cicd.yml

name: Authentication Microservice CICD

on:
  push:
    branches:
      - main
  pull_request:
    types: [ opened, synchronize, reopened ]

permissions: write-all

env:
  AWS_REGION: ${{ secrets.AWS_REGION }}
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
  ECR_REPOSITORY_URL: ${{ secrets.ECR_REPOSITORY_URL }}
  PROJECT_KEY: ${{ secrets.PROJECT_KEY }}
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
  IMAGE_NAME: ${{ secrets.ECR_REPOSITORY_URL }}:${{ github.sha }}
  LATEST_IMAGE_NAME: ${{ secrets.ECR_REPOSITORY_URL }}:latest
  API_GATEWAY_URL: ${{ secrets.API_GATEWAY_URL }}

jobs:
  tests:
    name: Unit tests
    runs-on: ubuntu-latest
    steps:
      # checkout the codes
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis

      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'temurin'
          check-latest: true
          cache: 'gradle'

      - name: Cache Gradle packages
        uses: actions/cache@v4
        with:
          path: ~/.gradle/caches
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle') }}
          restore-keys: ${{ runner.os }}-gradle

      # Run all unit tests
      - name: Run unit tests
        run: ./gradlew test

  build_and_push_image:
    needs: code_scan
    name: Push Docker Image to ECR
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build and Push Image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./Dockerfile
          push: true
          tags: |
            ${{ env.IMAGE_NAME }}
            ${{ env.LATEST_IMAGE_NAME }}

  deploy_to_ecs:
    name: Deploy to ECS
    needs: build_and_push_image
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Fill in the new image ID in the Amazon ECS task definition
        id: task-def
        uses: aws-actions/amazon-ecs-render-task-definition@v1
        with:
          task-definition: aws/task-definition.json
          container-name: auth-ms
          image: ${{ env.IMAGE_NAME }}

      - name: Deploy Amazon ECS task definition
        uses: aws-actions/amazon-ecs-deploy-task-definition@v1
        with:
          task-definition: ${{ steps.task-def.outputs.task-definition }}
          service: auth-ms
          cluster: quemistry-ms
          wait-for-service-stability: false

  code_scan:
    needs: tests
    name: Analyze with SonarCloud
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis

      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'temurin'
          check-latest: true
          cache: 'gradle'

      - name: Cache Gradle packages
        uses: actions/cache@v4
        with:
          path: ~/.gradle/caches
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle') }}
          restore-keys: ${{ runner.os }}-gradle

      - name: Cache SonarCloud packages
        uses: actions/cache@v4
        with:
          path: ~/.sonar/cache
          key: ${{ runner.os }}-sonar
          restore-keys: ${{ runner.os }}-sonar

      - name: Build and analyze
        run: ./gradlew build sonar --info

      - name: Get SonarCloud quality gate status
        run: |
          STATUS=$(curl -s -u "${{ env.SONAR_TOKEN }}": "https://sonarcloud.io/api/qualitygates/project_status?projectKey=${{ env.PROJECT_KEY }}" | jq -r .projectStatus.status)
          echo "Quality gate status is $STATUS"   
          if [[ "$STATUS" != "OK" ]]; then
          echo "Quality gate failed"
            exit 1
          fi

      - name: Upload Code Analysis Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: project-artifact
          path: |
            build/reports/

  zap_scan:
    if: false
    permissions: write-all
    needs: deploy_to_ecs
    runs-on: ubuntu-latest
    name: Zap Scan
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: main

      - name: ZAP Scan
        uses: zaproxy/action-full-scan@v0.10.0
        with:
          target: ${{ env.API_GATEWAY_URL }}