platform-build.yaml

name: Platform - Build

on:
  workflow_call:
    inputs:
      platform-name:
        required: true
        type: string
      docker-build:
        type: boolean
        default: true
      integration-tests:
        type: boolean
        default: true
      code-style-checks:
        type: boolean
        default: true
      upload-scanned-sarif-report:
        type: boolean
        default: true
      release-otc-helm-chart:
        type: boolean
        default: false
      oras_repos:
        required: false
        type: string
        description: 'Comma-separated list of ORAS repositories to pull (optional)'
        default: ''

jobs:

  otc-helm:
    if: ${{ inputs.release-otc-helm-chart }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: OTC Helm - lint the chart
        run: |
          cd ${{ github.workspace }}
          cd helm/otc/chart
          helm lint .

  code-style:
    if: ${{ inputs.code-style-checks }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          
      - name: Set up JDK Corretto 21 
        uses: actions/setup-java@v4
        with:
          distribution: 'corretto'
          java-version: '21'
          architecture: x64
          
      - name: Validate Java code formatting
        run: mvn -T 1C formatter:validate
        
  build:
    runs-on: ${{ matrix.runner }}
    permissions:
      packages: read
    strategy:
      matrix:
        include:
          - runner: ubuntu-latest
            platform: amd64
          - runner: ubuntu-24.04-arm
            platform: arm64

    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0

    - name: Cache local Maven repository
      uses: actions/cache@v4
      with:
        path: ~/.m2/repository
        key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
        restore-keys: ${{ runner.os }}-maven-

    - name: Set up JDK Corretto 21
      uses: actions/setup-java@v4
      with:
        distribution: 'corretto'
        java-version: '21'

    - name: Install NodeJS
      uses: actions/setup-node@v4
      with:
        node-version: 22.x
        
    - name: Install TypeScript and esbuild
      run: npm i -g typescript@5.9.3 esbuild
      
    - name: Maven Build
      run: mvn clean install

    - name: Setup ORAS CLI
      uses: oras-project/setup-oras@v1

    - name: ORAS Login to GHCR
      run: echo "${{ secrets.GITHUB_TOKEN }}" | oras login ghcr.io -u oauth2 --password-stdin

    - name: Pull ORAS Repos
      env:
        ORAS_REPOS: ${{ inputs.oras_repos }}
      run: |
        mkdir -p oras-artifacts
        IFS=','; for repo in $ORAS_REPOS; do
          echo "Pulling $repo"
          oras pull "$repo" -o application/oras-artifacts
        done

    - name: Log in to Registry
      if: ${{ inputs.docker-build }}
      uses: docker/login-action@v3
      with:
        registry: ghcr.io
        username: ${{ secrets.DOCKER_USERNAME }}
        password: ${{ secrets.DOCKER_PASSWORD }}

    - name: Set up Docker Buildx
      if: ${{ inputs.docker-build }}
      uses: docker/setup-buildx-action@v3

    - name: Build and push by digest
      if: ${{ inputs.docker-build }}
      id: build
      uses: docker/build-push-action@v6
      with:
        context: application
        platforms: ${{ matrix.platform }}
        tags: ghcr.io/codbex/${{ inputs.platform-name }}
        outputs: type=image,push-by-digest=true,name-canonical=true,push=true

    - name: Export digest
      if: ${{ inputs.docker-build }}
      run: |
        mkdir -p /tmp/digests
        digest="${{ steps.build.outputs.digest }}"
        touch "/tmp/digests/${digest#sha256:}"

    - name: Upload digest
      if: ${{ inputs.docker-build }}
      uses: actions/upload-artifact@v4
      with:
        name: digests-${{ matrix.platform }}
        path: /tmp/digests/*
        if-no-files-found: error
        retention-days: 1

  build-docker-manifest:
    if: ${{ inputs.docker-build }}
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Download digests
        uses: actions/download-artifact@v4
        with:
          path: /tmp/digests
          pattern: digests-*
          merge-multiple: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Create manifest list and push
        working-directory: /tmp/digests
        run: |
          docker buildx imagetools create -t ghcr.io/codbex/${{ inputs.platform-name }}:latest \
            $(printf 'ghcr.io/codbex/${{ inputs.platform-name }}@sha256:%s ' *)

  integration-tests:
    if: ${{ inputs.integration-tests }}
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          
      - name: Cache local Maven repository
        uses: actions/cache@v4
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: ${{ runner.os }}-maven-
          
      - name: Set up JDK Corretto 21
        uses: actions/setup-java@v4
        with:
          distribution: 'corretto'
          java-version: '21'
          architecture: x64
          
      - name: Install NodeJS
        uses: actions/setup-node@v4
        with:
          node-version: 22.x
          
      - name: Install TypeScript and esbuild
        run: npm install -g typescript@5.9.3 esbuild

      - name: Install ttyd (prebuilt)
        run: |
          sudo apt update
          sudo apt install -y ttyd

      - name: Verify ttyd installation
        run: ttyd --version

      - name: Integration tests
        run: mvn clean install -P integration-tests
        
      - name: Generate a random artifact name
        if: always()
        id: generate_name
        run: |
          TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
          echo "ARTIFACT_NAME=selenide-screenshots-${TIMESTAMP}.zip" >> $GITHUB_ENV
          
      - name: Upload selenide screenshots
        uses: actions/upload-artifact@v4
        if: always()
        with:
          retention-days: 1
          name: ${{ env.ARTIFACT_NAME }}
          path: integration-tests/build/reports/tests
          
  scan-image:
    if: ${{ inputs.docker-build }}
    name: Scan Docker image using Docker Scout
    needs: [build-docker-manifest]
    runs-on: ubuntu-latest

    steps:
      - name: Checkout # need to upload the report to GitHub Security tab
        uses: actions/checkout@v4
      - name: Log in Docker Hub # required dockerhub login for docker/scout-action
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}

      - name: Docker Scout Quickview and CVEs
        uses: docker/scout-action@v1
        with:
          registry-user: ${{ secrets.DOCKER_USERNAME }}
          registry-password: ${{ secrets.DOCKER_PASSWORD }}
          command: quickview,cves
          image: ghcr.io/codbex/${{ inputs.platform-name }}:latest
          sarif-file: sast_docker_scout_sarif.json
          summary: true
          only-fixed: false

      - name: Upload Docker Scout SARIF file as artifact
        uses: actions/upload-artifact@v4
        with:
          name: sast_docker_scout_sarif.json
          path: sast_docker_scout_sarif.json

      - name: Upload Docker Scout SARIF Report to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        if: ${{ inputs.upload-scanned-sarif-report }}
        with:
          sarif_file: sast_docker_scout_sarif.json

  dast-scan:
    if: ${{ inputs.docker-build }}
    name: Perform DAST testing using ZAP
    needs: [build-docker-manifest]
    runs-on: ubuntu-latest

    services:
      app:
        image: ghcr.io/codbex/${{ inputs.platform-name }}:latest
        ports:
          - 80:80

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Wait for app to start
        run: |
          set -e

          URL="http://localhost:80/actuator/health/readiness"
          READY=false

          for i in {1..30}; do
            echo "Checking readiness at $URL... attempt $i"
            if curl -fsS "$URL"; then
              echo "----------------------"
              echo "Application is ready."
              READY=true
              break
            fi
            sleep 5
          done

          if [ "$READY" != "true" ]; then
            echo "----------------------"
            echo "Application failed to become ready after 30 attempts"
            echo "Dumping app service logs:"
            echo "----------------------"
            docker logs "${{ job.services.app.id }}"
            exit 1
          fi

      - name: Run OWASP ZAP Full Scan
        uses: zaproxy/action-full-scan@v0.12.0
        with:
          target: 'http://localhost:80'
          cmd_options: '-T 10' # https://www.zaproxy.org/docs/docker/full-scan/
          artifact_name: dast_zap_report # all results will be uploaded with an artifact with this name
          allow_issue_writing: false # create an issue with the results
          issue_title: '[DAST] ZAP Full Scan Report'