push-main.yaml

name: Publish Main Version

on:
  push:
    branches:
      - main

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
        with:
          submodules: recursive
      -
        name: Set up npm for linting
        uses: actions/setup-node@v4
        with:
          node-version: 'latest'
      -
        name: Lint Markdown
        run: npm ci && npm run mdlint
      -
        name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      -
        name: Login to Quay.io Container Registry
        uses: docker/login-action@v3 
        with:
          registry: quay.io
          username: ${{ secrets.QUAYIO_USERNAME }}
          password: ${{ secrets.QUAYIO_TOKEN }}
      -
        name: Build Latest Version
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./Dockerfile
          build-args: |
            TRAINING_HUGO_ENV=puzzle
          push: true
          tags: |
            quay.io/puzzle/gitlab-ci-cd-training:latest
      -
        name: Run vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'quay.io/puzzle/gitlab-ci-cd-training:latest'
          format: 'table'
          output: 'trivy-results.txt'
          exit-code: '0'
          ignore-unfixed: true
          vuln-type: 'os'
          severity: 'CRITICAL,HIGH'
      -
        name: Archive vulnerability scan results
        uses: actions/upload-artifact@v4
        with:
          name: trivy-results-main
          path: trivy-results.txt
      -
        name: 'Install Helm'
        uses: azure/setup-helm@v4
        with:
          version: v3.6.2
      -
        name: Install Kubectl
        uses: azure/setup-kubectl@v4
        with:
          version: v1.21.2
      -
        name: Create KUBECONFIG
        env:
          KUBE_CONFIG: '${{ secrets.KUBECONFIG_PROD_AV2 }}'
        run: |
          mkdir -p $HOME/.kube
          echo "$KUBE_CONFIG" > $HOME/.kube/config
      -
        name: Deploy Helm Release
        env:
          TRAINING_HELM_RELEASE: 'latest'
          TRAINING_NAMESPACE: 'pitc-cicd-gitlab-ci-cd-training-prod'
          TRAINING_VERSION: '${{ github.sha }}'
        run: |
          helm upgrade $TRAINING_HELM_RELEASE acend-training-chart --install --wait \
            --kubeconfig $HOME/.kube/config \
            --namespace=$TRAINING_NAMESPACE \
            --set=app.name=$HELM_RELEASE \
            --set=app.version=$TRAINING_VERSION \
            --repo=https://acend.github.io/helm-charts/ \
            --values=helm-chart/values.yaml \
            --set-string=acendTraining.deployments[0].ingress.labels.public=true \
            --atomic
      -
        name: Redeploy Deployments
        env:
          TRAINING_HELM_RELEASE: 'latest'
          TRAINING_HELM_NAME: 'gitlab-ci-cd-training-puzzle'
          TRAINING_NAMESPACE: 'pitc-cicd-gitlab-ci-cd-training-prod'
        run: |
          kubectl rollout restart deployment/${TRAINING_HELM_RELEASE}-${TRAINING_HELM_NAME} \
            --kubeconfig $HOME/.kube/config \
            --namespace $TRAINING_NAMESPACE