release-alpha.yml

# Copyright 2021 ZUP IT SERVICOS EM TECNOLOGIA E INOVACAO SA
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: release-alpha

on:
  push:
    branches:
      - main
permissions: read-all
jobs:
  ReleaseAlpha:
    permissions:
      contents: write
      packages: write
      issues:   write
    runs-on: ubuntu-latest
    env:
      COSIGN_KEY_LOCATION: /tmp/cosign.key
      COSIGN_PASSWORD: ${{ secrets.COSIGN_PWD }}
    steps:
      - name: Checkout
        uses: actions/checkout@v2
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v2
        with:
          go-version: 1.17

      - name: Docker Login
        uses: docker/login-action@v1
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Cosign Installer
        uses: sigstore/cosign-installer@main
        with:
          cosign-release: 'v1.2.0'

      - name: Install cosign private key
        run: 'echo "$COSIGN_KEY" > $COSIGN_KEY_LOCATION'
        shell: bash
        env:
          COSIGN_KEY: ${{secrets.COSIGN_KEY}}

      - name: Build and push api
        uses: docker/build-push-action@v2
        with:
          push: true
          context: ./api
          file: ./api/deployments/dockerfiles/Dockerfile
          tags: horuszup/horusec-api:alpha

      - name: Sign image
        run: |
          cosign sign -key $COSIGN_KEY_LOCATION horuszup/horusec-api:alpha
        env:
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PWD }}
      - name: Build and push auth
        uses: docker/build-push-action@v2
        with:
          push: true
          context: ./auth
          file: ./auth/deployments/dockerfiles/Dockerfile
          tags: horuszup/horusec-auth:alpha

      - name: Sign image
        run: |
          cosign sign -key $COSIGN_KEY_LOCATION horuszup/horusec-auth:alpha
      - name: Build and push analytic
        uses: docker/build-push-action@v2
        with:
          push: true
          context: ./analytic
          file: ./analytic/deployments/dockerfiles/Dockerfile
          tags: horuszup/horusec-analytic:alpha

      - name: Sign image
        run: |
          cosign sign -key $COSIGN_KEY_LOCATION horuszup/horusec-analytic:alpha
      - name: Build and push core
        uses: docker/build-push-action@v2
        with:
          push: true
          context: ./core
          file: ./core/deployments/dockerfiles/Dockerfile
          tags: horuszup/horusec-core:alpha

      - name: Sign image
        run: |
          cosign sign -key $COSIGN_KEY_LOCATION horuszup/horusec-core:alpha
      - name: Build and push manager
        uses: docker/build-push-action@v2
        with:
          push: true
          context: ./manager
          file: ./manager/deployments/dockerfiles/Dockerfile
          tags: horuszup/horusec-manager:alpha

      - name: Sign image
        run: |
          cosign sign -key $COSIGN_KEY_LOCATION horuszup/horusec-manager:alpha

      - name: Build and push messages
        uses: docker/build-push-action@v2
        with:
          push: true
          context: ./messages
          file: ./messages/deployments/dockerfiles/Dockerfile
          tags: horuszup/horusec-messages:alpha

      - name: Sign image
        run: |
          cosign sign -key $COSIGN_KEY_LOCATION horuszup/horusec-messages:alpha
      - name: Build and push migrations
        uses: docker/build-push-action@v2
        with:
          push: true
          context: ./migrations
          file: ./migrations/deployments/dockerfiles/Dockerfile
          tags: horuszup/horusec-migrations:alpha

      - name: Sign image
        run: |
          cosign sign -key $COSIGN_KEY_LOCATION horuszup/horusec-migrations:alpha
      - name: Build and push vulnerability
        uses: docker/build-push-action@v2
        with:
          push: true
          context: ./vulnerability
          file: ./vulnerability/deployments/dockerfiles/Dockerfile
          tags: horuszup/horusec-vulnerability:alpha

      - name: Sign image
        run: |
          cosign sign -key $COSIGN_KEY_LOCATION horuszup/horusec-vulnerability:alpha
      - name: Build and push webhook
        uses: docker/build-push-action@v2
        with:
          push: true
          context: ./webhook
          file: ./webhook/deployments/dockerfiles/Dockerfile
          tags: horuszup/horusec-webhook:alpha

      - name: Sign image
        run: |
          cosign sign -key $COSIGN_KEY_LOCATION horuszup/horusec-webhook:alpha

      - name: Delete outdate release
        uses: dev-drprasad/delete-tag-and-release@v0.2.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          delete_release: true
          tag_name: alpha

      - name: Update alpha release
        uses: softprops/action-gh-release@v1
        with:
          name: alpha
          tag_name: alpha
          prerelease: true
          draft: false
          target_commitish: ${{ github.sha }}
          token: ${{ secrets.GITHUB_TOKEN }}
          body: |
            ## Description

            This tag it's updated every time there's a change in the main branch. It's a developement tag and should not be used in production.

            ## Docker images

            - `docker pull horuszup/horusec-analytic:alpha`
            - `docker pull horuszup/horusec-api:alpha`
            - `docker pull horuszup/horusec-auth:alpha`
            - `docker pull horuszup/horusec-core:alpha`
            - `docker pull horuszup/horusec-manager:alpha`
            - `docker pull horuszup/horusec-messages:alpha`
            - `docker pull horuszup/horusec-migrations:alpha`
            - `docker pull horuszup/horusec-vulnerability:alpha`
            - `docker pull horuszup/horusec-webhook:alpha`