pipeline.yml

name: "CI Pipeline"

on:
  push:
    branches: [main]
    paths-ignore:
      - "**/*.md"
  pull_request:
  # Allow to run this workflow manually
  workflow_dispatch:

jobs:
  ########################################
  # Jobs operating on the whole repository
  ########################################

  security-jobs:
    uses: ./.github/workflows/security-jobs.yml
    secrets: inherit # so the backend workflow can access "secrets.SLACK_WEBHOOK_URL" and others
    permissions:
      contents: read
      security-events: write # trivy scan needs this

  ##############
  # Backend jobs
  ##############

  backend-setup-gradle:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Setup and validate Gradle
        uses: gradle/actions/setup-gradle@v4

  backend-checks:
    needs:
      - backend-setup-gradle
    uses: ./.github/workflows/backend-checks.yml
    secrets: inherit

  backend-build-image-and-scan:
    uses: ./.github/workflows/backend-build-image-and-scan.yml
    secrets: inherit
    permissions:
      contents: read
      security-events: write
    with:
      run-id: ${{ github.run_id }}
      image-ref: ghcr.io/${{ github.repository }}-backend:${{ github.event.pull_request.head.sha || github.sha }}
      container-registry: ghcr.io

  backend-push-image-to-registry:
    if: ${{ github.ref == 'refs/heads/main' }}
    # For PR releases, labels could be used like this:
    # if: ${{ github.ref == 'refs/heads/main' || contains(github.event.pull_request.labels.*.name, 'dev-env') || contains(github.event.labeled.labels.*.name, 'dev-env') }}
    needs:
      - security-jobs
      - backend-checks
      - backend-build-image-and-scan
    uses: ./.github/workflows/backend-push-image-to-registry.yml
    secrets: inherit
    permissions:
      contents: read
      id-token: write # This is used to complete the identity challenge with sigstore/fulcio..
      packages: write
    with:
      run-id: ${{ github.run_id }}
      container-registry: ghcr.io
      image-ref: ghcr.io/${{ github.repository }}-backend:${{ github.event.pull_request.head.sha || github.sha }}

  backend-push-reports-to-ris-reports:
    if: ${{ !cancelled() && github.ref == 'refs/heads/main' }}
    needs:
      - backend-checks
      - frontend-push-reports-to-ris-reports # this is to avoid our reports jobs (backend/frontend) to cause each other to
    uses: ./.github/workflows/backend-push-reports-to-ris-reports.yml
    secrets: inherit

  ###############
  # Frontend jobs
  ###############

  frontend-checks:
    uses: ./.github/workflows/frontend-checks.yml
    secrets: inherit

  frontend-build-image-and-scan:
    uses: ./.github/workflows/frontend-build-image-and-scan.yml
    secrets: inherit
    permissions:
      contents: read
      security-events: write
    with:
      run-id: ${{ github.run_id }}
      image-ref: ghcr.io/${{ github.repository }}-frontend:${{ github.event.pull_request.head.sha || github.sha }}

  frontend-push-image-to-registry:
    if: ${{ github.ref == 'refs/heads/main' }}
    # For PR releases, labels could be used like this:
    # if: ${{ github.ref == 'refs/heads/main' || contains(github.event.pull_request.labels.*.name, 'dev-env') || contains(github.event.labeled.labels.*.name, 'dev-env') }}
    needs:
      - security-jobs
      - frontend-checks
      - frontend-build-image-and-scan
    uses: ./.github/workflows/frontend-push-image-to-registry.yml
    secrets: inherit
    permissions:
      contents: read
      id-token: write # This is used to complete the identity challenge with sigstore/fulcio..
      packages: write
    with:
      run-id: ${{ github.run_id }}
      container-registry: ghcr.io
      image-ref: ghcr.io/${{ github.repository }}-frontend:${{ github.event.pull_request.head.sha || github.sha }}

  frontend-push-reports-to-ris-reports:
    if: ${{ !cancelled() && github.ref == 'refs/heads/main' }}
    needs:
      - frontend-checks
    uses: ./.github/workflows/frontend-push-reports-to-ris-reports.yml
    secrets: inherit

  #################
  # Deployment jobs
  #################

  deploy-staging:
    if: ${{ github.ref == 'refs/heads/main' }}
    needs:
      - security-jobs
      - frontend-checks
      - frontend-build-image-and-scan
      - frontend-push-image-to-registry
      - backend-checks
      - backend-build-image-and-scan
      - backend-push-image-to-registry
    uses: ./.github/workflows/deploy-staging.yml
    permissions:
      id-token: write
    secrets: inherit
    with:
      container-image-version: ${{ github.event.pull_request.head.sha || github.sha }}