pipeline.yml

# This workflow will build a Java project with Gradle and cache/restore any dependencies to improve the workflow execution time
# For more information see: https://help.github.com/actions/language-and-framework-guides/building-and-testing-java-with-gradle

name: Pipeline

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  # Allow to run this workflow manually
  workflow_dispatch:

env:
  CONTAINER_REGISTRY: ghcr.io
  CONTAINER_IMAGE_NAME: ${{ github.repository }}
  CONTAINER_IMAGE_VERSION: ${{ github.sha }}

jobs:
  validate-gradle-wrapper:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Validate gradle wrapper
        uses: gradle/wrapper-validation-action@8d49e559aae34d3e0eb16cde532684bc9702762b

  build:
    runs-on: ubuntu-latest
    needs: [validate-gradle-wrapper]
    steps:
      - uses: actions/checkout@v3
      - name: Set up JDK
        uses: actions/setup-java@v3
        with:
          java-version: "17.0"
          distribution: "temurin"
          cache: gradle
      - name: Grant execute permission for gradlew
        run: chmod +x gradlew
      - name: Build with Gradle
        run: ./gradlew build
      - name: Send status to Slack
        # Third-party action, pin to commit SHA!
        # See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
        uses: lazy-actions/slatify@c4847b8c84e3e8076fd3c42cc00517a10426ed65
        if: ${{ failure() && github.ref == 'refs/heads/main' && env.SLACK_WEBHOOK_URL }}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
        with:
          type: ${{ job.status }}
          job_name: "Build :point_right:"
          mention: "here"
          mention_if: "failure"
          commit: true
          url: ${{ secrets.SLACK_WEBHOOK_URL }}
          token: ${{ secrets.GITHUB_TOKEN }}

  audit-licenses:
    runs-on: ubuntu-latest
    needs: [validate-gradle-wrapper]
    steps:
      - uses: actions/checkout@v3
      - name: Set up JDK
        uses: actions/setup-java@v3
        with:
          java-version: "17.0"
          distribution: "temurin"
          cache: gradle
      - name: Grant execute permission for gradlew
        run: chmod +x gradlew
      - name: Run license scanner
        run: ./gradlew checkLicense
      - name: Send status to Slack
        # Third-party action, pin to commit SHA!
        # See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
        uses: lazy-actions/slatify@c4847b8c84e3e8076fd3c42cc00517a10426ed65
        if: ${{ failure() && github.ref == 'refs/heads/main' && env.SLACK_WEBHOOK_URL }}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
        with:
          type: ${{ job.status }}
          job_name: "License audit :point_right:"
          mention: "here"
          mention_if: "failure"
          commit: true
          url: ${{ secrets.SLACK_WEBHOOK_URL }}
          token: ${{ secrets.GITHUB_TOKEN }}

  vulnerability-scan:
    runs-on: ubuntu-latest
    needs: [validate-gradle-wrapper]
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v3
      - name: Set up JDK
        uses: actions/setup-java@v3
        with:
          java-version: "17.0"
          distribution: "temurin"
          cache: gradle
      - name: Grant execute permission for gradlew
        run: chmod +x gradlew
      - name: Build container image
        run: ./gradlew bootBuildImage
      - name: Run Trivy vulnerability scanner
        # Third-party action, pin to commit SHA!
        # See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
        uses: aquasecurity/trivy-action@41f05d9ecffa2ed3f1580af306000f734b733e54
        with:
          image-ref: ${{ env.CONTAINER_REGISTRY }}/${{ env.CONTAINER_IMAGE_NAME }}:${{ env.CONTAINER_IMAGE_VERSION }}
          format: "sarif"
          output: "trivy-results.sarif"
          severity: "CRITICAL,HIGH"
          exit-code: "1" # Fail the build!
      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        if: ${{ always() && github.ref == 'refs/heads/main' }} # Bypass non-zero exit code..
        with:
          sarif_file: "trivy-results.sarif"
      - name: Generate cosign vulnerability scan record
        # Third-party action, pin to commit SHA!
        # See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
        uses: aquasecurity/trivy-action@41f05d9ecffa2ed3f1580af306000f734b733e54
        with:
          image-ref: ${{ env.CONTAINER_REGISTRY }}/${{ env.CONTAINER_IMAGE_NAME }}:${{ env.CONTAINER_IMAGE_VERSION }}
          format: "cosign-vuln"
          output: "vuln.json"
      - name: Upload cosign vulnerability scan record
        uses: actions/upload-artifact@v3
        with:
          name: "vuln.json"
          path: "vuln.json"
          if-no-files-found: error
      - name: Send status to Slack
        # Third-party action, pin to commit SHA!
        # See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
        uses: lazy-actions/slatify@c4847b8c84e3e8076fd3c42cc00517a10426ed65
        if: ${{ failure() && github.ref == 'refs/heads/main' && env.SLACK_WEBHOOK_URL }}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
        with:
          type: ${{ job.status }}
          job_name: "Vulnerability scan :point_right:"
          mention: "here"
          mention_if: "failure"
          commit: true
          url: ${{ secrets.SLACK_WEBHOOK_URL }}
          token: ${{ secrets.GITHUB_TOKEN }}

  analyze:
    runs-on: ubuntu-latest
    if: ${{ github.ref == 'refs/heads/main' }}
    needs: [validate-gradle-wrapper, build, vulnerability-scan]
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
      - name: Set up JDK
        uses: actions/setup-java@v3
        with:
          java-version: "17.0"
          distribution: "temurin"
          cache: gradle
      - name: Cache SonarQube packages
        uses: actions/cache@v3
        with:
          path: ~/.sonar/cache
          key: ${{ runner.os }}-sonar
      - name: Grant execute permission for gradlew
        run: chmod +x gradlew
      - name: Scan with SonarQube
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        run: ./gradlew sonar --info
      - name: Check SonarQube Quality Gate
        # Third-party action, pin to commit SHA!
        # See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
        uses: sonarsource/sonarqube-quality-gate-action@d304d050d930b02a896b0f85935344f023928496
        with:
          scanMetadataReportFile: build/sonar/report-task.txt
        timeout-minutes: 3 # Force to fail step after specific time
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
      - name: Send status to Slack
        # Third-party action, pin to commit SHA!
        # See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
        uses: lazy-actions/slatify@c4847b8c84e3e8076fd3c42cc00517a10426ed65
        if: ${{ failure() && env.SLACK_WEBHOOK_URL }}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
        with:
          type: ${{ job.status }}
          job_name: "Analyze :point_right:"
          mention: "here"
          mention_if: "failure"
          commit: true
          url: ${{ secrets.SLACK_WEBHOOK_URL }}
          token: ${{ secrets.GITHUB_TOKEN }}

  build-and-push-image:
    runs-on: ubuntu-latest
    if: ${{ github.ref == 'refs/heads/main' }}
    needs:
      - validate-gradle-wrapper
      - build
      - audit-licenses
      - vulnerability-scan
    permissions:
      contents: read
      id-token: write # This is used to complete the identity challenge with sigstore/fulcio..
      packages: write
    outputs:
      version: ${{ steps.set-version.outputs.version }}
    steps:
      - uses: actions/checkout@v3
      - name: Set up JDK
        uses: actions/setup-java@v3
        with:
          java-version: "17.0"
          distribution: "temurin"
          cache: gradle
      - name: Grant execute permission for gradlew
        run: chmod +x gradlew
      - name: Build and publish container image
        run: CONTAINER_REGISTRY_USER=${{ github.actor }} CONTAINER_REGISTRY_PASSWORD=${{ secrets.GITHUB_TOKEN }} ./gradlew bootBuildImage --publishImage
      - name: Install cosign
        # Third-party action, pin to commit SHA!
        # See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
        uses: sigstore/cosign-installer@a5d81fb6bdbcbb3d239e864d6552820420254494
      - name: Log into container registry
        # Third-party action, pin to commit SHA!
        # See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
        with:
          registry: ${{ env.CONTAINER_REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Sign the published Docker image
        env:
          COSIGN_EXPERIMENTAL: "true"
        # This step uses the identity token to provision an ephemeral certificate
        # against the sigstore community Fulcio instance.
        run: cosign sign ${{ env.CONTAINER_REGISTRY }}/${{ env.CONTAINER_IMAGE_NAME }}:${{ env.CONTAINER_IMAGE_VERSION }}
      - name: Download cosign vulnerability scan record
        uses: actions/download-artifact@v3
        with:
          name: "vuln.json"
      - name: Attest vulnerability scan
        run: cosign attest --replace --predicate vuln.json --type vuln ${{ env.CONTAINER_REGISTRY }}/${{ env.CONTAINER_IMAGE_NAME }}:${{ env.CONTAINER_IMAGE_VERSION }}
        env:
          COSIGN_EXPERIMENTAL: "true"
      - id: set-version
        run: echo "version=$CONTAINER_IMAGE_VERSION" >> $GITHUB_OUTPUT
      - name: Send status to Slack
        # Third-party action, pin to commit SHA!
        # See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
        uses: lazy-actions/slatify@c4847b8c84e3e8076fd3c42cc00517a10426ed65
        if: ${{ failure() && env.SLACK_WEBHOOK_URL }}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
        with:
          type: ${{ job.status }}
          job_name: "Build/push image :point_right:"
          mention: "here"
          mention_if: "failure"
          commit: true
          url: ${{ secrets.SLACK_WEBHOOK_URL }}
          token: ${{ secrets.GITHUB_TOKEN }}