ecr-image-build.yml

---
name: AWS ECR Build Image

on:  # yamllint disable-line rule:truthy
  release:
    types:
      - "released"
  push:
    branches:
      - "main"
      - "*-rc"
    tags:
      - "v*"
  workflow_dispatch:

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        platforms:
          - [linux/amd64, ubuntu-latest]
          - [linux/arm64, ubuntu-24.04-arm]
    runs-on: ${{ matrix.platforms[1] }}
    steps:
      - name: Prepare
        run: |
          platform=${{ matrix.platforms[0] }}
          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV

      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@ff717079ee2060e4bcee96c4779b553acc87447c # v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: eu-central-1

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@c962da2960ed15f492addc26fffa274485265950 # v2

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
        with:
          images: ${{ steps.login-ecr.outputs.registry }}/onaio/onadata
          tags: |
            type=ref,event=branch
            type=ref,event=tag

      - name: Get docker repository URL
        id: get-repo-url
        run: |
          echo "docker_repo=${{ steps.login-ecr.outputs.registry }}\
               /onaio/onadata:${{ steps.meta.outputs.version }}"\
               | sed 's/ //g' >> $GITHUB_ENV

      - name: (Ubuntu) Build and push
        id: docker-build-ubuntu
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
        with:
          context: .
          file: ./docker/onadata-uwsgi/Dockerfile.ubuntu
          platforms: ${{ matrix.platforms[0] }}
          cache-from: type=gha,scope=${{ env.PLATFORM_PAIR }}
          cache-to: type=gha,scope=${{ env.PLATFORM_PAIR }},mode=max
          secrets: |
            ONADEPLOY_GH_TOKEN=${{ secrets.ONADEPLOY_GH_TOKEN }}
          build-args: >
            optional_packages=PyYAML
            django-redis
            ${{ secrets.ECR_OPTIONAL_PACKAGES }}
          labels: ${{ steps.meta.outputs.labels }}
          provenance: false
          outputs: >
            type=image,
            name=${{ steps.login-ecr.outputs.registry }}/onaio/onadata,
            push-by-digest=true,
            name-canonical=true,
            push=true,
            compression=zstd

      - name: Export digest
        run: |
          mkdir -p /tmp/digests
          digest="${{ steps.docker-build-ubuntu.outputs.digest }}"
          touch "/tmp/digests/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: digests-${{ env.PLATFORM_PAIR }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1

  merge:
    runs-on: ubuntu-latest
    needs:
      - build
    steps:
      - name: Download digests
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          path: /tmp/digests
          pattern: digests-*
          merge-multiple: true

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@ff717079ee2060e4bcee96c4779b553acc87447c # v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: eu-central-1

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@c962da2960ed15f492addc26fffa274485265950 # v2

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
        with:
          images: ${{ steps.login-ecr.outputs.registry }}/onaio/onadata
          tags: |
            type=ref,event=branch
            type=ref,event=tag

      - name: Get docker repository URL
        id: get-repo-url
        run: |
          echo "docker_repo=${{ steps.login-ecr.outputs.registry }}\
               /onaio/onadata:${{ steps.meta.outputs.version }}"\
               | sed 's/ //g' >> $GITHUB_ENV

      - name: Create manifest list and push
        working-directory: /tmp/digests
        run: |
          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") $(printf '${{ steps.login-ecr.outputs.registry }}/onaio/onadata@sha256:%s ' *)

      - name: Inspect image
        run: |
          docker buildx imagetools inspect ${{ env.docker_repo }}

      - name: Install Trivy
        uses: aquasecurity/setup-trivy@3fb12ec12f41e471780db15c232d5dd185dcb514 # v0.2.6
        with:
          version: v0.69.3
          cache: true

      - name: Configure Trivy VEX Hub with DHI advisories
        run: |
          mkdir -p ~/.trivy/vex
          cat > ~/.trivy/vex/repository.yaml << 'EOF'
          repositories:
            - name: default
              url: https://github.com/aquasecurity/vexhub
              enabled: true
            - name: dhi-vex
              url: https://github.com/docker-hardened-images/advisories
              enabled: true
          EOF
          trivy vex repo download

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
        with:
          version: "v0.69.3"
          image-ref: ${{ env.docker_repo }}
          format: "sarif"
          output: "trivy-results.sarif"
          trivy-config: trivy.yaml

      - name: Upload Trivy scan result to Github security lab
        uses: github/codeql-action/upload-sarif@256d634097be96e792d6764f9edaefc4320557b1 # v4
        with:
          sarif_file: "trivy-results.sarif"
        continue-on-error: true

      - name: Cache Trivy HTML template
        id: cache-template
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: html.tpl
          key: trivy-html-template-v1

      - name: Download Trivy HTML template
        if: steps.cache-template.outputs.cache-hit != 'true'
        run: |
          url="https://raw.githubusercontent.com"
          url+="/aquasecurity/trivy/main/contrib/html.tpl"
          wget -q "$url" -O html.tpl

      - name: Run Trivy vulnerability scanner (HTML report)
        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
        with:
          version: "v0.69.3"
          image-ref: ${{ env.docker_repo }}
          format: "template"
          template: "@html.tpl"
          output: "trivy-results.html"
          trivy-config: trivy.yaml

      - name: Upload Trivy SARIF as artifact
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: trivy-sarif-results
          path: trivy-results.sarif
          retention-days: 30

      - name: Upload Trivy HTML report as artifact
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: trivy-html-report
          path: trivy-results.html
          retention-days: 30

      - name: Create summary of trivy issues
        run: |
          summary=$(jq -r '.runs[0].tool.driver.rules as $rules | [.runs[0].results[] | $rules[.ruleIndex].properties.tags[] | select(. == "HIGH" or . == "CRITICAL" or . == "MEDIUM" or . == "LOW" or . == "UNKNOWN")] | group_by(.) | map({Severity: .[0], Count: length}) | .[] | [.Severity, .Count] | join(": ")' trivy-results.sarif | awk 'NR > 1 { printf(" | ") } {printf "%s",$0}')
          if [ -z "$summary" ]
          then
            summary="0 Issues"
          fi
          echo "SUMMARY=$summary" >> $GITHUB_ENV

      - name: Extract detailed vulnerabilities
        run: |
          details=$(jq -r '
            .runs[0].tool.driver.rules as $rules |
            [.runs[0].results[] |
              . as $result |
              $rules[.ruleIndex] as $rule |
              ($rule.properties.tags[] |
                select(. == "CRITICAL" or . == "HIGH")) as $severity |
              {
                result: $result,
                rule: $rule,
                severity: $severity
              }
            ] |
            sort_by(if .severity == "CRITICAL" then 0 else 1 end) |
            .[0:10] |
            map(
              .result as $result |
              .rule as $rule |
              .severity as $severity |
              ($result.locations[0].message.text | split(":")[0] |
                if contains("site-packages/") then
                  split("site-packages/")[1]
                elif contains("usr/lib/") then
                  split("usr/lib/")[1]
                else
                  (split("/") | .[-4:] | join("/"))
                end) as $location |
              ($result.message.text |
                capture("Package: (?<pkg>[^\n]+)") | .pkg) as $package |
              ($result.message.text |
                capture("Installed Version: (?<ver>[^\n]+)") |
                .ver) as $installed |
              ($result.message.text |
                capture("Fixed Version: ?(?<fix>[^\n]*)") |
                .fix) as $rawfixed |
              (if $rawfixed == "" then "Not available"
               else $rawfixed end) as $fixed |
              (if $severity == "CRITICAL" then "🔴"
               elif $severity == "HIGH" then "🟠"
               else "⚪" end) as $icon |
              "\($icon) *\($result.ruleId)* (\($severity))\n" +
              "Package: `\($package)@\($installed)`\n" +
              "Location: `\($location)`\n" +
              "Fixed: `\($fixed)`\n" +
              "<\($rule.helpUri)|View Details>\n"
            ) | join("\n")
          ' trivy-results.sarif)

          if [ -z "$details" ]
          then
            details="No vulnerabilities found in the scanned severity levels."
          fi

          # Escape for GitHub Actions environment
          echo "DETAILS<<EOF" >> $GITHUB_ENV
          echo "$details" >> $GITHUB_ENV
          echo "EOF" >> $GITHUB_ENV

      - name: Send Slack Notification
        uses: slackapi/slack-github-action@70cd7be8e40a46e8b0eced40b0de447bdb42f68e # v1.26.0
        with:
          payload: |
            {
              "text": "Trivy scan results for ${{ steps.meta.outputs.version }}",
              "blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": "[Ona Data] Trivy scan results for ${{ steps.meta.outputs.version }}: ${{ env.SUMMARY }}"
                  }
                },
                {
                  "type": "divider"
                },
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": "🔍 *Found Vulnerabilities (Top 10):*"
                  }
                },
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": ${{ toJSON(env.DETAILS) }}
                  }
                },
                {
                  "type": "divider"
                },
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": "📊 *View Full Reports:*\n• <https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}|Download HTML Report>\n• <https://github.com/${{ github.repository }}/security/code-scanning?query=branch:${{ env.version || github.ref_name }}+is:open++|GitHub Code Scanning>"
                  }
                }
              ]
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK