build.yml

#
# Copyright 2019-2020 DJANTA, LLC (https://www.djanta.io)
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#    http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed toMap in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

name: Build

on:
  # Trigger the workflow on push or pull request, but only for the master branch
  push:
    branches:
      - feature/*
      - addons/*
      - master

jobs:
  build:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        os: [centos]
    steps:
      -
        name: Checking out
        uses: actions/checkout@v4
        with:
          token: ${{ secrets.GH_TOKEN }}
          submodules: true
      -
        name: Submodules Sync
        shell: bash
        run: |
          git submodule sync --recursive
          git submodule update --recursive --remote --merge --force --depth=3

      -
        name: GitHub credentials configuration
        shell: bash
        run: |
          git config user.name "${{ secrets.GH_USER }}"
          git config user.email "${{ secrets.GH_USER_EMAIL }}"
          git config credential.helper "store --file=.git/credentials"
          echo "https://${{ secrets.GITHUB_TOKEN }}:@github.com" > .git/credentials
      -
        #https://github.com/crazy-max/ghaction-docker-buildx
        name: Prepare Build for (${{ matrix.os }})
        id: prepare
        run: |
          DOCKER_PLATFORMS=linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64,linux/386,linux/ppc64le,linux/s390x
          OS=${{ matrix.os }}
          YEAR=$(date -u +'%Y')
          MONTH=$(date -u +'%m')
          LTS=$YEAR
          DOCKER_IMAGE=djanta/nuxeo-sdk-${{ matrix.os }}

          # shellcheck disable=SC2034
          TAG_ID=${LTS}.$((10#$MONTH))
          #VERSION=edge
          VERSION=${TAG_ID}

          if [[ $GITHUB_REF == refs/tags/* ]]; then
            VERSION=${GITHUB_REF#refs/tags/v}
          elif [[ "${{ github.event_name }}" = "schedule" ]]; then
            VERSION=nightly
          else
            #VERSION=edge
            VERSION=${TAG_ID}
          fi

          #if [ "${{ github.event_name }}" = "schedule" ]; then
          #  VERSION=nightly
          #fi

          TAGS="${DOCKER_IMAGE}:${VERSION}"
          if [[ $VERSION =~ ^[0-9]{1,4}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
            TAGS="${DOCKER_IMAGE}:latest"
          fi

          echo ::set-output name=docker_image::${DOCKER_IMAGE}
          echo ::set-output name=version::${VERSION}
          echo ::set-output name=tags::${TAGS}
          echo ::set-output name=platforms::${DOCKER_PLATFORMS}
          echo ::set-output name=dockerfile::$(pwd)/dockerfiles/${OS}/Dockerfile

          echo ::set-output name=buildx_args::--platform ${DOCKER_PLATFORMS} \
            --build-arg BUILD_VERSION="${TAG_ID}" \
            --build-arg BUILD_HASH=$(git rev-parse HEAD) \
            --build-arg RELEASE_VERSION="$(date -u +'%Y.%m.%d')-${OS}" \
            --build-arg BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ') \
            --build-arg BUILD_DISTRIB="${OS}" \
            --progress auto \
            --tag "${TAGS}"

#          echo ::set-output name=buildx_args::--platform ${DOCKER_PLATFORMS} \
#            --build-arg BUILD_VERSION=${TAGS} \
#            --build-arg BUILD_HASH=$(git rev-parse HEAD) \
#            --build-arg VERSION=${VERSION} \
#            --build-arg BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ') \
#            --build-arg RELEASE_VERSION=$(date -u +'%Y.%m.%d')-${{ matrix.os }} \
#            --build-arg BUILD_DISTRIB=${{ matrix.os }} \
#            --build-arg BUILD_SDK_VERSION="${SDK_VERSION}" \
#            --build-arg BUILD_NX_CLID="${NX_CLID}" \
#            --build-arg BUILD_NX_HOTFIX="${NX_HOTFIX}" \
#            --build-arg BUILD_NX_HOTFIX_VERSION=${NX_HOTFIX_VERSION} \
#            --build-arg BUILD_NX_LTS="${LTS}" \
#            --build-arg VCS_REF=${GITHUB_SHA::8} \
#            ${TAGS} --file $(pwd)/dockerfiles/${OS}/Dockerfile ./

      - name: Set up Docker Buildx
        uses: crazy-max/ghaction-docker-buildx@v3

      # Mandatory authentication into docker hub
      - name: Login to DockerHub
        uses: docker/login-action@v3
        id: doickerhublogin
        with:
#          registry: ghcr.io
#          registry: docker.pkg.github.com
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Cache Docker layers
        uses: actions/cache@v4
        id: cache
        with:
          path: /tmp/.buildx-cache
          key: ${{ runner.os }}-buildx-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-buildx-

      - name: Build Image & Deploy (Legacy)
        id: image
        env:
          GITHUB_USERNAME: ${{ secrets.GH_USER }}
          GH_USER: ${{ secrets.GH_USER }}
          GH_TOKEN: ${{ secrets.GH_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
          JDK_VARIANT: jdk
          PLATFORM: ${{ steps.prepare.outputs.platforms }}
        run: |
          echo "Docker building ..."
      -
        name: Building Docker without push for (${{ matrix.os }})
        run: |
          docker -D buildx build --output "type=image,push=false" \
          ${{ steps.prepare.outputs.buildx_args }} \
          --file ${{ steps.prepare.outputs.dockerfile }} ./
#      -
#        name: Docker Buildx (push)
#        run: |
#          docker buildx build --output "type=image,push=true" \
#          ${{ steps.prepare.outputs.buildx_args }} \
#          --file ${{ steps.prepare.outputs.dockerfile }} ./
      -
        name: Inspect image
        run: |
          docker buildx imagetools inspect ${{ steps.prepare.outputs.tags }}

#          echo ::set-output name=image_id_cache::${IMAGE_ID_CACHE}

#      - name: Inspect image
##        if: always() && github.event_name != 'pull_request'
#        if: always()
#        run: |
#          if [ -n ${{ steps.image.outputs.image_id_cache }} ]; then \
#            for image in ${{ steps.image.outputs.image_id_cache }}[@]; do \
#              docker buildx imagetools inspect "$image" \
#            done; \
#          fi

#      - name: 'Run Docker test'
#        shell: bash
#        env:
#          IMAGE: djanta/nuxeo-sdk-${{ matrix.arch }}:develop
#        run: |
#          git clone https://github.com/docker-library/official-images.git ~/official-images
#          ~/official-images/test/run.sh $IMAGE

#      - name: Snyk vulnerabilities check
#        uses: snyk/actions/docker@master
#        fail-fast: false
#        env:
#          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
#        with:
#          image: djanta/nuxeo-sdk-${{ matrix.arch }}:develop
#          args: --severity-threshold=high --file=dockerfiles/${{ matrix.arch }}/.vulnerability

#      - name: Run Gitrivy Vulnerability check
#        uses: homoluctus/gitrivy@v2.0.0
#        with:
#          token: ${{ secrets.GITHUB_TOKEN }}
#          image: djanta/nuxeo-sdk-${{ matrix.arch }}:develop
#          trivy_version: true
#          issue_label: test,report,vulnerability

#      - name: Create Pull Request
#        id: cpr
#        uses: peter-evans/create-pull-request@v2
#        with:
#          token: ${{ secrets.GH_TOKEN }}
#          commit-message: "[WIP] - PR after passing ${GITHUB_REF} build"
#          committer: GitHub <noreply@github.com>
#          author: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>
#          title: '[PR: #${{ github.run_number }}] from ${{ github.ref }} by (${{ github.event.head_commit.committer.name }})'
#          body: |
#            - ${{ github.event.head_commit.message }}
#            - Auto-generated by [create-pull-request][1]
#            [1]: https://github.com/$GITHUB_REPOSITORY/pull
#          labels: report, automated pr
#          assignees: stanislaska
#          reviewers: stanislaska
#          team-reviewers: owners, maintainers
#          draft: false
#          branch: patch
#          request-to-parent: false
#          branch-suffix: short-commit-hash

#      - name: Create or Update Project Card
#        uses: peter-evans/create-or-update-project-card@v1
#        with:
#          token: ${{ secrets.GITHUB_TOKEN }}
#          project-name: Cloud
#          column-name: To do
#          issue-number: ${{ steps.cpr.outputs.pull-request-number }}