ci-pipeline.yml

name: buildAppImage
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  # Allow to run this workflow manually
  workflow_dispatch:

permissions:
  contents: read

env:
  REGISTRY: ghcr.io

jobs:
  code-quality:
    uses: ./.github/workflows/code-quality.yml
    secrets:
      SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
      GERICHTSFINDER_ENCRYPTION_KEY: ${{ secrets.GERICHTSFINDER_ENCRYPTION_KEY }}
  sonarcloud-scan:
    if: ${{ github.actor != 'dependabot[bot]' }}
    runs-on: ubuntu-latest
    needs: [code-quality]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        name: coverage
      - name: SonarQube Scan
        uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  get-content-file:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - id: fetchLatestImageContent
        run: ./docker.sh --contentFromImage && mv content_from_image.json content.json
        continue-on-error: true
      - if: steps.fetchLatestImageContent.outcome == 'failure'
        run: pnpm i && pnpm run build:localContent
        env:
          STRAPI_API: "${{ vars.STRAPI_API }}"
          STRAPI_ACCESS_KEY: "${{ secrets.STRAPI_ACCESS_KEY }}"
      - name: Calculate content checksum
        id: checksum
        run: echo "content_checksum=$(./docker.sh --contentHashFromImage)" >> $GITHUB_OUTPUT
      - name: Upload content.json
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: content-file
          path: content.json
    outputs:
      content_checksum: ${{ steps.checksum.outputs.content_checksum }}

  # integration-tests:
  #   runs-on: ubuntu-latest
  #   env:
  #     STRAPI_API: "${{ vars.STRAPI_API }}"
  #     STRAPI_ACCESS_KEY: "${{ secrets.STRAPI_ACCESS_KEY }}"
  #   steps:
  #     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
  #     - uses: ./.github/actions/cached-checkout-install
  #     - run: pnpm run test:integration

  verify-local-e2e:
    needs: [get-content-file]
    uses: ./.github/workflows/e2e-test.yml
    with:
      require-published-app: false
      e2e-target: local
    secrets:
      GERICHTSFINDER_ENCRYPTION_KEY: ${{ secrets.GERICHTSFINDER_ENCRYPTION_KEY }}

  build-app-image:
    runs-on: ubuntu-latest
    steps:
      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: ./.github/actions/cached-checkout-install
      - run: ./docker.sh --build app
        env:
          SENTRY_AUTH_TOKEN: "${{ secrets.SENTRY_AUTH_TOKEN }}"
      - name: Save Docker image to file
        if: github.ref == 'refs/heads/main'
        run: docker save ${{ env.REGISTRY }}/${{ github.repository }}-app:latest | gzip > image.tar.gz
      - name: Upload docker image to artifact
        if: github.ref == 'refs/heads/main'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: docker-build
          path: image.tar.gz
          retention-days: 1

  testing-feature:
    if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/APL-266-feature-release'
    needs: [code-quality, verify-local-e2e, build-app-image]
    permissions:
      id-token: write # for cosign w/ keyless signing
      packages: write # for updating cosign attestation
      security-events: write
    uses: ./.github/workflows/testing-feature.yml
    secrets: inherit

  push-app-image:
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    needs: [code-quality, verify-local-e2e, build-app-image]
    permissions:
      id-token: write # for cosign w/ keyless signing
      packages: write # for updating cosign attestation
      security-events: write
    steps:
      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: docker-build
      - name: Load Docker image
        run: docker load --input image.tar.gz
      - name: Push the app image
        run: ./docker.sh --push app
      - run: ./docker.sh --build prod
      - run: echo "PROD_IMAGE_TAG=$(./docker.sh --prodImageTag)" >> $GITHUB_ENV
      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
        with:
          cosign-release: "v2.6.1" # use latest 2.x release until Kyverno supports 3.x
      - name: Generate cosign vulnerability scan record for PROD image
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        env:
          TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db
        with:
          image-ref: ${{ env.REGISTRY }}/${{ github.repository }}:${{ env.PROD_IMAGE_TAG }}
          format: "cosign-vuln"
          output: "vulnerabilities.json"
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        env:
          TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db
        with:
          image-ref: ${{ env.REGISTRY }}/${{ github.repository }}:${{ env.PROD_IMAGE_TAG }}
          format: "sarif"
          output: "trivy-results.sarif"
          ignore-unfixed: true
          vuln-type: "os,library"
          severity: "CRITICAL,HIGH"
      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd #v4.37.7
        with:
          sarif_file: "trivy-results.sarif"
      - run: ./docker.sh --push prod
      - run: ./docker.sh --sign prod
      - id: prod_image_tag
        run: echo "prod_image_tag=$(./docker.sh --prodImageTag)" >> $GITHUB_OUTPUT
      - name: Create SBOM
        uses: digitalservicebund/create-sbom@8446cc7ecd4955f86be1856e72306989bea38e36 # main branch, HEAD as of 2026-04-07
        with:
          image_name: ${{ github.repository }}-app
    outputs:
      prod_image_tag: ${{ steps.prod_image_tag.outputs.prod_image_tag }}

  deploy-preview:
    if: github.ref == 'refs/heads/main'
    needs: [push-app-image]
    runs-on: ubuntu-latest
    environment: preview
    concurrency: deploy-preview
    steps:
      - name: Deploy new preview image
        uses: digitalservicebund/argocd-deploy@e8f6b8f77c8b8eeef3f67fc5bba9521f89145645 # v1.0.0
        with:
          environment: environments/preview
          version: ${{ needs.push-app-image.outputs.prod_image_tag }}
          deploying_repo: a2j-rechtsantragstelle
          infra_repo: a2j-rechtsantragstelle-infra
          github_app_client_id: ${{ secrets.GITOPS_A2J_APP_CLIENT_ID }}
          github_app_private_key: ${{ secrets.GITOPS_A2J_APP_PRIVATE_KEY }}
          app: a2j-preview
          argocd_auth_token: ${{ secrets.ARGOCD_AUTH_TOKEN }}
          argocd_server: ${{ secrets.ARGOCD_SERVER_STACKIT }}
          argocd_sync_timeout: 600
      - name: Report Deployment
        uses: digitalservicebund/track-deployment@5a2815e150e1268983aac5ca04c8c046ed1b614a # v1.0.0
        with:
          project: a2j-rechtsantragstelle
          environment: preview
          metrics_deployment_webhook_url: ${{ secrets.METRICS_DEPLOYMENT_WEBHOOK_URL }}
          metrics_webhook_token: ${{ secrets.METRICS_WEBHOOK_TOKEN }}

  verify-preview-e2e:
    needs: [deploy-preview]
    uses: ./.github/workflows/e2e-test.yml
    with:
      require-published-app: false
      use-existing-server: true
      e2e-target: preview

  deploy-staging:
    if: github.ref == 'refs/heads/main'
    needs: [push-app-image, deploy-preview]
    runs-on: ubuntu-latest
    environment: staging
    concurrency: deploy-staging
    steps:
      - name: Deploy new staging image
        uses: digitalservicebund/argocd-deploy@e8f6b8f77c8b8eeef3f67fc5bba9521f89145645 # v1.0.0
        with:
          environment: environments/staging
          version: ${{ needs.push-app-image.outputs.prod_image_tag }}
          deploying_repo: a2j-rechtsantragstelle
          infra_repo: a2j-rechtsantragstelle-infra
          github_app_client_id: ${{ secrets.GITOPS_A2J_APP_CLIENT_ID }}
          github_app_private_key: ${{ secrets.GITOPS_A2J_APP_PRIVATE_KEY }}
          app: a2j-staging
          argocd_auth_token: ${{ secrets.ARGOCD_AUTH_TOKEN }}
          argocd_server: ${{ secrets.ARGOCD_SERVER_STACKIT }}
          argocd_sync_timeout: 600
      - name: Report Deployment
        uses: digitalservicebund/track-deployment@5a2815e150e1268983aac5ca04c8c046ed1b614a # v1.0.0
        with:
          project: a2j-rechtsantragstelle
          environment: staging
          metrics_deployment_webhook_url: ${{ secrets.METRICS_DEPLOYMENT_WEBHOOK_URL }}
          metrics_webhook_token: ${{ secrets.METRICS_WEBHOOK_TOKEN }}

  deploy-production:
    if: github.ref == 'refs/heads/main'
    needs: [verify-preview-e2e, push-app-image]
    runs-on: ubuntu-latest
    environment: production
    concurrency: deploy-production
    steps:
      - name: Deploy new production image
        uses: digitalservicebund/argocd-deploy@e8f6b8f77c8b8eeef3f67fc5bba9521f89145645 # v1.0.0
        with:
          environment: environments/production
          version: ${{ needs.push-app-image.outputs.prod_image_tag }}
          deploying_repo: a2j-rechtsantragstelle
          infra_repo: a2j-rechtsantragstelle-infra
          github_app_client_id: ${{ secrets.GITOPS_A2J_APP_CLIENT_ID }}
          github_app_private_key: ${{ secrets.GITOPS_A2J_APP_PRIVATE_KEY }}
          app: a2j-production
          argocd_auth_token: ${{ secrets.ARGOCD_AUTH_TOKEN }}
          argocd_server: ${{ secrets.ARGOCD_SERVER_STACKIT }}
          argocd_sync_timeout: 600
      - name: Report Deployment
        uses: digitalservicebund/track-deployment@5a2815e150e1268983aac5ca04c8c046ed1b614a # v1.0.0
        with:
          project: a2j-rechtsantragstelle
          environment: production
          metrics_deployment_webhook_url: ${{ secrets.METRICS_DEPLOYMENT_WEBHOOK_URL }}
          metrics_webhook_token: ${{ secrets.METRICS_WEBHOOK_TOKEN }}

  test-production-text:
    needs: [deploy-production]
    runs-on: ubuntu-latest
    steps:
      - run: curl -s -v "https://service.justiz.de" | grep -q "Justiz-Services"

  alert-pipeline-failure:
    name: Send failure message to Slack
    needs:
      [
        code-quality,
        get-content-file,
        verify-local-e2e,
        build-app-image,
        push-app-image,
        deploy-staging,
        deploy-preview,
        verify-preview-e2e,
        deploy-production,
        test-production-text,
      ]
    if: always() && failure() && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - uses: digitalservicebund/notify-on-failure-gha@671832f192aee0a068fd92b2f6deb975df794a84
        with:
          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
          SLACK_CHANNEL_ID: ${{ secrets.SLACK_CHANNEL_A2J_ALERT_ID }}