dockers-helm-operator-image.yml

name: 'Build docker image: helm-operator'
on:
  push:
    branches:
      - master
    tags:
       - '*.*.*'
       - 'v*.*.*'
       - '*.*.*-*'
       - 'v*.*.*-*'
    paths:
      - 'dockers/operator/helm/Dockerfile'
      - 'charts/vald/Chart.yaml'
      - 'charts/vald/values.yaml'
      - 'charts/vald/templates/**'
      - 'charts/vald-helm-operator/Chart.yaml'
      - 'charts/vald-helm-operator/values.yaml'
      - 'charts/vald-helm-operator/templates/**'
      - 'versions/OPERATOR_SDK_VERSION'
  pull_request:
    paths:
      - 'dockers/operator/helm/Dockerfile'
      - 'charts/vald/Chart.yaml'
      - 'charts/vald/values.yaml'
      - 'charts/vald/templates/**'
      - 'charts/vald-helm-operator/Chart.yaml'
      - 'charts/vald-helm-operator/values.yaml'
      - 'charts/vald-helm-operator/templates/**'
      - 'versions/OPERATOR_SDK_VERSION'

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v1
      with:
        fetch-depth: 10
    - name: Build the Docker image
      run: |
        make docker/build/operator/helm
    - name: login to DockerHub
      run: |
        echo ${DOCKERHUB_PASS} | docker login --username ${DOCKERHUB_USER} --password-stdin
      env:
        DOCKERHUB_USER: ${{ secrets.DOCKERHUB_USER }}
        DOCKERHUB_PASS: ${{ secrets.DOCKERHUB_PASS }}
    - name: push to DockerHub (master)
      if: github.ref == 'refs/heads/master'
      run: |
        imagename=`make docker/name/operator/helm`
        docker tag ${imagename} ${imagename}:nightly
        docker push ${imagename}:nightly
    - name: push to DockerHub (pull request)
      if: github.event_name == 'pull_request'
      run: |
        imagename=`make docker/name/operator/helm`
        pr_num=`cat $GITHUB_EVENT_PATH | jq -r ".number"`
        docker tag ${imagename} ${imagename}:pr-${pr_num}
        docker push ${imagename}:pr-${pr_num}
    - name: push to DockerHub (tags)
      if: startsWith( github.ref, 'refs/tags/')
      id: push_to_dockerhub_tags
      run: |
        imagename=`make docker/name/operator/helm`
        docker push ${imagename}:latest
        tag_name=`echo $GITHUB_REF | sed -e 's:^refs/tags/::'`
        docker tag ${imagename} ${imagename}:${tag_name}
        docker push ${imagename}:${tag_name}
        docker tag ${imagename} ${imagename}:nightly
        docker push ${imagename}:nightly
        echo "::set-output name=IMAGE_NAME::${imagename}"
        echo "::set-output name=TAG_NAME::${tag_name}"
    - name: Initialize CodeQL
      if: startsWith( github.ref, 'refs/tags/')
      uses: github/codeql-action/init@v1
    - name: Run vulnerability scanner (table)
      if: startsWith( github.ref, 'refs/tags/')
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: "${{ steps.push_to_dockerhub_tags.outputs.IMAGE_NAME }}:${{ steps.push_to_dockerhub_tags.outputs.TAG_NAME }}"
        format: 'table'
    - name: Run vulnerability scanner (sarif)
      if: startsWith( github.ref, 'refs/tags/')
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: "${{ steps.push_to_dockerhub_tags.outputs.IMAGE_NAME }}:${{ steps.push_to_dockerhub_tags.outputs.TAG_NAME }}"
        format: 'template'
        template: '@/contrib/sarif.tpl'
        output: 'trivy-results.sarif'
    - name: Upload Trivy scan results to Security tab
      if: startsWith( github.ref, 'refs/tags/')
      uses: github/codeql-action/upload-sarif@v1
      with:
        sarif_file: 'trivy-results.sarif'
  slack:
    name: Slack notification
    needs: build
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/master' || startsWith( github.ref, 'refs/tags/')
    steps:
      - uses: technote-space/workflow-conclusion-action@v1
        with:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - uses: 8398a7/action-slack@v2
        with:
          author_name: helm-operator image build
          status: ${{ env.WORKFLOW_CONCLUSION }}
          only_mention_fail: channel
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_NOTIFY_WEBHOOK_URL }}