Merge pull request #1421 from neicnordic/feature/dao-in-workflows

Integrating doa in workflows
neicnordic · Feb 21, 2025 · bf50eff · bf50eff
2 parents ef86ef3 + 2c21180
commit bf50eff
Show file tree

Hide file tree

Showing 2 changed files with 76 additions and 1 deletion.
diff --git a/.github/workflows/build_pr_container.yaml b/.github/workflows/build_pr_container.yaml
@@ -189,6 +189,47 @@ jobs:
           sarif_file: 'inbox-results.sarif'
           category: sftp-inbox
 
+
+      - name: create maven settings.xml
+        uses: s4u/maven-settings-action@v3.0.0
+        with:
+          servers: |
+            [{
+              "id":"github-fega-norway",
+              "username": "${{github.actor}}",
+              "password": "${{ secrets.GITHUB_TOKEN }}"
+            }]
+
+      - name: Copy settings.xml to sda-doa root
+        shell: bash
+        run: cp /home/runner/.m2/settings.xml ./sda-doa/settings.xml
+
+      - name: Build container for sda-doa
+        uses: docker/build-push-action@v6
+        with:
+          context: ./sda-doa
+          push: true
+          tags: |
+            ghcr.io/${{ github.repository }}:sha-${{ github.sha }}-doa
+            ghcr.io/${{ github.repository }}:PR${{ github.event.number }}-doa
+          labels: |
+            org.opencontainers.image.source=${{ github.event.repository.clone_url }}
+            org.opencontainers.image.created=$(date -u +'%Y-%m-%dT%H:%M:%SZ')
+            org.opencontainers.image.revision=${{ github.sha }}
+
+      - name: Run Trivy vulnerability scanner on doa
+        uses: aquasecurity/trivy-action@0.29.0
+        env:
+          TRIVY_SKIP_DB_UPDATE: true
+          TRIVY_SKIP_JAVA_DB_UPDATE: true
+        with:
+          image-ref: ghcr.io/${{ github.repository }}:sha-${{ github.sha }}-doa
+          format: "sarif"
+          hide-progress: true
+          ignore-unfixed: true
+          output: 'inbox-results.sarif'
+          severity: "CRITICAL,HIGH"
+
   rabbitmq:
     needs:
       - build_go_images
@@ -248,6 +289,35 @@ jobs:
         run: docker compose -f .github/integration/sda-sync-integration.yml run integration_test
         if: steps.changes.outputs.sync == 'true' || steps.changes.outputs.sync-api == 'true'
 
+  sda-doa:
+    needs:
+      - build_java_images
+      - build_server_images
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        storage: [s3, posix]
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+
+      - name: create maven settings.xml
+        uses: s4u/maven-settings-action@v3.0.0
+        with:
+          servers: |
+            [{
+              "id":"github-fega-norway",
+              "username": "${{github.actor}}",
+              "password": "${{ secrets.GITHUB_TOKEN }}"
+            }]
+
+      - name: Copy settings.xml to sda-doa root
+        shell: bash
+        run: cp /home/runner/.m2/settings.xml ./sda-doa/settings.xml
+
+      - name: Test sda-doa for ${{ matrix.storage }} storage
+        run: docker compose -f .github/integration/sda-doa-${{ matrix.storage }}-outbox.yml run integration_test
+
   chart:
     needs:
       - build_go_images

diff --git a/.github/workflows/publish_container.yml b/.github/workflows/publish_container.yml
@@ -56,7 +56,7 @@ jobs:
 
       - name: Pull PR containers
         run : |
-          for t in -download -postgres -rabbitmq -sftp-inbox; do
+          for t in -download -postgres -rabbitmq -sftp-inbox -doa; do
             docker pull ghcr.io/${{ github.repository }}:PR${{ github.event.number }}$t
           done
           docker pull ghcr.io/${{ github.repository }}:PR${{ github.event.number }}
@@ -86,6 +86,11 @@ jobs:
           docker tag ghcr.io/${{ github.repository }}:PR${{ github.event.number }} ghcr.io/${{ github.repository }}:${{ needs.tag_release.outputs.tag }}
           docker push ghcr.io/${{ github.repository }}:${{ needs.tag_release.outputs.tag }}
 
+      - name: Retag PR image for doa
+        run: |
+          docker tag ghcr.io/${{ github.repository }}:PR${{ github.event.number }}-doa ghcr.io/${{ github.repository }}:${{ needs.tag_release.outputs.tag }}-doa
+          docker push ghcr.io/${{ github.repository }}:${{ needs.tag_release.outputs.tag }}-doa
+
   bump_chart_version:
     needs: [tag_release, push_to_registry]
     if: ${{ needs.tag_release.outputs.tag != '' && needs.push_to_registry.result == 'success' }}