Review CI Workflow

name: CI

on:
  pull_request:
    branches: [main]
    types: [opened, synchronize, reopened]
    paths-ignore:
      - docs/**
      - docker-compose.dev.yml

  merge_group:
    branches: [main]

  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  id-token: write
  contents: read

env:
  CI_IMAGE_NAME: localbuild/ci-image/latest

jobs:
  unit-test:
    name: Run unit tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up JDK ${{ vars.JAVA_VERSION }}
        uses: actions/setup-java@v4
        with:
          java-version: ${{ vars.JAVA_VERSION }}
          distribution: ${{ vars.JAVA_DISTRIBUTION }}

      - uses: actions/cache@v4
        name: Cache dependencies
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper            
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
          restore-keys: |
            ${{ runner.os }}-gradle-            

      - name: Run unit tests
        run: |
          chmod +x gradlew
          ./gradlew test          

      - if: ${{ !cancelled() }}
        name: Upload unit test report
        uses: actions/upload-artifact@v4
        with:
          name: unit-test-report
          path: build

  integration-test:
    name: Run integration tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up JDK ${{ vars.JAVA_VERSION }}
        uses: actions/setup-java@v4
        with:
          java-version: ${{ vars.JAVA_VERSION }}
          distribution: ${{ vars.JAVA_DISTRIBUTION }}

      - uses: actions/cache@v4
        name: Cache dependencies
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper            
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
          restore-keys: |
            ${{ runner.os }}-gradle-            

      - name: Run integration tests
        run: |
          chmod +x gradlew
          ./gradlew integrationTest          

      - if: ${{ !cancelled() }}
        name: Upload integration test report
        uses: actions/upload-artifact@v4
        with:
          name: integration-test-report
          path: build

  scan-source-code:
    name: Scan source code
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up JDK ${{ vars.JAVA_VERSION }}
        uses: actions/setup-java@v4
        with:
          java-version: ${{ vars.JAVA_VERSION }}
          distribution: ${{ vars.JAVA_DISTRIBUTION }}

      - uses: actions/cache@v4
        name: Cache dependencies
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper            
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
          restore-keys: |
            ${{ runner.os }}-gradle-            

      - name: Run build
        run: |
          chmod +x gradlew
          ./gradlew build -x test          

      - name: Code vulnerability scanning
        uses: anchore/scan-action@v3
        id: scan
        with:
          path: ${{ github.workspace }}
          fail-build: false
          severity-cutoff: high

      - if: ${{ !cancelled() }}
        name: Upload vulnerability report
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ steps.scan.outputs.sarif }}
          category: source-code-scanning-report

  build-image:
    name: Build image
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build image for vulnerability scanning
        uses: docker/build-push-action@v5
        with:
          context: .
          target: production
          load: true
          tags: ${{ env.CI_IMAGE_NAME }}
          outputs: type=docker,dest=/tmp/prepared-image.tar

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: prepared-image
          path: /tmp/prepared-image.tar

  scan-image:
    name: Scan image
    needs: [build-image]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Download artifact
        uses: actions/download-artifact@v4
        with:
          name: prepared-image
          path: /tmp

      - name: Load image
        run: docker load --input /tmp/prepared-image.tar

      - name: OCI image vulnerability scanning
        uses: anchore/scan-action@v3
        id: scan
        with:
          image: ${{ env.CI_IMAGE_NAME }}
          fail-build: false
          severity-cutoff: high

      - if: ${{ !cancelled() }}
        name: Upload vulnerability report
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ steps.scan.outputs.sarif }}
          category: image-scanning-report