push-trigger.yml

name: Maven Package upon a push

on:
  release:
    types: [published]
  pull_request:
    types: [opened, reopened, synchronize]
  workflow_dispatch:
    inputs:
      message:
        description: 'Message for manually triggering'
        required: false
        default: 'Triggered for Updates'
        type: string
  push:
    branches:
      - '!release-branch'
      - release*
      - master
      - 1.*
      - develop*
      - MOSIP*

jobs:
  build-commons:
    uses: mosip/kattu/.github/workflows/maven-build.yml@master-java21
    with:
      SERVICE_LOCATION: ./
      BUILD_ARTIFACT: commons
    secrets:
      OSSRH_USER: ${{ secrets.OSSRH_USER }}
      OSSRH_SECRET: ${{ secrets.OSSRH_SECRET }}
      OSSRH_TOKEN: ${{ secrets.OSSRH_TOKEN }}
      GPG_SECRET: ${{ secrets.GPG_SECRET }}
      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

  publish_to_nexus:
    if: "${{ !contains(github.ref, 'master') && github.event_name != 'pull_request' }}"
    needs: build-commons
    uses: mosip/kattu/.github/workflows/maven-publish-to-nexus.yml@master-java21
    with:
      SERVICE_LOCATION: ./
    secrets:
      OSSRH_URL: ${{ secrets.OSSRH_SNAPSHOT_URL }}
      OSSRH_USER: ${{ secrets.OSSRH_USER }}
      OSSRH_SECRET: ${{ secrets.OSSRH_SECRET }}
      OSSRH_TOKEN: ${{ secrets.OSSRH_TOKEN }}
      GPG_SECRET: ${{ secrets.GPG_SECRET }}
      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

  sonar_analysis:
    needs: build-commons
    if: "${{ github.event_name != 'pull_request' }}"
    uses: mosip/kattu/.github/workflows/maven-sonar-analysis.yml@master-java21
    with:
      SERVICE_LOCATION: ./
    secrets:
      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
      ORG_KEY: ${{ secrets.ORG_KEY }}
      OSSRH_USER: ${{ secrets.OSSRH_USER }}
      OSSRH_SECRET: ${{ secrets.OSSRH_SECRET }}
      OSSRH_TOKEN: ${{ secrets.OSSRH_TOKEN }}
      GPG_SECRET: ${{ secrets.GPG_SECRET }}
      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

  build-dockers:
    needs: build-commons
    strategy:
      matrix:
        include:
          - SERVICE_LOCATION: 'kernel/kernel-ridgenerator-service'
            SERVICE_NAME: 'kernel-ridgenerator-service'
            BUILD_ARTIFACT: 'commons'
          - SERVICE_LOCATION: 'kernel/kernel-notification-service'
            SERVICE_NAME: 'kernel-notification-service'
            BUILD_ARTIFACT: 'commons'
          - SERVICE_LOCATION: 'kernel/kernel-pridgenerator-service'
            SERVICE_NAME: 'kernel-pridgenerator-service'
            BUILD_ARTIFACT: 'commons'
          - SERVICE_LOCATION: 'kernel/kernel-idgenerator-service'
            SERVICE_NAME: 'kernel-idgenerator-service'
            BUILD_ARTIFACT: 'commons'
          - SERVICE_LOCATION: 'kernel/kernel-salt-generator'
            SERVICE_NAME: 'kernel-salt-generator'
            BUILD_ARTIFACT: 'commons'
          - SERVICE_LOCATION: 'kernel/kernel-config-server'
            SERVICE_NAME: 'kernel-config-server'
            BUILD_ARTIFACT: 'commons'
      fail-fast: false
    uses: mosip/kattu/.github/workflows/docker-build.yml@master-java21
    name: ${{ matrix.SERVICE_NAME }}
    with:
      SERVICE_LOCATION: ${{ matrix.SERVICE_LOCATION }}
      SERVICE_NAME: ${{ matrix.SERVICE_NAME }}
      BUILD_ARTIFACT: ${{ matrix.BUILD_ARTIFACT }}
    secrets:
      DEV_NAMESPACE_DOCKER_HUB: ${{ secrets.DEV_NAMESPACE_DOCKER_HUB }}
      ACTOR_DOCKER_HUB: ${{ secrets.ACTOR_DOCKER_HUB }}
      RELEASE_DOCKER_HUB: ${{ secrets.RELEASE_DOCKER_HUB }}
      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

  trivy_scan:
    needs: build-dockers
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - SERVICE_NAME: 'kernel-ridgenerator-service'
          - SERVICE_NAME: 'kernel-notification-service'
          - SERVICE_NAME: 'kernel-pridgenerator-service'
          - SERVICE_NAME: 'kernel-idgenerator-service'
          - SERVICE_NAME: 'kernel-salt-generator'
          - SERVICE_NAME: 'kernel-config-server'
    steps:
      - name: Set environment variables
        run: |
          echo "SERVICE_NAME=${{ matrix.SERVICE_NAME }}" >> $GITHUB_ENV
          echo "VERSION=latest" >> $GITHUB_ENV

      - name: Checkout code
        uses: actions/checkout@v3

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@0.20.0
        with:
          image-ref: 'docker.io/${{ env.SERVICE_NAME }}:${{ env.VERSION }}'
          format: 'sarif'
          output: 'trivy-results-${{ matrix.SERVICE_NAME }}.sarif'

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results-${{ matrix.SERVICE_NAME }}.sarif'