Skip to content

Commit b6a9bef

Browse files
sthanikan2000sthanikan2000
authored
Separated the Validation and Publishing Workflows (#342)
* Separated the Validation and Publishing Workflows * fix: removed the reference to the old workflows * feat: standardize repository name to lowercase in validation workflows * fix: improve application creation and verification in tests * feat: add Trivy vulnerability scanning to validation workflows * fix: re-enable unit and integration tests in validation workflow * Addressed the copilot comments * fix: comment out unit and integration tests in validation workflow
1 parent 3b21830 commit b6a9bef

11 files changed

+551
-353
lines changed

‎.github/workflows/api-server-publish.yml‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
name: Publish API Server Image
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
paths:
8+
- 'api-server-go/**'
9+
- '.github/workflows/api-server-publish.yml'
10+
tags:
11+
- 'api-server-go-v*'
12+
- 'v*'
13+
workflow_dispatch:
14+
15+
env:
16+
# === Service-specific variables ===
17+
SERVICE_PATH: 'api-server-go'
18+
IMAGE_NAME: ${{ github.repository }}/api-server-go
19+
# ================================
20+
REGISTRY: ghcr.io
21+
22+
jobs:
23+
publish:
24+
runs-on: ubuntu-latest
25+
permissions:
26+
contents: read # To check out the code
27+
packages: write # To push images to GHCR
28+
29+
steps:
30+
- name: Checkout repository
31+
uses: actions/checkout@v4
32+
33+
- name: Log in to GitHub Container Registry
34+
uses: docker/login-action@v3
35+
with:
36+
registry: ${{ env.REGISTRY }}
37+
username: ${{ github.actor }}
38+
password: ${{ secrets.GITHUB_TOKEN }}
39+
40+
- name: Set up Docker Buildx
41+
uses: docker/setup-buildx-action@v3
42+
43+
- name: Extract metadata
44+
id: meta
45+
uses: docker/metadata-action@v5
46+
with:
47+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
48+
tags: |
49+
type=ref,event=branch
50+
type=semver,pattern={{version}}
51+
type=semver,pattern={{major}}.{{minor}}
52+
type=semver,pattern={{major}}
53+
type=sha,format=long
54+
type=raw,value=latest,enable={{is_default_branch}}
55+
labels: |
56+
org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
57+
org.opencontainers.image.description=API Server Go service for managing data exchange
58+
org.opencontainers.image.licenses=Apache-2.0
59+
60+
- name: Build and push Docker image
61+
id: build-push
62+
uses: docker/build-push-action@v5
63+
with:
64+
context: ${{ env.SERVICE_PATH }}
65+
push: true
66+
tags: ${{ steps.meta.outputs.tags }}
67+
labels: ${{ steps.meta.outputs.labels }}
68+
build-args: |
69+
SERVICE_PATH=${{ env.SERVICE_PATH }}
70+
BUILD_VERSION=${{ github.sha }}
71+
BUILD_TIME=${{ github.event.head_commit.timestamp || github.event.repository.pushed_at || '2025-01-01T00:00:00Z' }}
72+
GIT_COMMIT=${{ github.sha }}
73+
cache-from: type=gha
74+
cache-to: type=gha,mode=max

.github/workflows/build-api-server-go.yml renamed to .github/workflows/api-server-validate.yml

Lines changed: 33 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,10 @@
1-
name: Build and Push API Server Go Docker Image
1+
name: Validate API Server
22

33
on:
4-
push:
5-
branches:
6-
- main
7-
paths:
8-
- 'api-server-go/**'
9-
- '.github/workflows/build-api-server-go.yml'
10-
tags:
11-
- 'api-server-go-v*'
12-
- 'v*'
134
pull_request:
145
paths:
156
- 'api-server-go/**'
16-
- '.github/workflows/build-api-server-go.yml'
7+
- '.github/workflows/api-server-validate.yml'
178
workflow_dispatch:
189

1910
env:
@@ -28,14 +19,11 @@ env:
2819
TEST_DB_PASS: password
2920

3021
jobs:
31-
# ----------------------------------------------------
32-
# JOB 1: VALIDATE (Runs on PRs and on push)
33-
# ----------------------------------------------------
3422
validate:
3523
runs-on: ubuntu-latest
3624
permissions:
3725
contents: read # To check out the code
38-
security-events: write # To upload TruffleHog results
26+
security-events: write # To upload Trivy SARIF results
3927

4028
services:
4129
postgres:
@@ -56,6 +44,10 @@ jobs:
5644
- name: Checkout repository
5745
uses: actions/checkout@v4
5846

47+
- name: Set lowercase repository name
48+
id: repo
49+
run: echo "name=$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
50+
5951
- name: Set up Go
6052
uses: actions/setup-go@v5
6153
with:
@@ -86,70 +78,41 @@ jobs:
8678
TEST_DB_SSLMODE: disable
8779
run: cd ${{ env.SERVICE_PATH }} && go test ./... -count=1
8880

89-
- name: Scan repository for secrets (TruffleHog)
90-
uses: trufflesecurity/trufflehog@main
91-
with:
92-
path: ./
93-
base: ${{ github.event.before || 'main' }}
94-
head: HEAD
95-
extra_args: --only-verified
96-
97-
# ----------------------------------------------------
98-
# JOB 2: PUBLISH (Runs ONLY on push to main)
99-
# ----------------------------------------------------
100-
publish:
101-
runs-on: ubuntu-latest
102-
needs: [validate] # Depends on the 'validate' job
103-
if: github.event_name == 'push' # Only run this job on a push
104-
permissions:
105-
contents: read # To check out the code
106-
packages: write # To push images to GHCR
107-
security-events: write # To upload Trivy SARIF results
108-
109-
steps:
110-
- name: Checkout repository
111-
uses: actions/checkout@v4
112-
113-
- name: Log in to GitHub Container Registry
114-
uses: docker/login-action@v3
115-
with:
116-
registry: ${{ env.REGISTRY }}
117-
username: ${{ github.actor }}
118-
password: ${{ secrets.GITHUB_TOKEN }}
119-
12081
- name: Set up Docker Buildx
12182
uses: docker/setup-buildx-action@v3
12283

123-
- name: Extract metadata
124-
id: meta
125-
uses: docker/metadata-action@v5
126-
with:
127-
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
128-
tags: |
129-
type=ref,event=branch
130-
# Removed 'type=ref,event=pr' - this job only runs on push
131-
type=semver,pattern={{version}}
132-
type=semver,pattern={{major}}.{{minor}}
133-
type=semver,pattern={{major}}
134-
type=sha,format=long
135-
type=raw,value=latest,enable={{is_default_branch}}
136-
labels: |
137-
org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
138-
org.opencontainers.image.description=API Server Go service for managing data exchange
139-
org.opencontainers.image.licenses=Apache-2.0
140-
141-
- name: Build and push Docker image
142-
id: build-push
84+
- name: Build Docker image (validation only)
14385
uses: docker/build-push-action@v5
14486
with:
14587
context: ${{ env.SERVICE_PATH }}
146-
push: true
147-
tags: ${{ steps.meta.outputs.tags }}
148-
labels: ${{ steps.meta.outputs.labels }}
88+
push: false # Don't push, just validate build
89+
load: true # Load image locally for security scanning
90+
tags: ${{ env.REGISTRY }}/${{ steps.repo.outputs.name }}/api-server-go:pr-${{ github.event.pull_request.number || 'manual' }}
14991
build-args: |
15092
SERVICE_PATH=${{ env.SERVICE_PATH }}
15193
BUILD_VERSION=${{ github.sha }}
152-
BUILD_TIME=${{ github.event.head_commit.timestamp || github.event.repository.pushed_at || '2025-01-01T00:00:00Z' }}
94+
BUILD_TIME=${{ github.event.pull_request.updated_at || github.run_id || '2025-01-01T00:00:00Z' }}
15395
GIT_COMMIT=${{ github.sha }}
15496
cache-from: type=gha
15597
cache-to: type=gha,mode=max
98+
99+
- name: Run Trivy vulnerability scanner on Docker image
100+
uses: aquasecurity/trivy-action@master
101+
with:
102+
image-ref: ${{ env.REGISTRY }}/${{ steps.repo.outputs.name }}/api-server-go:pr-${{ github.event.pull_request.number || 'manual' }}
103+
format: 'sarif'
104+
output: 'trivy-results.sarif'
105+
106+
- name: Upload Trivy scan results to GitHub Security tab
107+
uses: github/codeql-action/upload-sarif@v3
108+
if: always()
109+
with:
110+
sarif_file: 'trivy-results.sarif'
111+
112+
- name: Scan repository for secrets (TruffleHog)
113+
uses: trufflesecurity/trufflehog@main
114+
with:
115+
path: ./
116+
base: ${{ github.event.before || 'main' }}
117+
head: HEAD
118+
extra_args: --only-verified

‎.github/workflows/audit-service-publish.yml‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
name: Publish Audit Service Image
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
paths:
8+
- 'audit-service/**'
9+
- '.github/workflows/audit-service-publish.yml'
10+
tags:
11+
- 'audit-service-v*'
12+
- 'v*'
13+
workflow_dispatch:
14+
15+
env:
16+
# === Service-specific variables ===
17+
SERVICE_PATH: 'audit-service'
18+
IMAGE_NAME: ${{ github.repository }}/audit-service
19+
# ================================
20+
REGISTRY: ghcr.io
21+
22+
jobs:
23+
publish:
24+
runs-on: ubuntu-latest
25+
permissions:
26+
contents: read # To check out the code
27+
packages: write # To push images to GHCR
28+
29+
steps:
30+
- name: Checkout repository
31+
uses: actions/checkout@v4
32+
33+
- name: Log in to GitHub Container Registry
34+
uses: docker/login-action@v3
35+
with:
36+
registry: ${{ env.REGISTRY }}
37+
username: ${{ github.actor }}
38+
password: ${{ secrets.GITHUB_TOKEN }}
39+
40+
- name: Set up Docker Buildx
41+
uses: docker/setup-buildx-action@v3
42+
43+
- name: Extract metadata
44+
id: meta
45+
uses: docker/metadata-action@v5
46+
with:
47+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
48+
tags: |
49+
type=ref,event=branch
50+
type=semver,pattern={{version}}
51+
type=semver,pattern={{major}}.{{minor}}
52+
type=semver,pattern={{major}}
53+
type=sha,format=long
54+
type=raw,value=latest,enable={{is_default_branch}}
55+
labels: |
56+
org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
57+
org.opencontainers.image.description=Audit Service for logging and tracking system events
58+
org.opencontainers.image.licenses=Apache-2.0
59+
60+
- name: Build and push Docker image
61+
id: build-push
62+
uses: docker/build-push-action@v5
63+
with:
64+
context: ${{ env.SERVICE_PATH }}
65+
push: true
66+
tags: ${{ steps.meta.outputs.tags }}
67+
labels: ${{ steps.meta.outputs.labels }}
68+
build-args: |
69+
SERVICE_PATH=${{ env.SERVICE_PATH }}
70+
BUILD_VERSION=${{ github.sha }}
71+
BUILD_TIME=${{ github.event.head_commit.timestamp || github.event.repository.pushed_at || '2025-01-01T00:00:00Z' }}
72+
GIT_COMMIT=${{ github.sha }}
73+
cache-from: type=gha
74+
cache-to: type=gha,mode=max

0 commit comments

Comments
 (0)