dev-commit-stage.yml

name: Commit Stage 🤖
on:
  push:
    branches: [ feature/*, develop ]
  pull_request:
    branches: [ main, develop ]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  VERSION: ${{ github.sha }}
  CI: CI
  NATIVE_IMAGE_ENABLED: enabled
  CI_GITHUB_TOKEN: ${{ secrets.CI_GITHUB_TOKEN }}

permissions:
  packages: write
  contents: write
  issues: write

jobs:
  build:
    name: Build and Test 🧪
    runs-on: ubuntu-22.04
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: 🔍 CI_GITHUB_TOKEN
        if: env.CI_GITHUB_TOKEN == ''
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: echo "CI_GITHUB_TOKEN=${GITHUB_TOKEN}" >> $GITHUB_ENV

      - name: Checkout source code
        uses: actions/checkout@v4

      - name: Install Java Tools & Dependencies
        uses: ./.github/actions/install/java
        with:
          java-version: 21
          gradle-arguments: build --scan

      - name: Source code vulnerability scanning
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          format: 'sarif'
          output: 'trivy-results-source-code.sarif'

      - name: Upload vulnerability report
        uses: github/codeql-action/upload-sarif@v3
        if: success() || failure()
        with:
          sarif_file: 'trivy-results-source-code.sarif'
          category: source-code

  package:
    name: Package and Publish 📦
    needs: [ build ]
    runs-on: ubuntu-22.04
    permissions: write-all
    steps:
      - name: Checkout source code
        uses: actions/checkout@v4

      - name: Install Java Tools & Dependencies
        uses: ./.github/actions/install/java

      - name: Execute Gradle build
        run: |
          chmod +x gradlew
          ./gradlew bootBuildImage --imageName ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.VERSION }}

      - name: OCI image vulnerability scanning
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.VERSION }}
          format: 'sarif'
          output: 'trivy-results-oci-image.sarif'
      - name: Upload vulnerability report
        uses: github/codeql-action/upload-sarif@v3
        if: success() || failure()
        with:
          sarif_file: 'trivy-results-oci-image.sarif'
      - name: Log into container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ env.CI_GITHUB_TOKEN }}
      - name: Publish container image
        run: docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.VERSION }}
      - name: Publish container image (latest)
        run: |
          docker tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.VERSION }} \
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:nightly
          docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:nightly