dev-workflow.yaml

name: Main workflow
on: 
  workflow_call:
    inputs:
      dockerfile-path:
        description: 'Path to the Dockerfile. Will be build from the root of the repository.'
        required: false
        default: 'Dockerfile'
        type: string
      docker-build-path:
        description: 'Build path for the Dockerfile.'
        required: false
        default: '.'
        type: string

env:
  BUILD_NUMBER: ${{ github.run_number }}
  GIT_REPO: ${{ github.repository }}
  GIT_REPO_URL: ${{ github.event.repository.clone_url }}
  IMAGE: ${{ github.repository_owner }}/${{ github.event.repository.name }}
  BUILD_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
  COMMIT_URL: ${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }}
  KOSLI_API_TOKEN: ${{ secrets.KOSLI_API_KEY }} # Set the Kosli API token as a secret in your repository
  KOSLI_ORG: kosli-public
  KOSLI_FLOW:  ${{ github.event.repository.name }}
  KOSLI_TRAIL: ${{ github.sha }} # Use the full Git SHA for the trail
  
jobs:
  Setup:
    runs-on: ubuntu-latest
    outputs:
      short_sha: ${{ steps.get_short_sha.outputs.short_sha }} # Output the short SHA for use in other jobs
    steps:
      - name: Clone down repository
        uses: actions/checkout@v4       
      - name: setup-kosli-cli
        uses: kosli-dev/setup-cli-action@v2
      - name: Kosli start trail
        uses: ./begin-trail-action
        with:
          build_id: ${{ env.BUILD_NUMBER}}
      - name: Tag kosli flow
        run: kosli tag flow ${{ env.KOSLI_FLOW }} --set kind=ci-pipeline
      - name: Get 8-character Git SHA Substring
        id: get_short_sha # Assign an ID to this step to reference its outputs
        uses: actions/github-script@v7 # Use the github-script action
        env:
          INPUT_SHA: ${{ github.sha }}
        with:
          script: |
            // Access the full Git SHA from the github context
            const fullSha = core.getInput('SHA');
            // Extract the first 8 characters
            const shortSha = fullSha.substring(0, 8);
            // Set the 'short_sha' as an output of this step
            core.setOutput('short_sha', shortSha);
            console.log(`Extracted short SHA: ${shortSha}`);
      - name: Upload repo
        uses: actions/upload-artifact@v4
        with: 
          name: code
          path: .
          include-hidden-files: true
  Unit-tests:
    runs-on: ubuntu-latest
    needs: [Setup]
    steps:
      - name: Download code
        uses: actions/download-artifact@v4
        with:
          name: code
          path: .
      - name: Download test-report
        uses: actions/download-artifact@v4
        with:
          name: test-results
          path: .
      - name: setup-kosli-cli
        uses: kosli-dev/setup-cli-action@v2
      - name: Attest unit tests
        run: kosli attest generic --name test-report --attachments report.xml

  Linting:
    runs-on: ubuntu-latest
    needs: [Setup]
    steps:
      - name: Download code
        uses: actions/download-artifact@v4
        with:
          name: code
          path: .
      - name: run linting
        uses: super-linter/super-linter/slim@v7 
        env:
          DEFAULT_BRANCH: main
          # To report GitHub Actions status checks
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} 
          DISABLE_ERRORS: true 
  Docker-image:
    runs-on: ubuntu-latest
    needs: [Setup]
    env:
      TAG: ${{ needs.Setup.outputs.short_sha }} # Use the short SHA from the Setup job
    permissions:
      packages: write
    steps:
    - name: setup-kosli-cli
      uses: kosli-dev/setup-cli-action@v2
    - name: Download code
      uses: actions/download-artifact@v4
      with:
        name: code
        path: .
    - name: Build application
      run: docker build -t "ghcr.io/${{env.IMAGE}}:latest" -t "ghcr.io/${{env.IMAGE}}:${{env.TAG}}" -f ${{ inputs.dockerfile-path }} ${{ inputs.docker-build-path }}
    - name: Login to GitHub Container Registry
      uses: docker/login-action@v3
      with:
        registry: ghcr.io
        username: ${{ github.repository_owner }}
        password: ${{ secrets.GITHUB_TOKEN }}
    - name: push docker
      run: docker push "ghcr.io/${{env.IMAGE}}:latest" && docker push "ghcr.io/${{env.IMAGE}}:${{env.TAG}}"
    - name: Attest docker image
      run: kosli attest artifact --artifact-type=docker --commit-url=${{env.COMMIT_URL}} --commit=${{ github.sha }} "ghcr.io/${{env.IMAGE}}:${{env.TAG}}" --build-url=${{ env.BUILD_URL }} --name=container

    - name: Generate SBOM for the docker image
      uses: anchore/sbom-action@v0
      with:
        image: ghcr.io/${{ env.IMAGE }}:${{env.TAG}}
        format: 'spdx-json'
        output-file: 'sbom.spdx.json'
        upload-artifact: false
    - name: Attest SBOM
      run: kosli attest generic --name container.sbom --attachments  sbom.spdx.json

  Security-scan:
    runs-on: ubuntu-latest
    needs: Docker-image
    steps:
    - name: Download code
      uses: actions/download-artifact@v4
      with:
        name: code
        path: .
    - name: Run Trivy vulnerability scanner
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: 'ghcr.io/${{ github.repository }}:latest'
        format: 'table'
        #exit-code: '1' #Defaults to 0 meaning that the action will not fail the build if vulnerabilities are found
        ignore-unfixed: true
        vuln-type: 'os,library'
        severity: 'CRITICAL,HIGH'
  otel-cicd-action:
    if: always()
    name: OpenTelemetry Export Trace
    runs-on: ubuntu-latest
    needs: [Security-scan] # must run when all jobs are completed
    steps:
      - name: Export workflow
        uses: corentinmusard/otel-cicd-action@v4
        with:
          otlpEndpoint: ingress.europe-west4.gcp.dash0.com:4317
          otlpHeaders: ${{ secrets.OTLP_HEADERS }}
          githubToken: ${{ secrets.GITHUB_TOKEN }}