node.js.yml

# This workflow will do a clean install of node dependencies, cache/restore them, build the source code and run tests across different versions of node
# For more information see: https://help.github.com/actions/language-and-framework-guides/using-nodejs-with-github-actions

name: CI Test and Publish Workflow

on:
  workflow_dispatch:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [18.x]
    steps:
      - uses: actions/checkout@v3
      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v3.5.1
        with:
          node-version: ${{ matrix.node-version }}
          cache: "yarn"
      - name: Install dependencies
        run: yarn --frozen-lockfile
      - run: yarn build
      - name: Upload production artifacts
        uses: actions/upload-artifact@v3.1.1
        with:
          name: Static Build folder
          path: |
            ./build
  lint:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [18.x]
    steps:
      - uses: actions/checkout@v3
      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v3.5.1
        with:
          node-version: ${{ matrix.node-version }}
          cache: "yarn"
      - name: Install dependencies
        run: yarn --frozen-lockfile
      - run: yarn lint
  security:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [18.x]
    steps:
      - uses: actions/checkout@v3
      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v3.5.1
        with:
          node-version: ${{ matrix.node-version }}
          cache: "yarn"
      - name: Running audit check
        run: yarn audit --groups dependencies
      - name: docker-security
        uses: instrumenta/conftest-action@master
        with:
          files: Dockerfile
          policy: dockerfile-security.rego
  unit-test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [18.x]
    steps:
      - uses: actions/checkout@v3
      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v3.5.1
        with:
          node-version: ${{ matrix.node-version }}
          cache: "yarn"
      - name: Install dependencies
        run: yarn --frozen-lockfile
      - name: Running unit tests
        run: yarn test:coverage
      - run: yarn build
      - name: Upload test artifacts
        uses: actions/upload-artifact@v3.1.1
        with:
          name: coverage
          path: |
            ./coverage
  publish:
    runs-on: ubuntu-latest
    if: github.event_name != 'pull_request'
    permissions:
      contents: read
      packages: write
    needs:
      - build
      - security
      - lint
      - unit-test
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
      - name: Log in to the Github Container registry
        uses: docker/login-action@v1
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract branch name
        shell: bash
        run: echo "branch=${GITHUB_REF##*/}" >> $GITHUB_OUTPUT
        id: extract_branch
      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v3
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          labels: |
            maintainer=Team Digitale
            org.opencontainers.image.source.branch=${{ steps.extract_branch.outputs.branch }}
          tags: |
            type=raw,value={{date 'YYYYMMDD'}}-${{github.run_number}}-{{sha}}
            type=raw, value=latest
      - name: Build and push Docker image
        uses: docker/build-push-action@v2
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
  deploy:
    runs-on: ubuntu-latest
    if: github.event_name != 'pull_request'
    permissions:
      contents: read
      packages: write
    needs:
      - publish
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
      - name: build image
        id: extractImage
        run: |
          IMAGE="$REGISTRY/$IMAGE_NAME"
          TAG="$(date +'%Y%m%d')-${{github.run_number}}-$(git rev-parse --short HEAD)"
          echo "imageName=${IMAGE}:${TAG}" >> $GITHUB_OUTPUT
      - uses: convictional/trigger-workflow-and-wait@v1.3.0
        with:
          owner: teamdigitale
          repo: dati-semantic-kubernetes
          github_token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
          workflow_file_name: update-config.yaml
          ref: dev
          wait_interval: 20
          inputs: '{"serviceName": "dati-semantic-frontend", "imageWithNewTag": "${{ steps.extractImage.outputs.imageName }}"}'