build.yml

name: Build authorization server

on:
  push:
    branches:
    - main
  pull_request:
    branches:
    - main

env:
  CONTAINER_REGISTRY: ghcr.io

defaults:
  run:
    working-directory: dotnet-authserver

jobs:
  setup:
    name: Cancel previous runs for PR
    runs-on: ubuntu-latest

    steps:
    - uses: styfle/cancel-workflow-action@0.9.1
      with:
        access_token: ${{ github.token }}
      if: github.event_name == 'pull_request'

  build:
    name: Build
    needs: [setup]
    runs-on: ubuntu-latest
    environment:
      name: dev

    outputs:
      authserver: ${{ steps.image_tags.outputs.authserver }}
      testclient: ${{ steps.image_tags.outputs.testclient }}

    services:
      postgres:
        image: postgres
        env:
          POSTGRES_DB: teacher_identity
          POSTGRES_PASSWORD: teacher_identity
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 5432:5432

    steps:
    - uses: actions/checkout@v3

    - uses: actions/setup-dotnet@v2
      with:
        dotnet-version: '6.0.x'

    - name: Lint
      run: |
        #https://github.com/dotnet/format/issues/1433
        dotnet tool install -g dotnet-format --version "6.*" --add-source https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet6/nuget/v3/index.json
        dotnet-format --verify-no-changes

    - name: Install SASS
      run: npm install -g sass

    - name: Build
      run: dotnet build --configuration Release

    - name: Install Playwright
      run: pwsh ./test/TeacherIdentity.AuthServer.EndToEndTests/bin/Release/net6.0/playwright.ps1 install

    - name: Unit tests
      id: unit-tests
      run: dotnet test ./test/TeacherIdentity.AuthServer.Tests/ --configuration Release --no-build --logger trx
      env:
        ConnectionStrings__DefaultConnection: "Host=localhost;Username=postgres;Password=teacher_identity;Database=teacher_identity"

    - name: Unit tests report
      uses: dorny/test-reporter@v1
      if: always() && (steps.unit-tests.outcome == 'success' || steps.unit-tests.outcome == 'failure')
      with:
        name: Unit test results
        path: 'dotnet-authserver/test/TeacherIdentity.AuthServer.Tests/**/*.trx'
        reporter: dotnet-trx

    - name: End-to-end tests
      id: e2e-tests
      run: dotnet test ./test/TeacherIdentity.AuthServer.EndToEndTests/ --configuration Release --no-build --logger trx
      env:
        AuthorizationServer__ConnectionStrings__DefaultConnection: "Host=localhost;Username=postgres;Password=teacher_identity;Database=teacher_identity"

    - name: End-to-end tests report
      uses: dorny/test-reporter@v1
      if: always() && (steps.e2e-tests.outcome == 'success' || steps.e2e-tests.outcome == 'failure')
      with:
        name: End-to-end test results
        path: 'dotnet-authserver/test/TeacherIdentity.AuthServer.EndToEndTests/**/*.trx'
        reporter: dotnet-trx

    - name: Publish
      run: |
        dotnet publish --configuration Release --no-build src/TeacherIdentity.AuthServer/TeacherIdentity.AuthServer.csproj
        dotnet publish --configuration Release --no-build src/TeacherIdentity.TestClient/TeacherIdentity.TestClient.csproj

    - name: Get Docker image tags
      id: image_tags
      run: |
        echo ::set-output name=authserver::$CONTAINER_REGISTRY/$(echo $GITHUB_REPOSITORY | tr '[:upper:]' '[:lower:]'):authserver-$GITHUB_SHA
        echo ::set-output name=testclient::$CONTAINER_REGISTRY/$(echo $GITHUB_REPOSITORY | tr '[:upper:]' '[:lower:]'):testclient-$GITHUB_SHA

    - name: Set KV environment variables
      working-directory: terraform
      if: github.actor != 'dependabot[bot]'
      run: |
        tf_vars_file=workspace_variables/dev.tfvars.json
        echo "KEY_VAULT_NAME=$(jq -r '.key_vault_name' ${tf_vars_file})" >> $GITHUB_ENV

    - uses: azure/login@v1
      if: github.actor != 'dependabot[bot]'
      with:
        creds: ${{ secrets.AZURE_CREDENTIALS }}

    - uses: DfE-Digital/keyvault-yaml-secret@v1
      id: get_monitoring_secret
      with:
        keyvault: ${{ env.KEY_VAULT_NAME }}
        secret: MONITORING
        key: SLACK_WEBHOOK
      env:
        GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

    - uses: DFE-Digital/keyvault-yaml-secret@v1
      if: github.actor != 'dependabot[bot]'
      id: get-secret
      with:
        keyvault: ${{ env.KEY_VAULT_NAME }}
        secret: INFRASTRUCTURE
        key: SNYK_TOKEN

    - name: Login to GitHub Container Registry
      uses: docker/login-action@v1
      with:
        registry: ${{ env.CONTAINER_REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Auth server docker build
      uses: docker/build-push-action@v3
      with:
        context: dotnet-authserver/src/TeacherIdentity.AuthServer
        push: false
        tags: ${{ steps.image_tags.outputs.authserver }}
        build-args: |
          GIT_SHA=${{ github.sha }}

    - name: Run Snyk to check auth server Docker image for vulnerabilities
      if: github.actor != 'dependabot[bot]'
      uses: snyk/actions/docker@master
      env:
        SNYK_TOKEN: ${{ steps.get-secret.outputs.snyk_token }}
      with:
        image: ${{ steps.image_tags.outputs.authserver }}
        args: --file=dotnet-authserver/src/TeacherIdentity.AuthServer/Dockerfile --severity-threshold=high

    - name: Push auth server docker image
      run: docker image push ${{ steps.image_tags.outputs.authserver }}

    - name: Test client docker build
      uses: docker/build-push-action@v3
      with:
        context: dotnet-authserver/src/TeacherIdentity.TestClient
        push: true
        tags: ${{ steps.image_tags.outputs.testclient }}

    - name: Notify Slack channel on build or scan failure
      if: failure()
      uses: rtCamp/action-slack-notify@v2
      env:
        SLACK_USERNAME: CI Deployment
        SLACK_TITLE: Build failure
        SLACK_MESSAGE: Get an identity - build or SNYK scan failure.
        SLACK_WEBHOOK: ${{ steps.get_monitoring_secret.outputs.SLACK_WEBHOOK }}
        SLACK_COLOR: failure
        SLACK_FOOTER: Sent from build job of build.yml

  validate_terraform:
    name: Validate Terraform
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v3

    - uses: hashicorp/setup-terraform@v2
      with:
        terraform_version: 1.0.10

    - name: Check formatting
      run: terraform fmt -check
      working-directory: terraform

    - name: Validate
      run: |
        terraform init -backend=false
        terraform validate -no-color
      working-directory: terraform

    - name: Lint
      uses: reviewdog/action-tflint@master
      with:
        github_token: ${{ secrets.GITHUB_TOKEN }}
        tflint_rulesets: azurerm
        working_directory: terraform
      continue-on-error: true  # temporary- we're getting sporadic 503 errors here in action setup

  deploy_dev:
    name: Deploy to dev environment
    needs: [build, validate_terraform]
    runs-on: ubuntu-latest
    if: (github.event_name == 'pull_request' && github.event.pull_request.draft == false) || github.event_name == 'workflow_dispatch'
    environment:
      name: dev
      url: ${{ steps.deploy.outputs.environment_url }}
    concurrency: deploy_dev

    outputs:
      environment_url: ${{ steps.deploy.outputs.environment_url }}

    steps:
    - uses: actions/checkout@v3

    - uses: ./.github/workflows/actions/deploy-environment
      id: deploy
      with:
        environment_name: dev
        image_tag: ${{ github.sha }}
        azure_credentials: ${{ secrets.AZURE_CREDENTIALS }}
        terraform_vars: workspace_variables/dev.tfvars.json
        terraform_backend_vars: workspace_variables/dev.backend.tfvars

  deploy_preprod:
    name: Deploy to preprod environment
    needs: [build]
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch'
    environment:
      name: preprod
      url: ${{ steps.deploy.outputs.environment_url }}
    concurrency: deploy_preprod

    outputs:
      environment_url: ${{ steps.deploy.outputs.environment_url }}

    steps:
    - uses: actions/checkout@v3

    - uses: ./.github/workflows/actions/deploy-environment
      id: deploy
      with:
        environment_name: preprod
        image_tag: ${{ github.sha }}
        azure_credentials: ${{ secrets.AZURE_CREDENTIALS }}
        terraform_vars: workspace_variables/preprod.tfvars.json
        terraform_backend_vars: workspace_variables/preprod.backend.tfvars

  deploy_production:
    name: Deploy to production environment
    needs: [build, deploy_preprod]
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch'
    environment:
      name: production
      url: ${{ steps.deploy.outputs.environment_url }}
    concurrency: deploy_production

    outputs:
      environment_url: ${{ steps.deploy.outputs.environment_url }}
      postgres_server_name: ${{ steps.deploy.outputs.postgres_server_name }}

    steps:
    - uses: actions/checkout@v3

    - uses: ./.github/workflows/actions/deploy-environment
      id: deploy
      with:
        environment_name: production
        image_tag: ${{ github.sha }}
        azure_credentials: ${{ secrets.AZURE_CREDENTIALS }}
        terraform_vars: workspace_variables/production.tfvars.json
        terraform_backend_vars: workspace_variables/production.backend.tfvars