pr.yaml

name: Lint,Test,Security Checks

on:
  pull_request:
    branches:
      - dev
      - qa
      - pre-prod
      - main

permissions:
  contents: read
  pull-requests: write
  packages: write

jobs:
  static-checks:
    strategy:
      matrix:
        include:
          - workdir: ./backend
            name: backend
            dockerfile: ./backend/Dockerfile
            image: ghcr.io/${{ github.repository }}-backend:${{ github.sha }}

    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Lint Dockerfile
        id: hadolint
        uses: hadolint/hadolint-action@v3.1.0
        with:
          failure-threshold: error
          format: json
          dockerfile: ${{ matrix.dockerfile }}
          # output-file: hadolint_output.json

      - name: Save Hadolint output
        id: save_hadolint_output
        if: always()
        run: cd ${{ matrix.workdir }} && echo "$HADOLINT_RESULTS" | jq '.' > hadolint_output.json

      - name: Print Dockerfile lint output
        run: |
          cd ${{ matrix.workdir }}
          echo "-----HADOLINT RESULT-----"
          echo "Outcome: ${{ steps.hadolint.outcome }}"
          echo "-----DETAILS--------"
          cat hadolint_output.json
          echo "--------------------"

      - name: Code lint
        id: code_lint
        run: |
          cd ${{ matrix.workdir }}
          npm i
          set -o pipefail
          # npm run lint 2>&1 | tee code_lint_output.txt
          echo "no lint for now, skip" | tee code_lint_output.txt

      - name: Unit tests
        id: unit_tests
        run: |
          cd ${{ matrix.workdir }}
          npm i
          set -o pipefail
          # npm run test 2>&1 | tee unit_test_output.txt
          echo "no tests for now, skip" | tee unit_test_output.txt

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Cache Docker layers
        uses: actions/cache@v3
        with:
          path: /tmp/.buildx-cache
          key: ${{ runner.os }}-buildx-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-buildx-

      - id: image_lowercase
        uses: ASzc/change-string-case-action@v6
        with:
          string: ${{ matrix.image }}

      - name: Build Docker image
        uses: docker/build-push-action@v5
        with:
          context: ${{ matrix.workdir }}
          file: ${{ matrix.dockerfile }}
          tags: ${{ steps.image_lowercase.outputs.lowercase }}
          load: true
          cache-from: type=local,src=/tmp/.buildx-cache
          cache-to: type=local,dest=/tmp/.buildx-cache

      - name: Save Docker image
        run: docker save ${{ steps.image_lowercase.outputs.lowercase }} -o my-image.tar
          
      - name: Scan Docker image with Dockle
        id: dockle
        run: |
            wget https://github.com/goodwithtech/dockle/releases/download/v0.2.4/dockle_0.2.4_Linux-64bit.tar.gz
            tar zxvf dockle_0.2.4_Linux-64bit.tar.gz
            sudo mv dockle /usr/local/bin

            echo '{}' > ~/.docker/config.json

            dockle --exit-level fatal --format json --output ${{ matrix.workdir }}/dockle_scan_output.json --input ./my-image.tar

            echo "outcome=success" >> $GITHUB_OUTPUT
      # - name: Scan Docker image with Dockle
      #   id: dockle
      #   uses: goodwithtech/dockle-action@main
      #   with:
      #     input: ${{ steps.image_lowercase.outputs.lowercase }}
      #     format: 'json'
      #     exit-level: 'fatal'
      #     ignore: 'CIS-DI-0010'
      #     output: ${{ matrix.workdir }}/dockle_scan_output.json

      - name: Create PR comment
        if: always()
        uses: actions/github-script@v6
        env:
          HADOLINT_RESULT: ${{ steps.hadolint.outcome }}
          CODE_LINT_RESULT: ${{ steps.code_lint.outcome }}
          UNIT_TEST_RESULT: ${{ steps.unit_tests.outcome }}
          DOCKLE_RESULT: ${{ steps.dockle.outcome }}
        with:
          script: |
            const fs = require('fs');

            const hadolintResult = fs.existsSync('${{ matrix.workdir }}/hadolint_output.json') ? fs.readFileSync('${{ matrix.workdir }}/hadolint_output.json', 'utf8') : 'No output';
            const codeLintResult = fs.existsSync('${{ matrix.workdir }}/code_lint_output.txt') ? fs.readFileSync('${{ matrix.workdir }}/code_lint_output.txt', 'utf8') : 'No output';
            const unitTestResult = fs.existsSync('${{ matrix.workdir }}/unit_test_output.txt') ? fs.readFileSync('${{ matrix.workdir }}/unit_test_output.txt', 'utf8') : 'No output';
            const dockleScanResult = fs.existsSync('${{ matrix.workdir }}/dockle_scan_output.json') ? fs.readFileSync('${{ matrix.workdir }}/dockle_scan_output.json', 'utf8') : 'No output';

            let commentBody = '';

            if (process.env.HADOLINT_RESULT !== 'success') {
              commentBody = `
              :x: Dockerfile Lint (Hadolint) failed
              \`\`\`json
              ${hadolintResult}
              \`\`\`
                            `;
                          } else if (process.env.CODE_LINT_RESULT !== 'success') {
                            commentBody = `
              :x: Code Lint failed
              \`\`\`
              ${codeLintResult}
              \`\`\`
                            `;
                          } else if (process.env.UNIT_TEST_RESULT !== 'success') {
                            commentBody = `
              :x: Unit Tests failed
              \`\`\`
              ${unitTestResult}
              \`\`\`
                            `;
                          } else if (process.env.DOCKLE_RESULT !== 'success') {
                            commentBody = `
              :x: Docker Image Scan (Dockle) failed
              \`\`\`json
              ${dockleScanResult}
              \`\`\`
                            `;
                          } else {
                            commentBody = ':white_check_mark: All checks succeeded';
                          }

                          const { owner, repo } = context.repo;
                          const issue_number = context.issue.number;

                          await github.rest.issues.createComment({
                            owner,
                            repo,
                            issue_number,
                            body: commentBody
                          });