build-and-push-docker-image.yaml

name: Test, build and push code to docker registry

on:
  push:
    branches: 
      - 'main'
      - 'tests'
    paths: 
      - 'Dockerfile'
      - '.github/workflows/build-and-push-docker-image.yaml'
      - '*.py'
      - 'yaml-templates/*'
  schedule:
    - cron: '0 8 * * *'
  workflow_call:

jobs:

  test-python:
    runs-on: ubuntu-latest

    permissions:
      contents: read

    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
      
      - name: Setup python
        uses: actions/setup-python@v5
        with:
          python-version: '3.x'
      
      - name: flake8 Lint
        uses: py-actions/flake8@v2
      
      - name: Install Dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
      
      - name: Run Unittest
        run: |
          python -m unittest discover
          python -m unittest -v

  
  build-and-push-image:
    runs-on: ubuntu-latest
    needs: test-python

    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
    
      - name: Docker login
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
    
      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/dfe-digital/automated-threat-models
    
      - name: Build and push image
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

  test-action:
    runs-on: ubuntu-latest
    needs: build-and-push-image

    permissions:
      contents: read
      packages: read

    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
    
      - name: Test threagile help
        id: threagile-test-optional-args
        uses: pritchyspritch/run-threagile-action@v2
        with:
          optional_args: '--help'

      - name: Test threagile with real model
        id: threagile
        uses: pritchyspritch/run-threagile-action@v2
        with:
          model_file: 'example-models/threagile-SSPHP-model.yaml'
          output_dir: 'test/location'

      # will fail as Azure data ingestion hasn't been automated yet
      - name: Test threagile dfe automation 
        id: dfe-threagile
        uses: pritchyspritch/run-threagile-action@v2
        with:
          dfe_threagile: 'true'
      
      - name: Upload Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: threat-model-output
          path: test/location