git commit -m "fix(ci): Repair build failure by adopting GHCR #5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Test PHP API Stack | |
| on: | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| jobs: | |
| lint: | |
| name: Lint Dockerfile | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run hadolint | |
| run: make lint | |
| build: | |
| name: Build and Push Image | |
| needs: lint | |
| runs-on: ubuntu-latest | |
| # Grant permissions for the GITHUB_TOKEN to push images to GHCR | |
| permissions: | |
| contents: read | |
| packages: write | |
| outputs: | |
| image_tag: ${{ steps.meta.outputs.tags }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Log in to the GitHub Container Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata (tags, labels) for Docker | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ghcr.io/${{ github.repository }} | |
| # This creates a unique tag based on the Git commit SHA | |
| tags: type=sha,prefix= | |
| - name: Create .env file for build | |
| run: cp .env.example .env | |
| - name: Build and push Docker image | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: . | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| # Enable Docker layer caching | |
| cache-from: type=gha,scope=${{ github.workflow }} | |
| cache-to: type=gha,scope=${{ github.workflow }},mode=max | |
| # This job now pulls the image directly from the registry | |
| test: | |
| name: Run Tests | |
| needs: build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Log in to the GitHub Container Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Pull image | |
| run: docker pull ${{ needs.build.outputs.image_tag }} | |
| - name: Run comprehensive tests | |
| # You may need to adapt your Makefile to accept the image tag as a parameter | |
| # For simplicity, we retag it to latest locally | |
| run: | | |
| docker tag ${{ needs.build.outputs.image_tag }} kariricode/php-api-stack:latest | |
| make test | |
| - name: Run integration tests | |
| run: | | |
| make run | |
| sleep 10 | |
| curl -f http://localhost:8080 | |
| curl -f http://localhost:8080/health | |
| make stop | |
| # Simplified test-health job | |
| test-health: | |
| name: Test Health Checks | |
| needs: build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Log in to the GitHub Container Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Pull image | |
| run: docker pull ${{ needs.build.outputs.image_tag }} | |
| - name: Retag image and run tests | |
| run: | | |
| docker tag ${{ needs.build.outputs.image_tag }} kariricode/php-api-stack:latest | |
| make build-test-image | |
| make run-test | |
| sleep 10 | |
| make test-health | |
| curl -s http://localhost:8080/health.php | jq '.status' | grep -q "healthy" | |
| make stop-test | |
| # Simplified security job | |
| security: | |
| name: Security Scan | |
| needs: build | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: read | |
| security-events: write # Required to upload SARIF results | |
| steps: | |
| - name: Run Trivy scan | |
| uses: aquasecurity/trivy-action@0.20.0 | |
| with: | |
| image-ref: ${{ needs.build.outputs.image_tag }} | |
| format: "sarif" | |
| output: "trivy-results.sarif" | |
| severity: "CRITICAL,HIGH" | |
| # GHCR is a private registry by default for the running workflow, so auth is needed | |
| github-pat: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Upload Trivy results | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: "trivy-results.sarif" |