deploy-action.yml

name: 'Deploy'

on:
  push:
    branches: [ production ]


jobs:

  extract-version:
    runs-on: ubuntu-latest
    steps:
      - uses: actions
      - name: Extract Maven project version
        run: echo "version=$(mvn -q -Dexec.executable=echo -Dexec.args='${project.version}' --non-recursive exec:exec | sed 's/-SNAPSHOT$//')" >> $GITHUB_OUTPUT
        id: store-version

  build-docker-image:
    needs: extract-version
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'adopt'

      - name: Set up node 18
        uses: actions/setup-node@v4
        with:
          node-version: 18.17.1

      - name: Install Dependencies
        run: cd ./frontend && npm ci

      - name: Build frontend with Angular
        run: cd ./frontend && npm run build

      - name: Build backend with Maven
        run: mvn -B clean package --file pom.xml -P build-for-docker

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build the docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: docker/Dockerfile
          tags: ${{ steps.store-version.outputs.version }}
          load: true
          push: false
          outputs: type=docker,dest=/tmp/okr-docker-image.tar

      - name: Upload artifact
        uses: actions/upload-artifact@v3
        with:
          name: okr-image
          path: /tmp/okr-docker-image.tar

      - name: print imagetags
        run: echo ${{ steps.store-version.outputs.version }}

  e2e-docker:
    runs-on: ubuntu-22.04
    needs: build-docker-image
    steps:
      - uses: actions/checkout@v3

      - name: Download artifact
        uses: actions/download-artifact@v3
        with:
          name: okr-image
          path: /tmp

      - name: Load image
        run: docker load --input /tmp/okr-docker-image.tar

      - name: show images
        run: docker image ls -a

      - name: Run docker image
        run: |
          docker run --network=host \
          -p 8080:8080 \
          -e SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUER-URI=http://localhost:8544/realms/pitc \
          -e SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_JWK-SET-URI=http://localhost:8544/realms/pitc/protocol/openid-connect/certs \
          -e SPRING_SECURITY_OAUTH2_RESOURCESERVER_OPAQUETOKEN_CLIENT-ID=pitc_okr_staging \
          -e SPRING_PROFILES_ACTIVE-ID=integration-test \
          -e SPRING_DATASOURCE_URL="jdbc:h2:mem:db;DB_CLOSE_DELAY=-1" \
          -e SPRING_DATASOURCE_USERNAME=user \
          -e SPRING_DATASOURCE_PASSWORD=sa \
          -e SPRING_FLYWAY_LOCATIONS="classpath:db/h2-db/database-h2-schema,classpath:db/h2-db/data-test-h2" \
          ${{ steps.store-version.outputs.version }} &

      - name: run keycloak docker
        run: |
          docker run \
          -e KEYCLOAK_ADMIN=admin \
          -e KEYCLOAK_ADMIN_PASSWORD=keycloak \
          -v ./docker/config/realm-export.json:/opt/keycloak/data/import/realm.json \
          -p 8544:8080 \
          quay.io/keycloak/keycloak:22.0.0 \
          start-dev --import-realm &

      - uses: abhi1693/setup-browser@v0.3.4
        with:
          browser: chrome
          version: latest

      - name: Cypress run e2e tests
        uses: cypress-io/github-action@v6
        with:
          build: npm i -D cypress
          install: false
          wait-on: 'http://localhost:8080/config, http://localhost:8544'
          wait-on-timeout: 120
          browser: chrome
          headed: true
          working-directory: frontend
          config: baseUrl=http://localhost:8080

  okr-deploy:
    runs-on: ubuntu-latest
    needs: e2e-docker
    steps:
      - name: Checkout project
        uses: actions/checkout@v4

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'adopt'
          server-id: github
          settings-path: ${{ github.workspace }}

      - name: Set up node 18
        uses: actions/setup-node@v4
        with:
          node-version: 18.17.1

      - name: Install Dependencies
        run: cd ./frontend && npm ci

      - name: Build frontend with Angular
        run: cd ./frontend && npm run build

      - name: Build backend with Maven
        run: mvn -B clean package --file pom.xml -P build-for-docker

      - name: Log in to Quay registry
        uses: docker/login-action@v2
        with:
          registry: ${{ secrets.QUAY_REGISTRY }}
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_TOKEN }}

      - name: Build and push the Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: docker/Dockerfile
          push: true
          tags: ${{ secrets.TAG }}:${{ steps.store-version.outputs.version}}-PROD

      - name: Trigger Deployment Workflow with latest Version
        uses: actions/checkout@v4
        with:
          repository: ${{ vars.TARGET_REPOSITORY }}
          ref: ${{ vars.TARGET_REFERENCE }}
          path: ccy-repo
          token: ${{secrets.VERSION_TOKEN}}

      - name: Change Yaml
        shell: bash
        env:
          FILEPATH: ${{ vars.FILEPATH }}
          YAMLPATH: ${{ vars.YAML_PATH }}
          NEWVALUE: ${{ vars.NEW_VALUE_URL }}:${{ steps.store-version.outputs.version}}-PROD
          VERSION: v4.25.2
          BINARY: yq_linux_amd64
        run: |
          wget -q https://github.com/mikefarah/yq/releases/download/${VERSION}/${BINARY}.tar.gz -O - |\
          tar xz && mv ${BINARY} /usr/local/bin/yq
          yq -i "${YAMLPATH} = \"${NEWVALUE}\"" ccy-repo/${FILEPATH}
      - name: Commit and Push Changes
        working-directory: ccy-repo
        shell: bash
        env:
          COMMITPREFIX: '[CTS]'
        run: |
          git config --global user.email "actions@github.com"
          git config --global user.name "GitHub Actions"
          git add ${{ vars.FILEPATH }} || {
            echo "No files were changed, so we did not commit anything"
            exit 1
          } && \
          git commit -m "$COMMITPREFIX Automated changes to ${{ vars.FILEPATH }}" && \
          git push origin ${{ vars.TARGET_REFERENCE }}
      - run: rm -rf ccy-repo
        shell: bash

  generate-and-push-sbom:
    runs-on: ubuntu-latest
    needs: okr-deploy
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v3

      - name: Install cdxgen
        working-directory: frontend
        run: npm install -g @cyclonedx/cdxgen@8.6.0

      - name: 'Generate SBOM for maven dependencies'
        working-directory: backend
        run: mvn org.cyclonedx:cyclonedx-maven-plugin:makeAggregateBom

      - name: 'Generate SBOM for npm dependencies'
        working-directory: frontend
        run: cdxgen -o ../sbom-npm.xml -t npm .

      - name: 'Merge frontend and backend SBOMs'
        run: |
          docker run --rm -v $(pwd):/data cyclonedx/cyclonedx-cli merge --input-files data/backend/target/bom.xml data/sbom-npm.xml --output-file data/sbom.xml

      - name: 'Push merged SBOM to dependency track'
        env:
          PROJECT_NAME: okr-production
        run: |
          curl --verbose -s --location --request POST ${{ secrets.DEPENDENCY_TRACK_URL }} \
          --header "X-Api-Key: ${{ secrets.SECRET_OWASP_DT_KEY }}" \
          --header "Content-Type: multipart/form-data" \
          --form "autoCreate=true" \
          --form "projectName=${PROJECT_NAME:-$GITHUB_REPOSITORY}" \
          --form "projectVersion=latest" \
          --form "bom=@sbom.xml"

  clean-up:
    needs: generate-and-push-sbom
    runs-on: ubuntu-latest

    steps:
      - name: remove dockers
        run: docker ps -aq | xargs -r docker rm -f