build.yml

name: build

on:
  push:
    branches: [ master, dev ]
  pull_request:
    branches: [ master, dev ]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3.5.0
        with:
          fetch-depth: 0

      - name: setup go
        uses: actions/setup-go@v4
        with:
          go-version: '1.20.x'
          cache: true

      - name: Get branch name (merge)
        if: github.event_name != 'pull_request'
        run: echo "BRANCH_NAME=$(echo ${GITHUB_REF#refs/heads/} | tr / -)" >> $GITHUB_ENV

      - name: Get branch name (pull request)
        if: github.event_name == 'pull_request'
        run: |
          git fetch -a
          echo "BRANCH_NAME=$(echo ${GITHUB_HEAD_REF} | tr / -)" >> $GITHUB_ENV

      - name: Build binary
        run: |
          make build

      - name: Running ElasticSearch
        run: |
          docker run -itd --name elasticsearch -p 9200:9200 -e "discovery.type=single-node" -e "xpack.security.enabled=false" docker.elastic.co/elasticsearch/elasticsearch:8.3.3
          sleep 20
          timeout 120 sh -c 'until nc -z $0 $1; do echo "waiting for elasticsearch to start on port 9200"; sleep 5; done' localhost 9200

      - name: run test
        env:
          CODECOV_TOKEN: ${{secrets.CODECOV_TOKEN}}
        run: |
          echo "
            go 1.20

            use (
                .
                ./api
                ./pkg/logger
                ./pkg/opa-core
                ./pkg/policy-core
                ./pkg/uuid-go
            )" >> go.work
          make test
          bash <(curl -s https://codecov.io/bash) -F unit

      - name: Build docker image
        run: |
          COMMIT_COUNT=$(git rev-list --count HEAD)
          SHORT_HASH=$(git rev-parse --short HEAD)
          VERSION=${{ env.BRANCH_NAME }}-${COMMIT_COUNT}-${SHORT_HASH}

          if [[ ${{ env.BRANCH_NAME }} == "master" ]]; then
            export VERSION=master
          fi

          if [[ ${{ env.BRANCH_NAME }} == "dev" ]]; then
            export VERSION=dev
          fi

          make image VERSION=$VERSION

      - name: Scan The Image
        run: |
          REPO=policy-agent
          COMMIT_COUNT=$(git rev-list --count HEAD)
          SHORT_HASH=$(git rev-parse --short HEAD)
          VERSION=${{ env.BRANCH_NAME }}-${COMMIT_COUNT}-${SHORT_HASH}

          if [[ ${{ env.BRANCH_NAME }} == "master" ]]; then
            export VERSION=master
          fi

          if [[ ${{ env.BRANCH_NAME }} == "dev" ]]; then
            export VERSION=dev
          fi

          echo scanning ${REPO}:${VERSION}
          curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sudo sh -s -- -b /usr/local/bin
          grype "${REPO}:${VERSION}" --scope all-layers > /tmp/report.txt #--fail-on high to fail on sev high

      - name: Login to Docker Hub
        if: github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/master'
        uses: docker/login-action@v1
        with:
          registry: docker.io
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_PASSWORD }}


      - name: Create image and push to Docker Registry
        if: github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/master'
        run: |

          if [[ ${{ env.BRANCH_NAME }} == "master" ]]; then
            export VERSION=master
          fi

          if [[ ${{ env.BRANCH_NAME }} == "dev" ]]; then
            export VERSION=dev
          fi

          make push@weaveworks tag-file=new-tag version-file=new-version VERSION=$VERSION