server-charm-release.yml

name: "[server] Release testflinger-k8s charm"
run-name: "[server] Release testflinger-k8s charm (${{ github.event_name == 'push' && 'beta' || github.event.inputs.channel }})"
permissions:
  contents: read
on:
  push:
    branches: [main]
    paths:
      - .github/workflows/server-charm-release.yml
      - server/**
  workflow_dispatch:
    inputs:
      channel:
        description: The channel to release the charm to
        required: true
        default: latest/edge
        type: choice
        options:
          - latest/beta
          - latest/edge

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  REGISTRY: ghcr.io

jobs:
  build-and-push-charm:
    name: Build and Push Charm
    runs-on: [self-hosted, linux, jammy, X64]
    permissions:
      actions: read  # necessary to read runner information
      contents: write  # necessary to create tag(s)
      packages: write  # necessary to create push image

    env:
      IMAGE_NAME: ${{ github.repository }}

    steps:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
        with:
          cache-binary: false
          buildkitd-config-inline: |
            [registry."docker.io"]
              mirrors = ["https://github-runner-dockerhub-cache.canonical.com:5000"]

      - name: Checkout
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
        with:
          persist-credentials: false

      - name: Log in to the Container registry
        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

      - name: Build and push backend Docker image
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
        with:
          context: ./server
          build-contexts: |
            common=./common
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

      - name: Modify charmcraft.yaml OCI Image
        if: github.event_name == 'workflow_dispatch'
        env:
          IMAGE_FROM_BRANCH: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
        run: sed -i "s|ghcr.io/canonical/testflinger:main|$IMAGE_FROM_BRANCH|g" server/charm/charmcraft.yaml

      - name: Upload charm to charmhub
        uses: canonical/charming-actions/upload-charm@1753e0803f70445132e92acd45c905aba6473225 # 2.7.0
        with:
          charm-path: server/charm
          credentials: "${{ secrets.CHARMHUB_TOKEN }}"
          github-token: "${{ secrets.GITHUB_TOKEN }}"
          channel: ${{ github.event_name == 'push' && 'latest/beta' || github.event.inputs.channel }}

  scan:
    needs: build-and-push-charm
    name: Scan Charm with Trivy
    runs-on: ubuntu-latest
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
    env:
      CHANNEL: ${{ github.event_name == 'push' && 'beta' || github.event_name == 'schedule' && 'stable' || github.event.inputs.channel }}
    steps:
      - name: Install Juju
        run: sudo snap install juju --classic
      - name: Download and Unpack Charm
        run: |
          CHANNEL=$(echo "$CHANNEL" | sed "-e s,latest/,,")
          CHARM=$(juju download testflinger-k8s --channel=$CHANNEL 2>&1 | grep ".charm$" | sed -e 's/.*\(testflinger.*.charm\)/\1/')

          # Extract the contents to a local folder
          unzip -d unpacked-charm $CHARM
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
        with:
          scan-type: 'fs'
          scan-ref: 'unpacked-charm'
          exit-code: 1
          format: 'sarif'
          vuln-type: library
          output: 'testflinger-k8s-trivy-results.sarif'
          # By default, SARIF format enforces output of all vulnerabilities regardless of configured severities.
          severity: 'UNKNOWN,LOW,MEDIUM,CRITICAL,HIGH'
      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
        with:
          sarif_file: 'testflinger-k8s-trivy-results.sarif'
          wait-for-processing: "true"