datawave/.github/workflows/deploy-datawave.yml

name: Deploy

on:
  push:
    paths-ignore: ['**/*.md', '.github/**', 'CODEOWNERS', 'LICENSE']
    tags:
      - "**"
    branches:
      - 'integration'
      - 'release/version*'
      - 'docker-images'
      - 'add-trivvy-scans'
  workflow_dispatch:

concurrency:
  group: ${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  packages: read
  security-events: write

# Defines two custom environment variables for the workflow. These are used for the Container registry domain, and a name for the Docker image that this workflow builds.
env:
  IMAGE_NAME: ${{ github.repository.lowercase }}
  JAVA_VERSION: '11'
  JAVA_DISTRIBUTION: 'zulu' #This is the default on v1 of the action for 1.8
  MAVEN_OPTS: "-Djansi.force=true -Dhttps.protocols=TLSv1.2 -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=WARN -Djava.awt.headless=true -XX:ThreadStackSize=1m -Daether.connector.basic.threads=8 -Daether.metadataResolver.threads=8 -Daether.syncContext.named.time=480"
  GITHUB_REGISTRY: ghcr.io
  GITHUB_USERNAME: ${{ secrets.GHCR_WRITE_USER_NAME }}
  GITHUB_PASSWORD: ${{ secrets.GHCR_WRITE_ACCESS_TOKEN }}

jobs:
  configure-runner:
    runs-on: ubuntu-latest
    steps:
      - id: set_output_step
        run: |
          echo "Determining runner to be ${{ vars.RUNNER_TYPE }}"
          echo "runner=${{ vars.RUNNER_TYPE }}" >> "$GITHUB_OUTPUT"
    outputs:
      runner: ${{ steps.set_output_step.outputs.runner }}

  deploy-packages-and-images:
    needs: configure-runner
    runs-on: ${{ needs.configure-runner.outputs.runner }}
    continue-on-error: true
    steps:
    - name: Set owner of working dir and m2 dir recursively
      # Compose can leave files owned by root on persistent runners.
      if: needs.configure-runner.outputs.runner == 'self-hosted'
      run: sudo chown -R $(whoami) . ~/.m2 || true
    - name: Log in to the Container registry
      uses: docker/login-action@v4
      with:
        registry: ${{ env.GITHUB_REGISTRY }}
        username: ${{ secrets.GHCR_WRITE_USER_NAME }}
        password: ${{ secrets.GHCR_WRITE_ACCESS_TOKEN }}
    - name: Checkout Code
      uses: actions/checkout@v6
    # Clean up free space
    - uses: ./.github/actions/free-space
      with:
        tool-cache: false
        # Preserve the Docker layer cache and images used by other jobs on persistent runners.
        docker-images: ${{ needs.configure-runner.outputs.runner != 'self-hosted' }}
    - name: Configure Maven Settings
      run: |
        mkdir -p ~/.m2
        cat > ~/.m2/settings.xml <<'EOF'
        <settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
               xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
               xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 https://maven.apache.org/xsd/settings-1.0.0.xsd">
        <servers>
         <server>
           <id>github-datawave</id>
           <username>${env.GITHUB_USERNAME}</username>
           <password>${env.GITHUB_PASSWORD}</password>
         </server>
        </servers>
        <mirrors>
         <mirror>
           <id>google-maven-central</id>
           <name>Google Cloud Maven Central Mirror</name>
           <url>https://maven-central.storage-download.googleapis.com/maven2/</url>
           <mirrorOf>central</mirrorOf>
         </mirror>
        </mirrors>
        </settings>
        EOF
    - name: Set up JDK ${{env.JAVA_VERSION}}
      uses: actions/setup-java@v5
      with:
        distribution: ${{env.JAVA_DISTRIBUTION}}
        java-version: ${{env.JAVA_VERSION}}
        cache: 'maven'
        overwrite-settings: false
    - name: Build and Push DataWave web/ingest images and packages
      run: |
        docker info
        MVN_CMD="mvn --show-version --batch-mode --errors --no-transfer-progress --fail-at-end clean deploy -Pkubernetes -Dmaven.build.cache.enabled=false -Dtar -Ddeploy -Ddist -Ddocker-release -Dutils -DskipTests -DskipFormat -DskipSpotbugs -Denforcer.skip=true -Dcheckstyle.skip=true"
        $MVN_CMD || {
          # On tag builds, release artifacts already exist in the registry from when the release was
          # cut. The resulting deploy conflict cascades and bans assemble-webservice, preventing the
          # Docker image push. Retry skipping Maven artifact deployment to at least push the images.
          if [[ "${{ github.ref_type }}" == "tag" ]]; then
            echo "Deploy failed on tag build; retrying with -Dmaven.deploy.skip=true to push Docker images"
            $MVN_CMD -Dmaven.deploy.skip=true
          else
            exit 1
          fi
        }
    - name: Build and Push microservice images
      run: |
        mvn --show-version --batch-mode --errors --no-transfer-progress --fail-at-end clean deploy -Dmaven.build.cache.enabled=false -Dmicroservice-docker -Dservices -Dstarters -DskipTests -DskipFormat -DskipSpotbugs -Denforcer.skip=true -Dcheckstyle.skip=true -Dmaven.deploy.skip=true

  scan-datawave-images:
    runs-on: ubuntu-latest
    needs: deploy-packages-and-images
    strategy:
      fail-fast: false
      matrix:
        include:
        - image: datawave/ingest-kubernetes
          category: trivy-ingest
          pom: pom.xml
        - image: datawave/webservice-kubernetes
          category: trivy-webservice
          pom: pom.xml
        - image: datawave/accumulo-service
          category: trivy-accumulo-service
          pom: microservices/services/accumulo/service/pom.xml
        - image: datawave/annotation-service
          category: trivy-annotation-service
          pom: microservices/services/annotation/service/pom.xml
        - image: datawave/annotation-cache-service
          category: trivy-annotation-cache-service
          pom: microservices/services/annotation-cache/service/pom.xml
        - image: datawave/audit-service
          category: trivy-audit-service
          pom: microservices/services/audit/service/pom.xml
        - image: datawave/authorization-service
          category: trivy-authorization-service
          pom: microservices/services/authorization/service/pom.xml
        - image: datawave/config-service
          category: trivy-config-service
          pom: microservices/services/config/pom.xml
        - image: datawave/dictionary-service
          category: trivy-dictionary-service
          pom: microservices/services/dictionary/service/pom.xml
        - image: datawave/file-provider-service
          category: trivy-file-provider-service
          pom: microservices/services/file-provider/service/pom.xml
        - image: datawave/hazelcast-service
          category: trivy-hazelcast-service
          pom: microservices/services/hazelcast/service/pom.xml
        - image: datawave/mapreduce-query-service
          category: trivy-mapreduce-query-service
          pom: microservices/services/mapreduce-query/service/pom.xml
        - image: datawave/modification-service
          category: trivy-modification-service
          pom: microservices/services/modification/service/pom.xml
        - image: datawave/query-service
          category: trivy-query-service
          pom: microservices/services/query/service/pom.xml
        - image: datawave/query-executor-service
          category: trivy-query-executor-service
          pom: microservices/services/query-executor/service/pom.xml
        - image: datawave/query-metric-service
          category: trivy-query-metric-service
          pom: microservices/services/query-metric/service/pom.xml
    steps:
    - name: Checkout Code
      uses: actions/checkout@v6
    - name: Configure Maven Settings
      run: |
        mkdir -p ~/.m2
        cat > ~/.m2/settings.xml <<'EOF'
        <settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
               xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
               xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 https://maven.apache.org/xsd/settings-1.0.0.xsd">
        <servers>
         <server>
           <id>github-datawave</id>
           <username>${env.GITHUB_USERNAME}</username>
           <password>${env.GITHUB_PASSWORD}</password>
         </server>
        </servers>
        <activeProfiles>
         <activeProfile>github-datawave</activeProfile>
        </activeProfiles>
        <mirrors>
         <mirror>
           <id>google-maven-central</id>
           <name>Google Cloud Maven Central Mirror</name>
           <url>https://maven-central.storage-download.googleapis.com/maven2/</url>
           <mirrorOf>central</mirrorOf>
         </mirror>
        </mirrors>
        </settings>
        EOF
    - name: Get image version
      id: project-version
      run: echo "version=$(mvn --batch-mode -f '${{ matrix.pom }}' help:evaluate -Dexpression=project.version -q -DforceStdout)" >> "$GITHUB_OUTPUT"
    - name: Log in to the Container registry
      uses: docker/login-action@v4
      with:
        registry: ${{ env.GITHUB_REGISTRY }}
        username: ${{ secrets.GHCR_WRITE_USER_NAME }}
        password: ${{ secrets.GHCR_WRITE_ACCESS_TOKEN }}
    - name: Scan ${{ matrix.image }} image
      uses: aquasecurity/[email protected]
      continue-on-error: true
      with:
        image-ref: '${{ env.GITHUB_REGISTRY }}/nationalsecurityagency${{ env.IMAGE_NAME }}/${{ matrix.image }}:${{ steps.project-version.outputs.version }}'
        format: sarif
        output: trivy-results.sarif
        severity: CRITICAL,HIGH
        ignore-unfixed: true
    - name: Report scan results
      if: always()
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: trivy-results.sarif
        category: ${{ matrix.category }}