dev-java-ci-template.yaml

name: dev-java-ci-template
on:
  workflow_call:
    inputs:
      BRANCH_NAME:
        required: true
        type: string
        description: 'The name of the branch'
      SERVICE_PORT:
        required: true
        type: number
        description: 'The port number of the service'
      SERVICE_NAME:
        required: true
        type: string
        description: 'The name of the service'
  workflow_dispatch:
    inputs:
      SERVICE_PORT:
        required: true
        type: number
        description: 'The port number of the service'
      SERVICE_NAME:
        required: true
        type: string
        description: 'The name of the service'
jobs:
  setup-deps:
    defaults:
      run:
        shell: bash
        working-directory: ${{inputs.SERVICE_NAME}}
    name: Setup Project Dependencies
    runs-on: ubuntu-22.04
    continue-on-error: false
    steps:
      - name: Checkout
        uses: actions/checkout@v4.2.2
        with:
          fetch-depth: 1
      - name: Setup Java jdk 21
        uses: actions/setup-java@v4.5.0
        with:
          distribution: 'temurin'
          java-version: '21'
      - name: Cache Maven packages
        uses: actions/cache@v4.1.2
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-m2-v1
      - name: Resolve dependencies
        run: ./mvnw -q dependency:resolve-plugins dependency:resolve
  snyk-check:
    needs: setup-deps
    name: Snyk security check
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout
        uses: actions/checkout@v4.2.2
        with:
          fetch-depth: 1
      - name: Setup Java jdk 21
        uses: actions/setup-java@v4.5.0
        with:
          distribution: 'temurin'
          java-version: '21'
      - name: Cache Maven packages
        uses: actions/cache@v4.1.2
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-m2-v1
      - name: Setup Snyk
        uses: snyk/actions/setup@master
        with:
          snyk-version: 'latest'
      - name: Run Snyk to check for vulnerabilities
        working-directory: ${{inputs.SERVICE_NAME}}
        id: snyk-check
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        run: |
          chmod +x ./mvnw
          snyk test -q --severity-threshold=high --sarif-file-output=snyk.sarif
      - name: Upload The result to Artifact
        id: upload-artifact
        if: ${{always() && steps.snyk-check.outcome == 'failure'}}
        uses: actions/upload-artifact@v4.3.4
        with:
          name: ${{inputs.SERVICE_NAME}}-${{inputs.BRANCH_NAME}}-${{github.sha}}-snyk-report
          path: ${{inputs.SERVICE_NAME}}/snyk.sarif
      - name: PR Comment if Snyk check failed
        if: ${{ always() && steps.snyk-check.outcome == 'failure' && github.event_name == 'pull_request' }}
        uses: thollander/actions-comment-pull-request@v3.0.1
        with:
          pr-number: ${{ github.event.number }}
          comment-tag: 'snyk'
          mode: 'upsert'
          message: |
            # Snyk scan failed
            ** Please check the security report [here](${{steps.upload-artifact.outputs.artifact-url}}) **
      - name: Delete comment if Snyk check passed
        if: ${{ always() && steps.snyk-check.outcome == 'success' && github.event_name == 'pull_request'}}
        uses: thollander/actions-comment-pull-request@v3.0.1
        with:
          pr-number: ${{ github.event.number }}
          comment-tag: 'snyk'
          mode: 'delete'
  ci-test:
    name: UT, IT, Sonarqube analysis
    runs-on: ubuntu-22.04
    needs: setup-deps
    continue-on-error: true
    outputs:
      CI_IT_OUTCOME: ${{steps.IT.outcome}}
    defaults:
      run:
        shell: bash
        working-directory: ${{inputs.SERVICE_NAME}}
    steps:
      - name: Checkout
        uses: actions/checkout@v4.2.2
        with:
          fetch-depth: 1
      - name: Setup Jdk 17
        uses: actions/setup-java@v4.5.0
        with:
          distribution: 'temurin'
          java-version: '21'
      - name: Cache Maven packages
        uses: actions/cache@v4.1.2
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-m2-v1
      - name: UT
        run: ./mvnw -q test
      - name: IT
        id: IT
        run: ./mvnw -q verify
      - name: Run Sonarqube analysis
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
        run: ./mvnw -q sonar:sonar
  build-and-push:
    name: Build and Push Docker image for PR
    if: github.event_name == 'pull_request'
    outputs:
      IMAGE_VERSION: ${{ steps.meta.outputs.version }}
      IMAGE_TAG: ${{ steps.meta.outputs.tags }}
    runs-on: ubuntu-22.04
    steps:
      - name: Set up buildx
        uses: docker/setup-buildx-action@v3.7.1
      - name: docker login credential
        uses: docker/login-action@v3.3.0
        with:
          registry: ghcr.io
          username: ${{github.repository_owner}}
          password: ${{secrets.GHCR_READ_WRITE_PACKAGES_TOKEN}}
      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v5.5.1
        with:
          images: ghcr.io/ngodat0103/se347-backend/user-svc
      - name: Clone the repository
        uses: actions/checkout@v4.2.2
        with:
          fetch-depth: 1
      - name: Build and push
        uses: docker/build-push-action@v6.9.0
        with:
          context: ${{inputs.SERVICE_NAME}}
          push: true
          tags: ${{steps.meta.outputs.tags}}-${{github.sha}}
          cache-from: type=gha
          cache-to: type=gha,mode=max,compression=gzip,compression-level=0
          build-args: |
            SERVICE_NAME=user-svc
            SERVICE_PORT=5000
            VERSION=pr-${{github.sha}}

  docker-image-check:
    name: Docker image security scan
    needs: build-and-push
    runs-on: ubuntu-22.04
    env:
      TRIVY_REPORT_NAME: ${{inputs.SERVICE_NAME}}-${{inputs.BRANCH_NAME}}-${{github.sha}}-report
    steps:
      - name: Install Trivy
        uses: aquasecurity/setup-trivy@v0.2.2
        with:
          version: v0.57.1
          cache: true
      - name: Trivy scan
        id: trivy-scan
        uses: aquasecurity/trivy-action@0.29.0
        with:
          image-ref: ${{needs.build-and-push.outputs.IMAGE_TAG}}-${{github.sha}}
          severity: HIGH,CRITICAL
          vuln-type: os,library
          exit-code: 1
          format: table
          skip-setup-trivy: 'false'
          output: ${{env.TRIVY_REPORT_NAME}}.md
      - name: Upload ${{inputs.SERVICE_NAME}} security report to artifact tab
        if: ${{always() && steps.trivy-scan.outcome == 'failure'}}
        id: upload-artifact
        uses: actions/upload-artifact@v4.3.4
        with:
          name: ${{env.TRIVY_REPORT_NAME}}
          if-no-files-found: warn
          path: ${{env.TRIVY_REPORT_NAME}}.md
      - name: Comment Security scan failed if check failed
        if: ${{ always() &&  steps.trivy-scan.outcome == 'failure'  && github.event_name == 'pull_request' }}
        uses: thollander/actions-comment-pull-request@v3.0.1
        with:
          pr-number: ${{ github.event.number }}
          comment-tag: 'trivy'
          mode: 'upsert'
          message: |
           ## Trivi scan failed for ${{env.TRIVY_REPORT_NAME}}
           ** Please check the security report [here](${{steps.upload-artifact.outputs.artifact-url}}) **
      - name: Delete comment if security scan passed
        if: ${{ always() && steps.trivy-scan.outcome == 'success' && github.event_name == 'pull_request' }}
        uses: thollander/actions-comment-pull-request@v3.0.1
        with:
          pr-number: ${{ github.event.number }}
          comment-tag: 'trivy'
          mode: 'delete'
  deploy-to-dev:
    name: Deploy to dev environment
    environment: dev
    runs-on: dev-docker
    defaults:
      run:
        working-directory: ${{inputs.SERVICE_NAME}}
    needs: [build-and-push, ci-test]
    if: needs.ci-test.outputs.CI_IT_OUTCOME == 'success'
    steps:
      - name: Checkout
        uses: actions/checkout@v4.2.2
        with:
          fetch-depth: 1
      - name: Update dev image tag
        run: echo "IMAGE_VERSION=${{needs.build-and-push.outputs.IMAGE_VERSION}}-${{github.sha}}" > .env
      - name: Pull new Docker image version
        run: sudo docker compose --profile all pull
      - name: Fetch secrets from Vault
        uses: hashicorp/vault-action@v3.0.0
        env:
            SECRET_PATH: secrets/data/se347/backend/dev/user-svc
        with:
          url: ${{ secrets.VAULT_ADDR }}
          token: ${{ secrets.VAULT_TOKEN }}
          secrets: |
            ${{env.SECRET_PATH}} MONGODB_PASSWORD ;
            ${{env.SECRET_PATH}} MONGODB_ROOT_PASSWORD ;
            ${{env.SECRET_PATH}} MINIO_ENDPOINT ;
            ${{env.SECRET_PATH}} MINIO_ACCESS_KEY ;
            ${{env.SECRET_PATH}} MINIO_SECRET_KEY ;
      - name: Set up credentials
        run: |
          echo "MONGODB_PASSWORD=${{ env.MONGODB_PASSWORD }}" >> .env
          echo "MONGODB_ROOT_PASSWORD=${{ env.MONGODB_ROOT_PASSWORD }}" >> .env
          echo "MINIO_ENDPOINT=${{ env.MINIO_ENDPOINT }}" >> .env 
          echo "MINIO_ACCESS_KEY=${{ env.MINIO_ACCESS_KEY }}" >> .env
          echo "MINIO_SECRET_KEY=${{ env.MINIO_SECRET_KEY }}" >> .env
      - name: Deploy new Docker image
        run: sudo docker compose --profile all up -d