release.yml

name: Publish Release

on:
  release:
    types: [published]


concurrency:
  group: "${{ github.workflow }}"
  cancel-in-progress: true

defaults:
  run:
    shell: bash

permissions:
  id-token: write
  attestations: write


jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - id: killswitch
        name: Check release blockers
        shell: bash
        run: |
          if [[ -z '${{ inputs.force }}' ]] && gh issue list -l release-blocker -s open | grep -q '^[0-9]\+[[:space:]]'; then
            echo "Open release-blocking issues found, cancelling release...";
            gh api -X POST repos/:owner/:repo/actions/runs/$GITHUB_RUN_ID/cancel;
          fi

  build:
    name: Build Release Test Docker
    runs-on: ubuntu-latest
    timeout-minutes: 30
    needs: [ check ]
    defaults:
      run:
        shell: bash
    outputs:
      image: ${{ steps.build.outputs.image }}
      version: ${{ steps.build.outputs.version }}
      created: ${{ steps.build.outputs.created }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4.1.7
      - id: checksum
        uses: ./.github/actions/checksum
      - name: Build Image
        id: build
        uses: ./.github/actions/docker_build
        with:
          image: ${{ vars.DOCKER_IMAGE }}
          target: 'python_dev_deps'
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
          code_checksum: ${{ steps.checksum.outputs.checksum }}

  test:
    name: Run Pre-Release Test
    needs: [ build ]
    runs-on: ubuntu-latest
    services:
      redis:
        image: redis
        ports:
          - 16379:6379
      db:
        image: postgres:14
        env:
          POSTGRES_DATABASE: bitcaster
          POSTGRES_PASSWORD: postgres
          POSTGRES_USERNAME: postgres
        ports:
          - 15432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    env:
      DOCKER_DEFAULT_PLATFORM: linux/amd64
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Run tests
        run: |
          docker run --rm \
            -e DATABASE_URL=postgres://postgres:postgres@localhost:15432/bitcaster \
            -e SECRET_KEY=secret_key \
            -e CACHE_URL=redis://localhost:16379/0 \
            -e CELERY_BROKER_URL=redis://localhost:16379/0 \
            --network host \
            -v $PWD:/code/app \
            -w /code/app \
            -t ${{ vars.DOCKER_IMAGE }}:${{needs.build.outputs.version}} \
            pytest tests -v --create-db --maxfail=10 --cov -n auto --cov-report xml:coverage.xml
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v4
        env:
          token: ${{ secrets.CODECOV_TOKEN }}
        if: env.token != null
        with:
          env_vars: OS,PYTHON
          fail_ci_if_error: true
          files: coverage.xml
          token: ${{ secrets.CODECOV_TOKEN }}
          verbose: false
          name: codecov-${{env.GITHUB_REF_NAME}}

  deployable:
    name: "Build Release Docker"
    needs: [ test ]
    runs-on: ubuntu-latest
    timeout-minutes: 30
    defaults:
      run:
        shell: bash
    outputs:
      image: ${{ steps.build.outputs.image }}
      version: ${{ steps.build.outputs.version }}
      created: ${{ steps.build.outputs.created }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4.1.7
      - id: checksum
        uses: ./.github/actions/checksum
      - name: Build
        id: build
        uses: ./.github/actions/docker_build
        with:
          dryrun: ${{ env.ACT || 'false' }}
          push: 'true'
          rebuild: ${{ env.BUILD == 'true'}}
          image: ${{ vars.DOCKER_IMAGE }}
          target: 'dist'
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
          code_checksum: ${{ steps.checksum.outputs.checksum }}
      - shell: bash
        run: |
          echo "${{ toJSON(steps.build.outputs) }}"
      - name: Generate artifact attestation
        if:  steps.build.outputs.digest
        uses: actions/attest-build-provenance@v1
        with:
          subject-name: ${{ env.REGISTRY }}/${{ vars.DOCKER_IMAGE }}:${{ steps.build.outputs.version }}
          subject-digest: ${{ steps.build.outputs.digest }}
          push-to-registry: true

      - uses: ./.github/actions/delete_docker
        with:
          image: ${{vars.DOCKER_IMAGE}}
          tag: test-${{ steps.build.outputs.version }}
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

  trivy:
    name: Check Release with Trivy
    runs-on: ubuntu-latest
    needs: [ deployable ]
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
    if: needs.deployable.outputs.created == 'true' 
      || contains(github.event.head_commit.message, 'ci:scan') 
      || contains(github.event.head_commit.message, 'ci:all')
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{needs.deployable.outputs.image}}
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results.sarif'