search-api-ci.yml

name: Search API CI

on:
  pull_request:
    paths:
      - "search-api/**"

defaults:
  run:
    shell: bash
    working-directory: ./search-api

jobs:
  setup-job:
    runs-on: ubuntu-20.04

    if: github.repository == 'bcgov/sbc-search'

    steps:
      - uses: actions/checkout@v2
      - run: "true"

  linting:
    needs: setup-job
    runs-on: ubuntu-20.04

    strategy:
      matrix:
        python-version: [3.9]

    steps:
      - uses: actions/checkout@v2
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v1
        with:
          python-version: ${{ matrix.python-version }}
      - name: Install dependencies
        run: |
          make setup
      - name: Lint with pylint
        id: pylint
        run: |
          make pylint
      - name: Lint with flake8
        id: flake8
        run: |
          make flake8

  testing:
    needs: setup-job
    env:
      SQLALCHEMY_DATABASE_URI: "postgresql://postgres:postgres@localhost:5432/postgres"
      IS_ORACLE: false

    runs-on: ubuntu-20.04

    services:
      postgres:
        image: postgres:12
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: postgres
        ports:
          - 5432:5432
        # needed because the postgres container does not provide a healthcheck
        options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5

    steps:
      - uses: actions/checkout@v2
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v1
        with:
          python-version: ${{ matrix.python-version }}
      - name: Install dependencies
        run: |
          make setup
      - name: Test with pytest
        id: test
        run: |
          make test
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v1
        with:
          file: ./search-api/coverage.xml
          flags: searchapi
          name: codecov-search-api
          fail_ci_if_error: true

  build-strictness:
    needs: setup-job
    runs-on: ubuntu-20.04

    env:
      DOCKER_NAME: search-api

    steps:
      - uses: actions/checkout@v2
      - name: build to check strictness
        id: build
        run: |
          make build-nc

      - name: export image
        id: export
        run: |
          docker save ${{ env.DOCKER_NAME }} > /tmp/${{ env.DOCKER_NAME }}.tar

      - name: Upload artifact
        uses: actions/upload-artifact@v2
        with:
          name: ${{ env.DOCKER_NAME }}
          path: /tmp/${{ env.DOCKER_NAME }}.tar

  vulnerability-scan:
    runs-on: ubuntu-latest
    needs: build-strictness

    env:
      DOCKER_NAME: search-api

    steps:
      - uses: actions/checkout@v2
      - name: Download artifact
        uses: actions/download-artifact@v2
        with:
          name: ${{ env.DOCKER_NAME }}
          path: /tmp
      - name: Load image
        run: |
          ls  -l /tmp
          docker load --input /tmp/${{ env.DOCKER_NAME }}.tar

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ env.DOCKER_NAME }}
          format: "table"
          exit-code: "1"
          ignore-unfixed: true
          vuln-type: "os,library"
          severity: "CRITICAL,HIGH"

      # delete-artifact
      - uses: geekyeggo/delete-artifact@v1
        with:
          name: ${{ env.DOCKER_NAME }}