ci.yml

name: CI

on:
  push:
    branches:
      - 'release/**'
  pull_request:

jobs:
  build-amd64:
    name: Build PHP Image amd64

    runs-on: ubuntu-latest

    continue-on-error: false

    steps:
      -   name: "Checkout code"
          uses: actions/checkout@v3

      -   name: Lint Dockerfile
          uses: hadolint/hadolint-action@v3.0.0
          with:
            dockerfile: "Dockerfile"
            format: "tty"
            no-color: "true"
            output-file: "/dev/stdout"

      -   name: "Build Alpine"
          run: >
            ./build_images.sh temporary-build-image linux/amd64
      -   name: "Export image"
          run: mv dockercache amdcache
      -   name: 'Upload Artifact'
          uses: actions/upload-artifact@v3
          with:
            name: amdcache
            path: amdcache
            retention-days: 1
            
  build-arm64:
    name: Build PHP Image arm64

    runs-on: ARM64

    continue-on-error: false

    steps:
      -   name: "Checkout code"
          uses: actions/checkout@v3

      -   name: Lint Dockerfile
          uses: hadolint/hadolint-action@v3.0.0
          with:
            dockerfile: "Dockerfile"
            format: "tty"
            no-color: "true"
            output-file: "/dev/stdout"

      -   name: "Build Alpine"
          run: >
            ./build_images.sh temporary-build-image linux/arm64/v8
      -   name: "Export image"
          run: mv dockercache armcache
      -   name: 'Upload Artifact'
          uses: actions/upload-artifact@v3
          with:
            name: armcache
            path: armcache
            retention-days: 1
            
  upload:
    name: Upload PHP Image

    runs-on: ubuntu-latest
    
    needs: 
      - build-arm64
      - build-amd64

    continue-on-error: false

    steps:
      -   name: "Checkout code"
          uses: actions/checkout@v3

      -   name: Download amd64
          uses: actions/download-artifact@v3
          with:
            name: amdcache
            path: amdcache

      -   name: Download arm64
          uses: actions/download-artifact@v3
          with:
            name: armcache
            path: armcache

      -   name: "Create docker cache"
          run: >
            cp -rf amdcache dockercache

      -   name: "Reload build cache for amd64"
          run: >
            ./build_images.sh temporary-build-image linux/amd64
            
      -   name: "Smoke test with php -v"
          run: docker run --pull=never --rm -t temporary-build-image-linux-amd64 php -v

      -   name: "PHP_VERSION Env"
          run: echo "PHP_VERSION=`docker run --pull=never --rm -t temporary-build-image-linux-amd64 php --version | head -n 1 | cut -f 2 -d ' '``docker run --pull=never --rm -t temporary-build-image-linux-amd64 php --version | grep 'ZTS' >/dev/null && echo '-zts' || echo ''`" >> $GITHUB_ENV

      -   name: Tag also with php:${{ env.PHP_VERSION }}
          run: docker tag temporary-build-image-linux-amd64 php-${{ env.PHP_VERSION }}

      -   name: "Check Alpine -i"
          run: docker run --pull=never --rm -t php-${{ env.PHP_VERSION }} php -i

      -   name: "Check Alpine -v"
          run: docker run --pull=never --rm -t php-${{ env.PHP_VERSION }} php -v

      -   name: "Run Tests"
          run: tests/run_tests.sh
          env:
            DOCKER_REGISTRY_IMAGE: "temporary-build-image-linux-amd64"

      -   name: Run Alpine Trivy vulnerability scanner
          uses: aquasecurity/trivy-action@master
          with:
            image-ref: php-${{ env.PHP_VERSION }}
            format: 'table'
            exit-code: '0' # we don't break the build if vulnerabilities are included!
            ignore-unfixed: true
            vuln-type: 'os,library'
            severity: 'CRITICAL,HIGH'

      -   if: contains(github.ref, 'refs/heads/release/')
          name: Run Alpine Trivy vulnerability scanner and upload to github security tab
          uses: aquasecurity/trivy-action@master
          with:
            image-ref: php-${{ env.PHP_VERSION }}
            format: 'sarif'
            output: 'trivy-results.sarif'

      -   if: contains(github.ref, 'refs/heads/release/')
          name: Upload Alpine Trivy scan results to GitHub Security tab
          uses: github/codeql-action/upload-sarif@v2
          with:
            sarif_file: 'trivy-results.sarif'
#
      -   if: contains(github.ref, 'refs/heads/release/')
          name: Run Trivy in GitHub SBOM mode and submit results to Dependency Snapshots
          uses: aquasecurity/trivy-action@master
          with:
            format: 'github'
            output: 'dependency-results.sbom.json'
            image-ref: 'temporary-build-image-linux-amd64'
            github-pat: ${{ secrets.PAT }}
      -   if: contains(github.ref, 'refs/heads/release/')
          name: Login to DockerHub
          uses: docker/login-action@v2
          with:
            username: ${{ secrets.DOCKER_USERNAME }}
            password: ${{ secrets.DOCKER_PASSWORD }}

      -   if: contains(github.ref, 'refs/heads/release/')
          name: Login to Quay.io
          uses: docker/login-action@v2
          with:
            registry: quay.io
            username: ${{ secrets.QUAY_USERNAME }}
            password: ${{ secrets.QUAY_PASSWORD }}

      -   if: contains(github.ref, 'refs/heads/release/')
          name: Login to ghcr.io
          uses: docker/login-action@v2
          with:
            registry: ghcr.io
            username: ${{ github.actor }}
            password: ${{ secrets.GITHUB_TOKEN }}

      -   if: contains(github.ref, 'refs/heads/release/')
          name: "Build and Push Multi Arch PHP"
          env:
            GHCR_DOCKER_IMAGE_NAME: ghcr.io/endava/docker-php:${{ env.PHP_VERSION }}
            QUAY_DOCKER_IMAGE_NAME: quay.io/endava/php:${{ env.PHP_VERSION }}
          run: ./build_and_push_multi_arch_images.sh endava/php:${{ env.PHP_VERSION }}