ci-pipeline.yml

name: u34 ci-pipeline
run-name: u34 ci-pipeline run on ${{ github.event_name }} event
on:
#  schedule:
#    - cron: '0 0 * * 1,4' # on Monday (1) and Thursday (4)
  pull_request:
#    types: [opened, reopened]
#    branches:
#        - 'main'
#    paths:
#      - 'app/**'
#      - 'Dockerfile'
#      - 'requirements.txt'

env:
  IMAGE_TAG: metodil/my-hello-app

jobs:

  editorconfig:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: editorconfig-checker/action-editorconfig-checker@main
      - run: editorconfig-checker

  markdown-link-check:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@master
    - uses: gaurav-nelson/github-action-markdown-link-check@v1

  lint-black:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: psf/black@stable
        with:
          options: "--check --verbose"
#          src: "."

  lint-unit-tests:
    runs-on: ubuntu-latest
    needs: [ editorconfig, markdown-link-check, lint-black ]
    steps:
      - name: Check out code
        uses: actions/checkout@v4
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11.8'
          cache: 'pip'
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
          pip install pytest pytest-cov flake8 pylint
      - name: Run flake8 linting
        run: flake8 app/
      - name: Analysing the code with pylint
        run: |
          pylint --rcfile=.pylintrc $(git ls-files '*.py')
      - name: Test with pytest
        run: |
          cd app
          python -m unittest app_test.py

  gitleaks-security:
    runs-on: ubuntu-latest
    needs: lint-unit-tests
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  trivy-security:
    runs-on: ubuntu-latest
    needs: lint-unit-tests
    steps:
      - uses: actions/checkout@v4
      - name: Run Trivy vulnerability scanner in repo mode
        uses: aquasecurity/trivy-action@0.20.0
        with:
          scan-type: 'fs'
          ignore-unfixed: true
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL'
      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'
#  it is link in my github account
#  snyk-security:
#    runs-on: ubuntu-latest
#    needs: lint-unit-tests
#    steps:
#      - uses: actions/checkout@v4 #actions/checkout@master
#      - name: Run Snyk to check for vulnerabilities
#        uses: snyk/actions/node@master
#        continue-on-error: true # To make sure that SARIF upload gets called
#        env:
#          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
#        with:
#          args: --sarif-file-output=snyk.sarif
#      - name: Upload result to GitHub Code Scanning
#        uses: github/codeql-action/upload-sarif@v2
#        with:
#          sarif_file: snyk.sarif
  sonarcloud-security:
    runs-on: ubuntu-latest
    needs: lint-unit-tests
    steps:
    - uses: actions/checkout@v4
      with:
        # Disabling shallow clone is recommended for improving relevancy of reporting
        fetch-depth: 0
    - name: SonarCloud Scan
      uses: sonarsource/sonarcloud-github-action@v3.1.0 # Ex: v2.1.0, See the latest version at https://github.com/marketplace/actions/sonarcloud-scan
      env:
        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  build-test:
    name: Build image and test
#    description: Build Dockerfile, test container with trivy if ok push to registry
    runs-on: ubuntu-latest
    if: ${{ !cancelled() && !failure() }}
    needs: [ gitleaks-security,  trivy-security, sonarcloud-security ]
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Build an image from Dockerfile
        run: |
          docker build -t ${{ env.IMAGE_TAG }}:${{ github.sha }} .
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@0.29.0
        with:
          image-ref: '${{ env.IMAGE_TAG }}:${{ github.sha }}'
          format: 'sarif'
          output: 'trivy-results-container.sarif'
      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results-container.sarif'
#        if: always()
#        with:
#          sarif_file: 'trivy-results-container.sarif'

  deploy:
    name: Get credentials and push to Dockerhub
#    description: Get credentials from Hashi vault and push docker image to Dockerhub
    runs-on: ubuntu-latest
    if: ${{ !cancelled() && !failure() }}
    needs: [ build-test ]
    steps:
      - name: Import Secrets from Hashi vault
        id: import-secrets
        uses: hashicorp/vault-action@v3
        with:
          url: https://vault.elcomp68.com:8200
          token: ${{ secrets.HV_U34_TOKEN }}
          caCertificate: ${{ secrets.VAULT_CA_CERT }}
          secrets: |
                kv/data/u34-ci dockerhub_username | DOCKERHUB_USERNAME ;
                kv/data/u34-ci dockerhub_token | DOCKERHUB_TOKEN ;
      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ env.DOCKERHUB_USERNAME }}
          password: ${{ env.DOCKERHUB_TOKEN }}

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          push: true
          tags: '${{ env.IMAGE_TAG }}:${{ github.sha }}'
        if: success()  # Only push if get login is ok