build-main.yml

name: Build latest from main and AutoDeploy to Testing

on:
  workflow_run:
    workflows: [ 'Run Tests' ]
    branches: [ 'main' ]
    types: [ completed ]

jobs:
  build-unstable:
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    uses: mlibrary/platform-engineering-workflows/.github/workflows/build-unstable.yml@v1
    with:
      image_name: ${{ vars.IMAGE_NAME }}
      tag: ${{ github.sha }}
      dockerfile: Dockerfile
    secrets: inherit

  scan-image:
    needs: build-unstable
    runs-on: ubuntu-latest
    steps:
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ needs.build-unstable.outputs.image }}
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'

  deploy-testing:
    needs: build-unstable
    runs-on: ubuntu-latest
    environment: testing
    steps:
    - name: Deploy to Testing
      uses: mlibrary/deploy-to-kubernetes@v3
      with:
        registry_token: ${{ secrets.GITHUB_TOKEN }}
        image: ${{ needs.build-unstable.outputs.image }}
        cluster_ca: ${{ secrets.HATCHER_CLUSTER_CA }}
        cluster_server: https://hatcher.kubernetes.lib.umich.edu
        namespace_token: ${{ secrets.HATCHER_TOKEN }}
        namespace: ${{ secrets.NAMESPACE }}