build-s1-container.yaml

# Copyright 2023 Airbus
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: Build Container for S1 IPF Simulator

on: 
  push:
    paths:
      - 'rs-container/docker_s1_container/**'
      - '.github/workflows/build-s1-container.yaml'
    branches:
      - '!main'
      - 'release/**'
      - 'develop**'
  workflow_dispatch:

env:
  REGISTRY_BASE: artifactory.coprs.esa-copernicus.eu
  ARTIFACTORY_PROJECT: rs-docker-private
  USERNAME: ${{ secrets.WERUM_ARTIFACTORY_USER }}
  PASSWORD: ${{ secrets.WERUM_ARTIFACTORY_PASSWORD }}
  VERSION: 3.32.1
  COMMIT_ID: ${{ github.sha }}

jobs:
  build-container:
    runs-on: ubuntu-latest    
    
    steps:
      - name: Extract branch name
        shell: bash
        run: echo "##[set-output name=branch;]$(echo ${GITHUB_REF} | cut -d / -f3-)"
        id: extract_branch

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v1

      - name: Set up Buildx
        uses: docker/setup-buildx-action@v1

      - name: Checkout repository
        uses: actions/checkout@v2
        with:
          fetch-depth: 0 # fetch all history so multiple commits can be scanned

      - name: GitGuardian scan
        uses: GitGuardian/ggshield-action@master
        env:
          GITHUB_PUSH_BEFORE_SHA: ${{ github.event.before }}
          GITHUB_PUSH_BASE_SHA: ${{ github.event.base }}
          GITHUB_PULL_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          GITHUB_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}

      - name: Login to Github Registry
        uses: docker/login-action@v1
        with:
          registry: ${{ env.REGISTRY_BASE }}/${{ env.ARTIFACTORY_PROJECT }}
          username: ${{ env.USERNAME }}
          password: ${{ env.PASSWORD }}
                    
      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v3
        with:
          images:  ${{ env.REGISTRY_BASE }}/${{ env.ARTIFACTORY_PROJECT }}/rs-container-s1-ipf-simulator
              
      - name: Build image
        uses: docker/build-push-action@v2
        with:
          load: true
          context: ./rs-container/docker_s1_container
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            BRANCH=${{ steps.extract_branch.outputs.branch }}
            BRANCH_TEXT=${{ steps.extract_branch.outputs.branch }}
            VERSION=${{ env.VERSION }}
            COMMIT_ID=${{ env.COMMIT_ID }}

      - name: Scan image
        uses: anchore/scan-action@v2
        id: scan
        with:
          image: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
          acs-report-enable: true
          severity-cutoff: critical

      - name: Upload Anchore scan SARIF report
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: ${{ steps.scan.outputs.sarif }}

      - name: Upload Anchore scan json report
        uses: actions/upload-artifact@v2
        with:
          name: vulnerabilities-s1-ipfsimulator
          path: ${{ steps.scan.outputs.vulnerabilities }}

      - name: Push image
        run: |
          docker push ${{ fromJSON(steps.meta.outputs.json).tags[0] }};

  generate-reports-s1-ipfsimulator:
    needs: build-container 
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Download json report from build jobs
        uses: actions/download-artifact@v2
        with:
          name: vulnerabilities-s1-ipfsimulator

      - name: Generate CSV and intermediate HTML report
        run: |
          echo "SEVERITY;ID;PACKAGE;VERSION;LINK" > vulnerabilities.csv
          cat vulnerabilities.json | jq -r '.matches[] | "\(.vulnerability.severity);\(.vulnerability.id);\(.artifact.name);\(.artifact.version);\(.vulnerability.links[0])"' >> vulnerabilities.csv
          echo -e '<table>\n<thead>\n<tr class="header">\n<th><p>SEVERITY</p></th>\n<th><p>ID</p></th>\n<th><p>PACKAGE</p></th>\n<th><p>VERSION</p></th>\n</tr>\n</thead>\n<tbody>' > vulnerabilities.html
          cat vulnerabilities.json | jq -r '.matches[] | "<tr>;<td><p>\(.vulnerability.severity)</p></td>;<td><p><a href=\"\(.vulnerability.links[0])\">\(.vulnerability.id)</a></p></td>;<td><p>\(.artifact.name)</p></td>;<td><p>\(.artifact.version)</p></td>;</tr>"' | tr -s ';' '\n' | sed 's!><p>Negligible! style="background-color:#FFFFFF;"><p>Negligible!g' | sed 's!><p>Low! style="background-color:#FFFC9E;"><p>Low!g' | sed 's!><p>Medium! style="background-color:#FE996B;"><p>Medium!g' | sed 's!><p>High! style="background-color:#FD6864;"><p>High!g' | sed 's!><p>Critical! style="background-color:#FE0000;"><p>Critical!g' >> vulnerabilities.html
          echo -e '</tbody>\n</table>' >> vulnerabilities.html
      - name: Convert HTLM to PDF
        uses: docker://ghcr.io/coprs/reference-system:dependencies_wkhtmltopdf
        with:
          args: vulnerabilities.html vulnerabilities.pdf

      - name: Upload Anchore scan reports
        uses: actions/upload-artifact@v2
        with:
          name: vulnerabilities-s1-ipfsimulator
          path: |
            vulnerabilities.csv
            vulnerabilities.pdf

  # If the execution-worker-jar is updated also update the S1 IPF Simulator image
  build-s1-ipf-simulator:
    needs: build-container
    uses: ./.github/workflows/build-s1-ipf-simulator.yaml
    secrets:
      WERUM_ARTIFACTORY_USER: ${{ secrets.WERUM_ARTIFACTORY_USER }}
      WERUM_ARTIFACTORY_PASSWORD: ${{ secrets.WERUM_ARTIFACTORY_PASSWORD }}
      GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}