main.yaml

name: CI/CD

# Controls when the workflow will run
on:
  push:
    tags: '*'
  pull_request:
    branches: '**'

env:
  CONTAINER_REGISTRY: ghcr.io

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  # This workflow contains two jobs named "build" and "container"
  build:
    name: Compile and test
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3

      - name: Setup node
        uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3
        with:
          node-version-file: '.node-version'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Generate code
        run: npm run generate

      - name: Compile
        run: npm run compile

      - name: Lint code
        run: npm run lint

      - name: Execute tests
        run: npm test

  build-container:
    name: Build container image
    needs: build
    runs-on: ubuntu-latest
    env:
      image_tag: ${{ github.repository }}:${{ github.sha }}

    steps:
      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3

      - name: Build container image
        uses: docker/build-push-action@1104d471370f9806843c095c1db02b5a90c5f8b6 # v3
        with:
          tags: ${{ env.image_tag }}

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@d63413b0a4a4482237085319f7f4a1ce99a8f2ac # 0.7.1
        with:
          image-ref: ${{ env.image_tag }}
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'
          security-checks: 'vuln,secret,config'

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@89036746af0bb9507d6f90289b0d5b97d5f44c0c # v2
        with:
          sarif_file: 'trivy-results.sarif'

  deliver:
    name: Build and push container image
    needs: build-container
    # This job is trigger only on new tags
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest

    steps:
      - name: Login to GitHub Package
        uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2
        with:
          registry: ${{ env.CONTAINER_REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels)
        id: meta
        uses: docker/metadata-action@818d4b7b91585d195f67373fd9cb0332e31a7175 # v4
        with:
          images: ${{ env.CONTAINER_REGISTRY }}/${{ github.repository }}

      - name: Build and push container image
        uses: docker/build-push-action@1104d471370f9806843c095c1db02b5a90c5f8b6 # v3
        with:
          push: true
          tags: ${{ steps.meta.outputs.tags }}