build-push-image.yml

name: Build and push image

on:
  push:
    branches:
      - staging
      - master
  workflow_dispatch:

permissions:
  id-token: write           # Required for requesting the JWT
  contents: read            # Required for actions/checkout
  security-events: write    # Required for uploading security scan results

env:
  ECR_REPOSITORY_URL_APP: "${{ secrets.IMAGE_REGISTRY_URL }}/defi-providers"
  ECR_REPOSITORY_URL_INFRA: "${{ secrets.IMAGE_REGISTRY_URL }}/defi-providers-infra"
  IMAGE_TAG: "${{ github.ref_name }}-${{ github.sha }}"
  MANIFESTS_PATH: "${{ github.ref_name == 'master' && './kubernetes/production' || './kubernetes/staging' }}"
  AWS_DEFAULT_REGION: eu-central-1
  AWS_IAM_ROLE_GITHUB: "${{ secrets.AWS_IAM_ROLE_GITHUB }}"

jobs:
  build:
    name: Build and push image
    runs-on: dappradar-runner

    steps:
    - uses: actions/checkout@v3

    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@v2
      with:
        aws-region: ${{ env.AWS_DEFAULT_REGION }}
        role-to-assume: ${{ env.AWS_IAM_ROLE_GITHUB }}

    - name: Authenticate to Amazon ECR
      uses: aws-actions/amazon-ecr-login@v1

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v2
      with:
        driver: docker

    - name: Build Docker image
      uses: docker/build-push-action@v4
      with:
        context: .
        tags: "${{ env.ECR_REPOSITORY_URL_APP }}:${{ env.IMAGE_TAG }}"
        push: false

    - name: Scan image - High and Critical Severity
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: "${{ env.ECR_REPOSITORY_URL_APP }}:${{ env.IMAGE_TAG }}"        
        format: sarif
        output: trivy-results.sarif
        hide-progress: false
        exit-code: 1

    - name: Upload Trivy scan results to GitHub Security tab
      uses: github/codeql-action/upload-sarif@v2
      if: always()
      with:
        sarif_file: trivy-results.sarif

    - name: Push Docker image
      uses: docker/build-push-action@v4
      with:
        context: .
        tags: "${{ env.ECR_REPOSITORY_URL_APP }}:${{ env.IMAGE_TAG }}"
        push: true

    - name: Bake and push manifests
      run: |
        kubectl kustomize $MANIFESTS_PATH | \
        envsubst '$CONTAINER_IMAGE' | \
        flux push artifact oci://$OCI_IMAGE_URL_INFRA -f - \
          --source="$(git config --get remote.origin.url)" \
          --revision="$(git branch --show-current)@sha1:$(git rev-parse HEAD)" \
          --provider=aws && \
        flux tag artifact oci://$OCI_IMAGE_URL_INFRA \
          --tag $GITHUB_REF_NAME \
          --provider aws
      env:
        OCI_IMAGE_URL_INFRA: "${{ env.ECR_REPOSITORY_URL_INFRA }}:${{ env.IMAGE_TAG }}"
        CONTAINER_IMAGE: "${{ env.ECR_REPOSITORY_URL_APP }}:${{ env.IMAGE_TAG }}"