ci.yml

name: ci

on:
  push:
    branches: [main, homol, desen]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

env:
  TRIVY_IMAGE: aquasec/trivy:0.76.1@sha256:790fd66d1697395d8693d1acaa1ea702406a20f109b6fc7bac8db623eca6c06c

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
      - run: uv sync --locked
      - run: uv run ruff check .
      - run: uv run ruff format --check .
      - run: uv run pytest
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: coverage
          path: coverage.xml

  trivy:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Build image
        run: docker build -t app:${{ github.sha }} .
      - name: Scan Dockerfile
        run: docker run --rm -v "$PWD:/src" "$TRIVY_IMAGE" config --ignorefile /src/.trivyignore.yaml --exit-code 1 --severity HIGH,CRITICAL /src
      - name: Scan image
        run: |
          docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v "$PWD:/src" "$TRIVY_IMAGE" \
            image --ignorefile /src/.trivyignore.yaml --format sarif --output /src/trivy.sarif app:${{ github.sha }}
          docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v "$PWD:/src" "$TRIVY_IMAGE" \
            image --ignorefile /src/.trivyignore.yaml --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed app:${{ github.sha }}
      - uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
        if: always() && hashFiles('trivy.sarif') != ''
        with:
          sarif_file: trivy.sarif
          category: trivy

  sonar:
    needs: test
    runs-on: ubuntu-latest
    env:
      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: coverage
      # skipped when the org has no SonarCloud token, e.g. on Dependabot PRs.
      # The gate is only enforced on PRs, the first analysis of a branch has no baseline.
      - uses: SonarSource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9 # v8.3.0
        if: env.SONAR_TOKEN != ''
        with:
          args: >
            -Dsonar.organization=${{ vars.SONAR_ORGANIZATION }}
            -Dsonar.projectKey=${{ github.repository_owner }}_${{ github.event.repository.name }}
            -Dsonar.qualitygate.wait=${{ github.event_name == 'pull_request' }}

  # needs the Actions variables Forge sets when the AWS resources are created
  deploy:
    needs: [test, trivy]
    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && vars.AWS_ROLE_ARN != ''
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
        with:
          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
          aws-region: ${{ vars.AWS_REGION }}
      - uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2.1.7
      - name: Build and push image
        env:
          IMAGE: ${{ vars.ECR_REPOSITORY }}:${{ github.sha }}
        run: |
          docker build --provenance=false -t "$IMAGE" .
          docker push "$IMAGE"
      - name: Update function
        env:
          IMAGE: ${{ vars.ECR_REPOSITORY }}:${{ github.sha }}
          FUNCTION: ${{ vars.LAMBDA_FUNCTION }}
        run: |
          aws lambda update-function-code --function-name "$FUNCTION" --image-uri "$IMAGE" > /dev/null
          aws lambda wait function-updated --function-name "$FUNCTION"