ci-build.yml

name: Build

on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main

jobs:
  analyze-commits:
    runs-on: ubuntu-latest
    outputs:
      version-next: ${{ steps.next-version.outputs.release-version }}
      version-next-tag: ${{ steps.next-version.outputs.release-tag }}
      version-next-type: ${{ steps.next-version.outputs.release-type }}
    steps:
      - uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
        with:
          disable-sudo: true
          egress-policy: audit
          allowed-endpoints: >
            github.com:443
  
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #4.1.1
      
      - name: Setup Node
        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 #4.0.2
        with:
          node-version: 20
      
      - name: Install dependencies
        run: yarn global add semantic-release @semantic-release/changelog @semantic-release/git @semantic-release/github @semantic-release/exec @semantic-release/release-notes-generator @semantic-release/commit-analyzer conventional-changelog-conventionalcommits
      
      - name: Get next version
        id: next-version
        run: semantic-release --dryRun
        env:
          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
          GH_TOKEN: ${{ secrets.GH_TOKEN }}

  docker:
    uses: ./.github/workflows/docker-build-and-push-workflow.yml
    needs: analyze-commits
    secrets: inherit
    with:
      version: ${{ needs.analyze-commits.outputs.release-version }}
      publish: >- 
        ${{ (startsWith(github.ref, 'refs/tags/') ||
            github.ref == 'refs/heads/main') &&
            github.event_name == 'push' }}
      docker-image-repo: ${{ vars.DOCKER_IMAGE_REPOSITORY }}
      upload-sarif-to-security: >- 
        ${{ (startsWith(github.ref, 'refs/tags/') ||
          github.ref == 'refs/heads/main') &&
          github.event_name == 'push' }}

  release: 
    runs-on: ubuntu-latest
    needs:
      - docker
      - analyze-commits
    steps:
    - 
      name: Checkout
      uses: actions/checkout@v3
      with:
        token: ${{ secrets.GITHUB_TOKEN }}
    -
      name: Update BuildInfo.properties if there is a version
      run: /bin/bash .github/workflows/writeBuildInfo.sh ${{ needs.analyze-commits.outputs.release-version }}
    -
      name: Make JAR of configuration
      run: jar cvf /tmp/WebformulierenVerwerker.jar -C configurations WebformulierenVerwerker
    -
      name: "🔧 setup node"
      uses: actions/setup-node@v2.1.5
      with:
        node-version: 20.x
    - 
      name: Install dependencies
      run: yarn global add semantic-release @semantic-release/changelog @semantic-release/git @semantic-release/github @semantic-release/exec @semantic-release/release-notes-generator @semantic-release/commit-analyzer@10.0.1 conventional-changelog-conventionalcommits@6.1.0
    -
      name: Semantic Release
      run: "semantic-release"
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    -
      name: Pull commit that holds the newly created tag - if applicable
      run: git pull origin main
      if: github.ref == 'refs/heads/main'
    -
      name: Release on GitHub
      uses: softprops/action-gh-release@v1
      with:
        tag_name: v${{ needs.analyze-commits.outputs.release-version }}
        files: /tmp/WebformulierenVerwerker.jar
      if: >- 
        (startsWith(github.ref, 'refs/tags/') ||
            github.ref == 'refs/heads/main') &&
            github.event_name == 'push' &&
            needs.analyze-commits.outputs.release-version != '' &&
            needs.analyze-commits.outputs.release-version != null

  publish-docker:
    runs-on: ubuntu-latest
    needs:
    - release
    - analyze-commits
    if: >- 
      (startsWith(github.ref, 'refs/tags/') ||
          github.ref == 'refs/heads/main') &&
          github.event_name == 'push' &&
          needs.analyze-commits.outputs.release-version != '' &&
          needs.analyze-commits.outputs.release-version != null
    steps:
    -
      name: Show release version
      run: echo "Pushing docker image for version ${{ needs.analyze-commits.outputs.release-version }}"
    - 
      name: Checkout
      uses: actions/checkout@v3
      with: 
        token: ${{ secrets.GITHUB_TOKEN }}
    -  
      name: "Download Docker artifact"
      uses: actions/download-artifact@v2
      with:
        name: docker
        path: /tmp
    - 
      name: "Load Docker artifact"
      run: |
        docker load --input /tmp/docker.tar
        docker image ls -a
    - 
      name: Login to Container Registry
      uses: docker/login-action@v2
      if: github.event_name == 'push'
      with:
        username: ${{ secrets.DOCKER_USERNAME }}
        password: ${{ secrets.DOCKER_PASSWORD }}
    -
      name: Push Docker image
      run: docker push ${{ vars.DOCKER_IMAGE_REPOSITORY }} --all-tags