.reusable-ci.yml

name: ci

permissions: {}

on:
  workflow_call:
    inputs:
      skip_build:
        description: "Want to skip running certain build jobs 'none', 'non-required', 'all'?"
        type: string
        default: "all"
        required: false
      skip_compliance_checks:
        description: "Want to skip running certain compliance jobs 'none', 'non-required', 'all'?"
        type: string
        default: "all"
        required: false
      skip_unit_tests:
        description: "Want to skip running certain unit test jobs 'none', 'non-required', 'all'?"
        type: string
        default: "all"
        required: false
      skip_sast:
        description: "Want to skip running certain sast jobs 'none', 'non-required', 'all'?"
        type: string
        default: "all"
        required: false
      skip_sca:
        description: "Want to skip running certain sca jobs 'none', 'non-required', 'all'?"
        type: string
        default: "all"
        required: false
      skip_docs:
        description: "Want to skip running certain docs jobs 'none', 'non-required', 'all'?"
        type: string
        default: "all"
        required: false
      skip_integration_tests:
        description: "Want to skip running certain integration test jobs 'none', 'non-required', 'all'?"
        type: string
        default: "all"
        required: false
      output_type:
        description: 'Output either "sarif" (GITHUB_TOKEN with security-events:write) or print results as "table" and fail on error'
        type: string
        default: 'sarif'
        required: false

defaults:
  run:
    shell: bash

jobs:
  conditionals:
    runs-on: ubuntu-latest
    outputs:
      skip_build: ${{ steps.conditionals.outputs.skip_build }}
      skip_compliance_checks: ${{ steps.conditionals.outputs.skip_compliance_checks }}
      skip_unit_tests: ${{ steps.conditionals.outputs.skip_unit_tests }}
      skip_sast: ${{ steps.conditionals.outputs.skip_sast }}
      skip_sca: ${{ steps.conditionals.outputs.skip_sca }}
      skip_docs: ${{ steps.conditionals.outputs.skip_docs }}
      skip_integration_tests: ${{ steps.conditionals.outputs.skip_integration_tests }}
      output_type: ${{ steps.conditionals.outputs.output_type }}
    steps:
      - name: CI conditionals
        id: conditionals
        run: |
          echo "skip_build=${{ inputs.skip_build }}" >> ${GITHUB_OUTPUT}
          echo "skip_compliance_checks=${{ inputs.skip_compliance_checks }}" >> ${GITHUB_OUTPUT}
          echo "skip_unit_tests=${{ inputs.skip_unit_tests }}" >> ${GITHUB_OUTPUT}
          echo "skip_sast=${{ inputs.skip_sast }}" >> ${GITHUB_OUTPUT}
          echo "skip_sca=${{ inputs.skip_sca }}" >> ${GITHUB_OUTPUT}
          echo "skip_docs=${{ inputs.skip_docs }}" >> ${GITHUB_OUTPUT}
          echo "skip_integration_tests=${{ inputs.skip_integration_tests }}" >> ${GITHUB_OUTPUT}
          echo "output_type=${{ inputs.output_type }}" >> ${GITHUB_OUTPUT}
      - name: Show conditionals
        id: show_conditionals
        run: |
          get_output() { case "$1" in "none") echo ":heavy_check_mark:";; "non-required") echo ":warning:";; "all") echo ":x:";; *) echo "Unknown value";; esac; }
          echo "# :pencil: CI Settings" >> ${GITHUB_STEP_SUMMARY}
          echo "<table>" >> ${GITHUB_STEP_SUMMARY}
          echo "<tr><th>Setting</th><th>Value</th></tr>" >> ${GITHUB_STEP_SUMMARY}
          echo "<tr><td>Run Docs</td><td>$(get_output ${{ steps.conditionals.outputs.skip_docs }})</td></tr>" >> ${GITHUB_STEP_SUMMARY}
          echo "<tr><td>Run Build</td><td>$(get_output ${{ steps.conditionals.outputs.skip_build }})</td></tr>" >> ${GITHUB_STEP_SUMMARY}
          echo "<tr><td>Run Compliance</td><td>$(get_output ${{ steps.conditionals.outputs.skip_compliance_checks }})</td></tr>" >> ${GITHUB_STEP_SUMMARY}
          echo "<tr><td>Run Unit Tests</td><td>$(get_output ${{ steps.conditionals.outputs.skip_unit_tests }})</td></tr>" >> ${GITHUB_STEP_SUMMARY}
          echo "<tr><td>Run SAST</td><td>$(get_output ${{ steps.conditionals.outputs.skip_sast }})</td></tr>" >> ${GITHUB_STEP_SUMMARY}
          echo "<tr><td>Run SCA</td><td>$(get_output ${{ steps.conditionals.outputs.skip_sca }})</td></tr>" >> ${GITHUB_STEP_SUMMARY}
          echo "<tr><td>Run Integration Tests</td><td>$(get_output ${{ steps.conditionals.outputs.skip_integration_tests }})</td></tr>" >> ${GITHUB_STEP_SUMMARY}
          echo "<tr><td>Report type</td><td><code>${{ steps.conditionals.outputs.output_type }}</code></td></tr>" >> ${GITHUB_STEP_SUMMARY}
          echo "</table>" >> ${GITHUB_STEP_SUMMARY}
          echo "( $(get_output 'none') - run all jobs, $(get_output 'non-required') - run important/required jobs only, $(get_output 'all') - skip jobs)" >> ${GITHUB_STEP_SUMMARY}
          echo "" >> ${GITHUB_STEP_SUMMARY}

  build:
    uses: ./.github/workflows/.reusable-build.yml
    needs: [conditionals]
    permissions:
      id-token: write
      packages: write
    secrets: inherit
    with:
      skip: ${{ needs.conditionals.outputs.skip_build }}

  compliance:
    uses: ./.github/workflows/.reusable-compliance.yml
    needs: [conditionals]
    permissions:
      actions: read
      attestations: read
      checks: read
      contents: write
      deployments: read
      discussions: read
      id-token: write
      issues: read
      packages: read
      pages: read
      pull-requests: write
      repository-projects: read
      security-events: write
      statuses: read
    secrets: inherit
    with:
      skip: ${{ needs.conditionals.outputs.skip_compliance_checks }}
 
  unit-test:
    uses: ./.github/workflows/.reusable-unit-test.yml
    needs: [conditionals]
    permissions:
      checks: write
      pull-requests: write
    with:
      skip: ${{ needs.conditionals.outputs.skip_unit_tests }}

  sast:
    uses: ./.github/workflows/.reusable-sast.yml
    needs: [conditionals]
    permissions:
      pull-requests: read
      security-events: write
    with:
      skip: ${{ needs.conditionals.outputs.skip_sast }}
      output: ${{ needs.conditionals.outputs.output_type }}

  semgrep:
    uses: ./.github/workflows/semgrep.yml
    needs: [compliance]
    secrets: inherit

  sca:
    uses: ./.github/workflows/.reusable-sca.yml
    needs: [conditionals, build]
    permissions:
      contents: write
      packages: read
      security-events: write
    secrets: inherit
    with:
      registry: ${{ needs.build.outputs.build_registry }}
      repo_owner: ${{ github.repository_owner }}
      image: ${{ needs.build.outputs.build_image }}
      skip: ${{ needs.conditionals.outputs.skip_sca }}
      output: ${{ needs.conditionals.outputs.output_type }}

  docs:
    uses: ./.github/workflows/.reusable-docs.yml
    needs: [conditionals]
    permissions:
      contents: write
    with:
      skip: ${{ needs.conditionals.outputs.skip_docs }}

  integration-test:
    uses: ./.github/workflows/.reusable-integration-test.yml
    needs: [conditionals, build]
    permissions:
      packages: read
    secrets: inherit
    with:
      build_registry: ${{ needs.build.outputs.build_registry }}
      repo_owner: ${{ github.repository_owner }}
      build_image_repository: ${{ needs.build.outputs.build_registry }}/${{ needs.build.outputs.build_repo }}
      build_tag: ${{ needs.build.outputs.build_tag }}
      skip: ${{ needs.conditionals.outputs.skip_integration_tests }}