pr-open.yml

name: Commits and PR Open

on:
  pull_request:
  push:
    branches:
      - '*'
      - '*/*'
      - '**'
    tags-ignore:
      - '**'

env:
  REGISTRY: ghcr.io
  NAME: nr-spar-oracle-api
  KEYCLOAK_REALM_URL: ${{ secrets.KEYCLOAK_REALM_URL }}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # For every commit and pull request
  validate:
    name: Code validation (Commits and PR)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: actions/cache@v3
        with:
          path: |
            ~/.m2
          key: ${{ runner.os }}-maven-test-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-maven-test-

      - name: Set up JDK 17
        uses: actions/setup-java@v3
        with:
          java-version: '17'
          distribution: 'temurin'

      - name: Code Validation
        run: mvn --no-transfer-progress validate --file pom.xml

      - name: Code Compilation
        run: mvn --no-transfer-progress clean compile --file pom.xml

      - name: Checkstyle
        run: mvn --no-transfer-progress checkstyle:checkstyle -Dcheckstyle.skip=false --file pom.xml

      - name: Archive Checkstyle
        uses: actions/upload-artifact@v3
        with:
          name: checkstyle
          path: target/site/checkstyle.html
          retention-days: 5

  # For every commit and pull request
  tests:
    name: Code tests (Commits and PR)
    runs-on: ubuntu-latest
    needs:
      - validate
    steps:
      - uses: actions/checkout@v3
        if: github.event_name == 'pull_request'
        with:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.head.ref }}

      - uses: actions/checkout@v3
        if: github.event_name == 'push'
        with:
          fetch-depth: 0

      - uses: actions/cache@v3
        with:
          path: |
            ~/.m2
          key: ${{ runner.os }}-maven-test-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-maven-test-

      - name: Cache SonarCloud packages
        uses: actions/cache@v3
        with:
          path: ~/.sonar/cache
          key: ${{ runner.os }}-sonar
          restore-keys: ${{ runner.os }}-sonar

      - name: Set up JDK 17
        uses: actions/setup-java@v3
        with:
          java-version: '17'
          distribution: 'temurin'

      - name: Unit Tests
        run: mvn --no-transfer-progress test --file pom.xml

      - name: Integration Tests
        run: mvn --no-transfer-progress verify -P integration-test --file pom.xml

      - name: Code Coverage
        run: mvn --no-transfer-progress clean verify -P all-tests --file pom.xml

      - name: Generate JaCoCo Badge
        uses: cicirello/jacoco-badge-generator@v2
        id: jacoco
        with:
          generate-branches-badge: true
          jacoco-csv-file: target/coverage-reports/merged-test-report/jacoco.csv

      - name: Log coverage percentage
        run: |
          echo "coverage = ${{ steps.jacoco.outputs.coverage }}"
          echo "branch coverage = ${{ steps.jacoco.outputs.branches }}"

      - name: Commit the badge (if it changed)
        uses: EndBug/add-and-commit@v9
        with:
          author_name: Ci Bot
          author_email: cibot@users.noreply.github.com
          message: 'ci: autogenerated JaCoCo coverage badge'
          add: '*.svg'

      - name: Upload JaCoCo coverage report
        uses: actions/upload-artifact@v3
        with:
          name: jacoco-report
          path: target/coverage-reports/merged-test-report/

      - name: QualityGate
        run: mvn --no-transfer-progress clean verify package -P all-tests sonar:sonar -Dsonar.projectKey=bcgov_nr-backend-starting-api -Dsonar.coverage.jacoco.xmlReportPaths=target/coverage-reports/merged-test-report/jacoco.xml --file pom.xml
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  # For every commit and pull request
  security:
    name: Security checks (Commits and PR)
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    needs:
      - validate
    steps:
      - uses: actions/checkout@v3
      - uses: actions/cache@v3
        with:
          path: |
            ~/.m2
          key: ${{ runner.os }}-maven-test-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-maven-test-

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v2
        with:
          debug: true
          languages: java

      - name: Set up JDK 17
        uses: actions/setup-java@v3
        with:
          java-version: '17'
          distribution: 'temurin'

      - name: Code Compilation
        run: mvn --no-transfer-progress clean compile --file pom.xml

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v2

      - name: Run Snyk to check for vulnerabilities
        uses: snyk/actions/maven@master
        continue-on-error: true
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high --sarif-file-output=snyk.sarif

  # For every commit and pull request
  codeql:
    name: Semantic Code Analysis (Commits and PR)
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    needs:
      - tests
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      - name: Initialize
        uses: github/codeql-action/init@v2
        with:
          debug: true
          languages: java

      - name: Set up JDK 17
        uses: actions/setup-java@v3
        with:
          java-version: '17'
          distribution: 'temurin'

      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
      # If this step fails, then you should remove it and run the build manually (see below)
      - name: Autobuild
        uses: github/codeql-action/autobuild@v2

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v2

  # Only for Pull Requests
  pr-validation:
    name: Label Validation (Only PR)
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'main'
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v3

      - name: Pull request size and stability labels
        uses: actions/labeler@v4
        continue-on-error: true
        with:
          repo-token: "${{ secrets.GITHUB_TOKEN }}"

      - name: Conventional Label
        uses: bcoe/conventional-release-labels@v1
        continue-on-error: true
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          ignored_types: '["chore","pr"]'
          type_labels: '{"feat": "feature", "fix": "fix", "bug": "fix", "doc": "documentation", "ci": "ci", "chore": "chore", "breaking": "breaking", "BREAKING CHANGE": "breaking"}'

      - name: Checkout branch
        uses: actions/checkout@v3
        with:
          ref: refs/heads/${{ github.head_ref }}

      - name: Conventional Changelog Update
        continue-on-error: true
        uses: TriPSs/conventional-changelog-action@v3
        id: changelog
        with:
          github-token: ${{ github.token }}
          output-file: 'CHANGELOG.md'
          skip-version-file: 'true'
          skip-commit: 'true'
          git-push: 'false'
          git-branch: refs/heads/${{ github.head_ref }}

      - name: Checkout pr
        uses: actions/checkout@v3
        with:
          ref: ${{ github.ref }}

      - name: Comment PR
        continue-on-error: true
        uses: thollander/actions-comment-pull-request@v2
        if: ${{ steps.changelog.outputs.skipped == 'false' }}
        with:
          message: |
            # Current changelog

            ${{ steps.changelog.outputs.clean_changelog }}
          comment_tag: current-changelog
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # Only for Pull Requests
  build-service-api:
    name: Image Build (Only PR)
    env:
      COMPONENT: service-api
      ZONE: ${{ github.event.number }}
      NR_SPAR_ORACLE_API_VERSION: snapshot-${{ github.event.number }}
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'main'
    needs:
      - security
      - tests
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v3
        name: Checkout repository and Setup JDK 17

      - uses: actions/setup-java@v3
        with:
          java-version: '17'
          distribution: 'temurin'
          cache: maven

      - name: Build with Maven
        run: mvn --no-transfer-progress --update-snapshots package

      - name: Log in to the Container registry
        uses: docker/login-action@v2
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v4
        with:
          context: .
          push: true
          tags: ${{ env.REGISTRY }}/${{ github.repository }}:${{ env.ZONE }}-${{ env.COMPONENT }}

      - name: Clear any previous OpenShift image
        run: |
          # Login to OpenShift and select project
          oc login --token=${{ secrets.OC_TOKEN }} --server=${{ secrets.OC_SERVER }}
          oc project ${{ secrets.OC_NAMESPACE }}

          # Clean previous image
          oc delete is ${{ env.NAME }}-${{ env.ZONE }}-${{ env.COMPONENT }} || true

  # Only for Pull Requests
  deploy-dev:
    name: DEV Deployment (Only PR)
    needs:
      - build-service-api
    runs-on: ubuntu-latest
    if: |
      github.event_name == 'pull_request'
      && github.event.pull_request.base.ref == 'main'
      && ${{ github.actor != 'dependabot[bot]' }}
    timeout-minutes: 15
    env:
      ZONE: ${{ github.event.number }}
      NR_SPAR_ORACLE_API_VERSION: snapshot-${{ github.event.number }}
    steps:
      - name: Broker
        id: broker
        uses: bcgov-nr/action-vault-broker-approle@v0.0.5
        with:
          broker_jwt: ${{ secrets.BROKER_JWT }}
          provision_role_id: ${{ secrets.PROVISION_ROLE_ID }}
          project_name: spar
          app_name: app-spar
          environment: development
      - name: Import Secrets
        id: import-secrets
        uses: hashicorp/vault-action@v2
        with:
          url: https://vault-iit.apps.silver.devops.gov.bc.ca
          token: ${{ steps.broker.outputs.vault_token }}
          exportEnv: 'false'
          secrets: |
            apps/data/dev/spar/app-spar/db_proxy_read_only db_username | VAULT_DB_USER;
            apps/data/dev/spar/app-spar/db_proxy_read_only db_password | VAULT_DB_PASS;

      - uses: actions/checkout@v3
      - name: Deploy
        run: |
          # Login to OpenShift and select project
          oc login --token=${{ secrets.OC_TOKEN }} --server=${{ secrets.OC_SERVER }}
          oc project ${{ secrets.OC_NAMESPACE }}

          # Clean previous image, if rebuilding
          if [ ${{ needs.build-service-api.outputs.build == 'true' }} ]
          then
            # Clear stale images for import/replacement
            oc delete is ${{ env.NAME }}-${{ env.ZONE }}-service-api || \
              echo "No previously imported images have been found"
          fi

          # Process and apply template
          oc process -f .github/openshift/deploy.backend.yml -p ZONE=${{ env.ZONE }} \
            -p NR_SPAR_ORACLE_API_VERSION=${{ env.NR_SPAR_ORACLE_API_VERSION }} \
            -p ALLOWED_ORIGINS=${{ secrets.ALLOWED_ORIGINS }} \
            -p DATABASE_HOST=${{ secrets.DATABASE_HOST }} \
            -p DATABASE_PORT=${{ secrets.DATABASE_PORT }} \
            -p SERVICE_NAME=${{ secrets.SERVICE_NAME }} \
            -p DATABASE_USER='${{ steps.import-secrets.outputs.VAULT_DB_USER }}' \
            -p DATABASE_PASSWORD='${{ steps.import-secrets.outputs.VAULT_DB_PASS }}' \
            -p KEYCLOAK_REALM_URL=${{ secrets.KEYCLOAK_REALM_URL }} \
            -p PROMOTE=${{ github.repository }}:${{ env.ZONE }}-service-api | oc apply -f -

          # Follow any active rollouts (see deploymentconfigs)
          oc rollout status dc/${{ env.NAME }}-${{ env.ZONE }}-service-api -w

      - name: DEV Deployment update
        uses: mshick/add-pr-comment@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          allow-repeats: false
          message: |
            DEV deployments have completed successfully!
            Service API: [https://${{ env.NAME }}-${{ github.event.number }}-service-api.apps.silver.devops.gov.bc.ca/](https://${{ env.NAME }}-${{ github.event.number }}-service-api.apps.silver.devops.gov.bc.ca/)

  api-tests:
    name: Newman API tests runner
    needs:
      - deploy-dev
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Install Node
        uses: actions/setup-node@v3
        with:
          node-version: 16

      - name: Install newman
        run: |
          npm install -g newman
          npm install -g newman-reporter-htmlextra

      - name: Make Directory for Test Results
        run: mkdir -p testArtifacts

      - name: Run Postman Collection
        run: |
          newman run test/postman/oracle-api.postman_collection.json -e test/postman/oracle-api.postman_environment.json \
            --env-var "apiAddr=${{ env.NAME }}-${{ github.event.number }}-service-api.apps.silver.devops.gov.bc.ca" \
            --env-var "releaseVer=snapshot-${{ github.event.number }}" \
            --env-var "authServer=${{ secrets.KEYCLOAK_SERVER_REALM }}" \
            --env-var "authClient=${{ secrets.KC_SERVICE_ACCOUNT_NAME }}" \
            --env-var "authClient=${{ secrets.KC_SERVICE_ACCOUNT_PASS }}" \
            --suppress-exit-code -r htmlextra --reporter-htmlextra-export testArtifacts/api-tests-report.html

      - name: Output the results
        uses: actions/upload-artifact@v3
        with:
          name: API test report
          path: testArtifacts