- name: Set up JDK 25
18+
uses: actions/setup-java@v5
19+
with:
20+
java-version: '25'
21+
distribution: 'corretto'
22+
23+
- name: Restore Maven Cache
24+
uses: actions/cache/restore@v5
25+
with:
26+
path: ~/.m2/repository
27+
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
28+
restore-keys: |
29+
${{ runner.os }}-maven-
30+
31+
- name: Run Checkstyle
32+
run: mvn checkstyle:check
33+
34+
- name: Save Maven Cache
35+
uses: actions/cache/save@v5
36+
if: success()
37+
with:
38+
path: ~/.m2/repository
39+
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}

‎.github/workflows/backend_owasp_dependency_check.yml‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
name: OWASP Dependency Check ensure no vulnerable dependencies
2+
run-name: OWASP Dependency Check
3+
on:
4+
workflow_call:
5+
secrets:
6+
NIST_OWASP_API_KEY:
7+
description: "API Key for the national vulnerability database used by OWASP Dependency Check"
8+
required: true
9+
jobs:
10+
owasp-dependency-check:
11+
name: OWASP Dependency Check
12+
runs-on: ubuntu-latest
13+
timeout-minutes: 100
14+
steps:
15+
- name: Checkout
16+
uses: actions/checkout@v6
17+
with:
18+
fetch-depth: 0
19+
20+
- name: Set up JDK 25
21+
uses: actions/setup-java@v5
22+
with:
23+
java-version: '25'
24+
distribution: 'corretto'
25+
26+
- name: Get Date for OWASP Cache
27+
id: get-cache-date
28+
run: |
29+
echo "date=$(/bin/date -u "+%Y%m%d")" >> $GITHUB_OUTPUT
30+
shell: bash
31+
32+
- name: check NIST key length
33+
env:
34+
NIST_OWASP_API_KEY: ${{ secrets.NIST_OWASP_API_KEY }}
35+
run: |
36+
echo "Key length: ${#NIST_OWASP_API_KEY}"
37+
38+
- name: Restore Maven Cache
39+
uses: actions/cache/restore@v5
40+
with:
41+
path: ~/.m2/repository
42+
# Using date in cache key as OWASP database may change, without the pom changing
43+
key: ${{ runner.os }}-owasp-${{ steps.get-cache-date.outputs.date }}-${{ hashFiles('**/pom.xml') }}
44+
restore-keys: |
45+
${{ runner.os }}-owasp-${{ steps.get-cache-date.outputs.date }}
46+
${{ runner.os }}-owasp-
47+
48+
49+
50+
- name: Run OWASP Dependency Check
51+
run: |
52+
mvn org.owasp:dependency-check-maven:check \
53+
-DossindexAnalyzerEnabled=false \
54+
-DnvdApiKey=${{ secrets.NIST_OWASP_API_KEY }} \
55+
-DossindexAnalyzerEnabled=false \
56+
-DpnpmAuditAnalyzerEnabled=false \
57+
-DnodeAuditAnalyzerEnabled=false \
58+
-DyarnAuditAnalyzerEnabled=false
59+
60+
- name: Save Maven Cache
61+
uses: actions/cache/save@v5
62+
if: always()
63+
with:
64+
path: ~/.m2/repository
65+
key: ${{ runner.os }}-owasp-${{ steps.get-cache-date.outputs.date }}-${{ hashFiles('**/pom.xml') }}

‎.github/workflows/backend_unit_test_sonarqube.yml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
name: Unit Tests and SonarQube analysis for Java backend
2+
run-name: Unit Tests and SonarQube
3+
on:
4+
workflow_call:
5+
secrets:
6+
SONAR_TOKEN:
7+
description: "SonarQube authentication token"
8+
required: true
9+
jobs:
10+
unit-test-sonarqube:
11+
name: Unit Tests and SonarQube
12+
runs-on: ubuntu-latest
13+
timeout-minutes: 10
14+
steps:
15+
- name: Checkout
16+
uses: actions/checkout@v6
17+
with:
18+
fetch-depth: 0
19+
20+
- name: Set up JDK 25
21+
uses: actions/setup-java@v5
22+
with:
23+
java-version: '25'
24+
distribution: 'corretto'
25+
26+
- name: Restore Maven Cache
27+
uses: actions/cache/restore@v5
28+
with:
29+
path: ~/.m2/repository
30+
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
31+
restore-keys: |
32+
${{ runner.os }}-maven-
33+
34+
- name: Run Unit Tests
35+
run: mvn -B test -T 1C
36+
37+
- name: Run SonarQube Analysis
38+
env:
39+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
40+
run: |
41+
mvn -T 1C sonar:sonar -Dsonar.coverage.jacoco.xmlReportPaths=target/jacoco-report/jacoco.xml
42+
43+
- name: Save Maven Cache
44+
uses: actions/cache/save@v5
45+
if: success()
46+
with:
47+
path: ~/.m2/repository
48+
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}

0 commit comments

Comments
 (0)