ecr-image-build.yml

name: AWS ECR Build Image

on:
  release:
      types:
          - "released"
  push:
    branches:
      - "main"
      - "*-rc"
  workflow_dispatch:
    buildAlpine:
      description: Whether to build an Alpine based image
      required: false
      type: boolean
      default: false

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v2

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: eu-central-1

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v1

      - name: Setup SSH Agent and add Github to known hosts
        env:
          SSH_AUTH_SOCK: /tmp/ssh-agent.sock
        run: |
          ssh-agent -a  $SSH_AUTH_SOCK >> /dev/null
          ssh-add  - <<<  "${{ secrets.SSH_PRIVATE_KEY }}"
          mkdir -p ~/.ssh
          ssh-keyscan github.com > ~/.ssh/known_hosts

      - name: Get the version
        id: get-version
        if: github.event_name != 'push'
        run: echo "version=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV

      - name: Get the branch name
        id: get-branch-name
        if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
        run: echo "version=${GITHUB_REF#refs/heads/}" >> $GITHUB_ENV

      - name: (Ubuntu) Build and push
        id: docker-build-ubuntu
        uses: docker/build-push-action@v2
        with:
          context: .
          file: ./docker/onadata-uwsgi/Dockerfile.ubuntu
          platforms: linux/amd64
          cache-from: type=registry,ref=${{ steps.login-ecr.outputs.registry }}/onaio/onadata:${{ env.version }}
          cache-to: type=inline
          ssh: |
            default=/tmp/ssh-agent.sock
          build-args: |
            optional_packages=PyYAML django-redis ${{ secrets.ECR_OPTIONAL_PACKAGES }}
          push: true
          tags: |
            ${{ steps.login-ecr.outputs.registry }}/onaio/onadata:${{ env.version || github.ref_name }}

      - name: (Alpine) Build and push
        id: docker-build-alpine
        uses: docker/build-push-action@v2
        if: github.event.inputs.buildAlpine
        with:
          context: .
          file: ./docker/onadata-uwsgi/Dockerfile.alpine
          platforms: linux/amd64
          cache-from: type=registry,ref=${{ steps.login-ecr.outputs.registry }}/onaio/onadata:${{ env.version }}
          cache-to: type=inline
          ssh: |
            default=/tmp/ssh-agent.sock
          build-args: |
            optional_packages=PyYAML django-redis ${{ secrets.ECR_OPTIONAL_PACKAGES }}
          push: true
          tags: |
            ${{ steps.login-ecr.outputs.registry }}/onaio/onadata:${{ env.version || github.ref_name }}-alpine

      - name: (Ubuntu) Image digest
        run: echo ${{ steps.docker-build-ubuntu.outputs.digest }}

      - name: (Alpine) Image digest
        if: github.event.inputs.buildAlpine
        run: echo ${{ steps.docker-build-alpine.outputs.digest }}

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ steps.login-ecr.outputs.registry }}/onaio/onadata:${{ env.version || github.ref_name }}
          format: 'sarif'
          output: 'trivy-results.sarif'

      - name: Upload Trivy scan result to Github security lab
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results.sarif'

      - name: Run Trivy vulnerability scanner for Slack
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ steps.login-ecr.outputs.registry }}/onaio/onadata:${{ env.version || github.ref_name }}
          format: json
          output: 'trivy-results.json'

      - name: Create summary of trivy issues
        run: |
          summary=$(jq -r '.Results[] | select(.Vulnerabilities) | .Vulnerabilities | group_by(.Severity) | map({Severity: .[0].Severity, Count: length}) | .[] | [.Severity, .Count] | join(": ")' trivy-results.json | awk 'NR > 1 { printf(" | ") } {printf "%s",$0}')
          if [ -z $summary ]
          then
            summary="0 Issues"
          fi
          echo "SUMMARY=$summary" >> $GITHUB_ENV

      - name: Send Slack Notification
        uses: slackapi/slack-github-action@v1.23.0
        with:
          payload: |
            {
              "text": "Trivy scan results for ${{ env.version || github.ref_name }}",
              "blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": "[Ona Data] Trivy scan results: ${{ env.SUMMARY }}"
                  }
                },
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": "View scan results: https://github.com/${{ github.repository }}/security/code-scanning?query=branch:${{ env.version || github.ref_name }}+is:open++"
                  }
                }
              ]
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK