ci.yml

---
# This workflow will build a Java project with Maven
# For more information see:
# https://help.github.com/actions/language-and-framework-guides/building-and-testing-java-with-maven

name: Java CI with Maven

env:
  JAVA: 17
  PRIVILEGED_RUN: ${{ (github.event_name == 'push' && github.ref == 'refs/heads/development') 
   || github.event.pull_request.head.repo.full_name == github.repository }}
  CODEQL_LANGUAGES: 'java' # FIXME(@JonasCir) add 'javascript'
on:
  push:
    branches: [ development, master, hotfix* ]
  pull_request:
    branches: [ development, hotfix* ]
  workflow_dispatch: # run it manually from the GH Actions web console
  schedule:
    - cron: '35 1 * * 0'
jobs:
  ci:
    name: SORMAS CI
    runs-on: ubuntu-latest
    permissions:
      security-events: write

    steps:
      - name: Checkout repository (with token)
        # Check if PR results from the repository: if yes, we have access to the secrets.
        # The token is only needed for privileged actions from within the repo, so no need
        # to make it available on 3rd party PRs
        if: ${{ fromJSON(env.PRIVILEGED_RUN) }}
        uses: actions/checkout@v3
        with:
          token: ${{ secrets.SORMAS_VITAGROUP_CI_TOKEN }}

      - name: Checkout repository (without token)
        # Check if PR results from a fork: if yes, we cannot access the token.
        # The token is only needed for privileged actions from within the
        # repo, so no need to make it available on 3rd party PRs
        if: ${{ !fromJSON(env.PRIVILEGED_RUN) }}
        uses: actions/checkout@v3

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v2
        with:
          languages: ${{ env.CODEQL_LANGUAGES }}

      - name: Set up JDK ${{ env.JAVA }}
        uses: actions/setup-java@v3
        with:
          java-version: ${{ env.JAVA }}
          distribution: 'zulu'

      - name: Cache Maven packages
        # Check if PR results from the repository: if yes, it is safe to cache dependencies.
        # This is to keep us safe from cache poisoning through 3rd party PRs.
        if: ${{ fromJSON(env.PRIVILEGED_RUN) }}
        uses: actions/cache@v3
        with:
          path: ~/.m2
          key: ${{ runner.os }}-java-${{ env.JAVA }}-m2-${{ hashFiles('**/pom.xml') }}
          restore-keys: ${{ runner.os }}-java-${{ env.JAVA }}-m2

      - name: Cache SonarCloud packages
        # Check if PR results from the repository: if yes, it is safe to cache dependencies.
        # This is to keep us safe from cache poisoning through 3rd party PRs.
        if: ${{ fromJSON(env.PRIVILEGED_RUN) }}
        uses: actions/cache@v3
        with:
          path: ~/.sonar/cache
          key: ${{ runner.os }}-sonar
          restore-keys: ${{ runner.os }}-sonar
      - name: Run mvn verify and sonar analysis
        # FIXME(@JonasCir) see https://github.com/sormas-foundation/SORMAS-Project/issues/3730#issuecomment-745165678
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        working-directory: ./sormas-base
        run: mvn -B -ntp verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey=SORMAS-Project

      - name: Comment with SonarCloud analysis
        uses: actions/github-script@v6
        if: github.event_name == 'pull_request'
        with:
          github-token: ${{ secrets.SORMAS_VITAGROUP_CI_TOKEN }}
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: `SonarCloud analysis: https://sonarcloud.io/dashboard?id=SORMAS-Project&pullRequest=${{ github.event.pull_request.number }}`
            })

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v2

      - name: Run Trivy vulnerability scanner in repo mode
        uses: aquasecurity/trivy-action@0.11.2
        with:
          scan-type: 'fs'
          ignore-unfixed: true
          format: 'sarif'
          output: 'trivy-results.sarif'
          scanners: 'vuln,secret,config'

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results.sarif'
          # needed as codeQL also performs an upload, and they clash otherwise
          category: 'code-scanning/trivy-repo'

      - name: Commit openAPI spec to development
        # Privileged action needing a secret token. Since this only runs on development in our own repo
        # the token will be available through a privileged checkout.
        if: github.event_name == 'push' && github.ref == 'refs/heads/development' 
         && hashFiles('sormas-rest/target/swagger.yaml') != hashFiles('sormas-rest/swagger.yaml')
        # https://stackoverflow.com/questions/59604922/authorize-bash-to-access-github-protected-branch
        run: |
            git config --global user.name "sormas-vitagroup"
            git config --global user.email "support.sormas@helpdesk.symeda.de"
          
            mkdir /tmp/openapi
            cp sormas-rest/target/swagger.* /tmp/openapi
            
            git fetch
            git checkout development
            git pull

            rm -f sormas-rest/swagger.*
            cp /tmp/openapi/swagger.* sormas-rest/

            git add sormas-rest/swagger.*
            git commit -m "[GitHub Actions] Update openAPI spec files"
            git push