build-centraldashboard.yml

name: component/centraldashboard
on:
  push:
    branches:
      - stc-master
    paths:
      - components/centraldashboard/**
  pull_request:
    types:
      - 'opened'
      - 'synchronize'
      - 'reopened'
  schedule: 
    - cron: '0 22 * * *'
# Environment variables available to all jobs and steps in this workflow
env:
  REGISTRY_NAME: k8scc01covidacr
  DEV_REGISTRY_NAME: k8scc01covidacrdev
  CLUSTER_NAME: k8s-cancentral-02-covid-aks
  CLUSTER_RESOURCE_GROUP: k8s-cancentral-01-covid-aks
  TRIVY_VERSION: "v0.43.1"
  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

jobs:
  build-push:
    runs-on: ubuntu-latest
    services:
      registry:
        image: registry:2
        ports:
          - 5000:5000
    steps:
    - uses: actions/checkout@v2

    # Determine if pushing to ACR or DEV ACR
    - name: Set ENV variables for a PR containing the auto-deploy tag
      if: github.event_name == 'pull_request' && contains( github.event.pull_request.labels.*.name, 'auto-deploy')
      run: echo "REGISTRY=${{env.DEV_REGISTRY_NAME}}.azurecr.io" >> "$GITHUB_ENV"
   
    - name: Set ENV variable for pushes to master
      if: github.event_name == 'push' && github.ref == 'refs/heads/stc-master'
      run: echo "REGISTRY=${{env.REGISTRY_NAME}}.azurecr.io" >> "$GITHUB_ENV"

    # Connect to Azure Container registry (ACR)
    - uses: azure/docker-login@v1
      with:
        login-server: ${{ env.REGISTRY_NAME }}.azurecr.io
        username: ${{ secrets.REGISTRY_USERNAME }}
        password: ${{ secrets.REGISTRY_PASSWORD }}

    # Connect to DEV Azure Container registry (ACR)
    - uses: azure/docker-login@v1
      with:
        login-server: ${{ env.DEV_REGISTRY_NAME }}.azurecr.io
        username: ${{ secrets.DEV_REGISTRY_USERNAME }}
        password: ${{ secrets.DEV_REGISTRY_PASSWORD }}

    # Container build to a Azure Container registry (ACR)
    - name: Docker build
      run: |
        docker build \
          -t localhost:5000/kubeflow/centraldashboard:${{ github.sha }} \
          --build-arg kubeflowversion=$(git describe --abbrev=0 --tags) \
          --build-arg commit=$(git rev-parse HEAD) \
          components/centraldashboard/
        docker push localhost:5000/kubeflow/centraldashboard:${{ github.sha }}
        docker image prune

    # Scan image for vulnerabilities
    - name: Aqua Security Trivy image scan
      run: |
        curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin ${{ env.TRIVY_VERSION }}
        trivy image localhost:5000/kubeflow/centraldashboard:${{ github.sha }} --exit-code 1 --timeout=20m --security-checks vuln --severity CRITICAL

    # Run Dockle
    - name: Run dockle
      uses: goodwithtech/dockle-action@main
      with:
        image: localhost:5000/kubeflow/centraldashboard:${{ github.sha }}
        format: 'list'
        exit-code: '0'
        exit-level: 'fatal'
        ignore: 'DKL-DI-0006'

    # Pushes if this is a push to master or an update to a PR that has auto-deploy label
    - name: Test if we should push to ACR
      id: should-i-push
      if: |
        github.event_name == 'push' ||
        (
          github.event_name == 'pull_request' &&
          contains( github.event.pull_request.labels.*.name, 'auto-deploy')
        )
      run: echo "::set-output name=boolean::true"

    - name: Docker push
      if: steps.should-i-push.outputs.boolean == 'true'
      run: |
        docker pull localhost:5000/kubeflow/centraldashboard:${{ github.sha }}
        docker tag localhost:5000/kubeflow/centraldashboard:${{ github.sha }} ${{ env.REGISTRY }}/kubeflow/centraldashboard:${{ github.sha }}
        docker push ${{ env.REGISTRY }}/kubeflow/centraldashboard:${{ github.sha }}

    - name: Slack Notification
      if: failure() && github.event_name=='schedule'
      uses: act10ns/slack@v1
      with: 
        status: failure
        message: kubeflow build failed. https://github.com/StatCan/kubeflow/actions/runs/${{github.run_id}}