commit.yml

---
name: "Commit"

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

env:
  python_version: "{{ cookiecutter.python_version }}"

defaults:
  run:
    shell: 'bash --noprofile --norc -Eeuo pipefail {0}'

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout the repository
        uses: actions/checkout@v3
      - name: Run the goat
        uses: seisollc/goat@main
        with:
          disable_mypy: true
  test:
    name: Test
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
        platform:
          - linux/amd64
          - linux/arm64
    steps:
      - name: Checkout the repository
        uses: actions/checkout@v3
        with:
          fetch-depth: 0
      - name: Setup python
        uses: actions/setup-python@v4
        with:
          python-version: ${{ "{{ env.python_version }}" }}
      - uses: actions/cache@v3
        with:
          path: ~/.local/share/virtualenvs
          key: ${{ "{{ runner.os }}" }}-python-${{ "{{ env.python_version }}" }}-pipenv-${{ "{{ hashFiles('Pipfile.lock') }}" }}
      - name: Install Task
        uses: arduino/setup-task@v1
      - name: Initialize the repo
        run: task -v init
      - name: Validate the repo
        run: task -v validate
      - name: Set up QEMU for cross-platform emulation
        uses: docker/setup-qemu-action@v2
      - name: Build the image(s)
        run: task -v build
        env:
          PLATFORM: ${{ "{{ matrix.platform }}" }}
      - name: Run the tests
        run: task -v test
        env:
          PLATFORM: ${{ "{{ matrix.platform }}" }}
      - name: Generate the SBOMs
        run: task -v sbom
        env:
          PLATFORM: ${{ "{{ matrix.platform }}" }}
      - name: Upload the SBOMs
        uses: actions/upload-artifact@v3
        with:
          name: SBOM
          path: sbom.*.json
          if-no-files-found: error
      - name: Generate vuln scan results
        run: task -v vulnscan
        env:
          PLATFORM: ${{ "{{ matrix.platform }}" }}
      - name: Upload the vuln scan results
        uses: actions/upload-artifact@v3
        with:
          name: Vulns
          path: vulns.*.json
          if-no-files-found: error
{%- if cookiecutter.versioning == "CalVer" %}
  bump-version:
    name: Bump version
    needs: [lint, test]
    if: "${{ "{{ github.event_name == 'push' && !startsWith(github.event.head_commit.message, 'Bump version: 2') }}" }}"
    permissions:
      contents: write
    runs-on: ubuntu-22.04
    outputs:
      tag: ${{ "{{ steps.bump-version.outputs.tag }}" }}
    steps:
      - name: Checkout the repository
        uses: actions/checkout@v3
        with:
          token: ${{ "{{ secrets.SEISO_AUTOMATION_PAT }}" }}
          fetch-depth: 0
      - name: Setup python
        uses: actions/setup-python@v4
        with:
          python-version: ${{ "{{ env.python_version }}" }}
      - uses: actions/cache@v3
        with:
          path: ~/.local/share/virtualenvs
          key: ${{ "{{ runner.os }}" }}-python-${{ "{{ env.python_version }}" }}-pipenv-${{ "{{ hashFiles('Pipfile.lock') }}" }}
      - name: Install Task
        uses: arduino/setup-task@v1
      - name: Initialize the repo
        run: task -v init
      - name: Bump the version
        id: bump-version
        run: |
          task -v release
          TAG="$(git describe --tags)"
          BRANCH="$(git branch --show-current)"
          git push --atomic origin "${BRANCH}" "${TAG}"
          echo "tag=${TAG}" >> "${GITHUB_OUTPUT}"
      - name: Download the SBOMs and Vuln scan results
        uses: actions/download-artifact@v3
        with:
          path: ${{ "{{ runner.temp }}" }}
      - name: Publish the release to GitHub
        uses: softprops/action-gh-release@v1
        env:
          GITHUB_TOKEN: ${{ "{{ secrets.GITHUB_TOKEN }}" }}
        with:
          name: ${{ "{{ steps.bump-version.outputs.tag }}" }}
          tag_name: ${{ "{{ steps.bump-version.outputs.tag }}" }}
          generate_release_notes: true
          files: |
            ${{ "{{ runner.temp }}" }}/Vulns/vulns.*.json
            ${{ "{{ runner.temp }}" }}/SBOM/sbom.*.json
          draft: false
          prerelease: false
{%- endif -%}
{%- if cookiecutter.dockerhub == 'yes' %}
  distribute:
    name: Distribute
    runs-on: ubuntu-22.04
    needs: [bump-version]
    if: ${{ "{{ github.event_name == 'push' }}" }}
    steps:
      - name: Checkout the repository
        uses: actions/checkout@v3
        with:
          ref: ${{ "{{ needs.bump-version.outputs.tag }}" }}
      - name: Setup python
        uses: actions/setup-python@v4
        with:
          python-version: ${{ "{{ env.python_version }}" }}
      - uses: actions/cache@v3
        with:
          path: ~/.local/share/virtualenvs
          key: ${{ "{{ runner.os }}" }}-python-${{ "{{ env.python_version }}" }}-pipenv-${{ "{{ hashFiles('Pipfile.lock') }}" }}
      - name: Install Task
        uses: arduino/setup-task@v1
      - name: Initialize the repo
        run: task -v init
      - name: Log in to Docker Hub
        uses: docker/login-action@v2
        with:
          username: ${{ "{{ secrets.DOCKERHUB_USERNAME }}" }}
          password: ${{ "{{ secrets.DOCKERHUB_TOKEN }}" }}
      - name: Publish the release README to Docker Hub
        uses: peter-evans/dockerhub-description@v3
        with:
          username: ${{ "{{ secrets.DOCKERHUB_USERNAME }}" }}
          password: ${{ "{{ secrets.DOCKERHUB_TOKEN }}" }}
          repository: seiso/{{ cookiecutter.project_slug }}
          short-description: {{ cookiecutter.project_short_description }}
      - name: Set up QEMU for cross-platform emulation
        uses: docker/setup-qemu-action@v2
      - name: Build and publish all the supported images to Docker Hub
        run: task -v publish
        env:
          PLATFORM: all
{%- endif -%}