prod.yml

name: Produksjon

on:
  release:
    types: [released]

env:
  APP: spinntektsmelding-frontend
  IMAGE: ghcr.io/${{ github.repository }}/spinntektsmelding-frontend-prod:${{ github.sha }}
  SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  NPM_AUTH_TOKEN: ${{ secrets.READER_TOKEN }}
  NODE_AUTH_TOKEN: ${{ secrets.READER_TOKEN }}

jobs:
  Kodekvalitet:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@master
      - uses: actions/setup-node@v4
        with:
          node-version: '22.x'
          registry-url: 'https://npm.pkg.github.com'
      - run: yarn install --immutable
      - run: yarn test
      - name: SonarCloud Scan
        uses: sonarsource/sonarcloud-github-action@master
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  Eslint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@master
      - uses: actions/setup-node@v4
        with:
          node-version: '22.x'
          registry-url: 'https://npm.pkg.github.com'
      - run: yarn install --immutable
      - run: yarn lint

  Docker:
    needs: [Kodekvalitet, Eslint]
    runs-on: ubuntu-latest
    permissions:
      packages: write
      contents: write # to write sarif
      security-events: write # push sarif to github security
    steps:
      - uses: actions/checkout@v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: |
            ${{ env.IMAGE }}
          secrets: |
            "NODE_AUTH_TOKEN=${{ secrets.READER_TOKEN }}"
          build-args: |
            "BUILDMODE=production"

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ env.IMAGE }}
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'HIGH,CRITICAL'
          limit-severities-for-sarif: true

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'

  Deploy:
    needs: [Docker]
    runs-on: ubuntu-latest
    permissions:
      packages: write
      id-token: write
    steps:
      - uses: actions/checkout@v4
      - uses: nais/deploy/actions/deploy@v2
        env:
          TEAM: helsearbeidsgiver
          CLUSTER: prod-gcp
          RESOURCE: naiserator.yaml
          VARS: nais/prod-gcp.json
          REF: ${{ env.COMMIT }}
          IMAGE: ${{ env.IMAGE }}