dockerCI.yaml

name: Docker Image Build

on:
  pull_request:
    types: [opened, reopened, synchronize, closed]
    branches:
      - main

    paths-ignore:
    - 'docs/**'
    - '.devcontainer/**'
    - '**.md'
    - 'TestFiles/**'

  push:
    branches:
      - main

    paths-ignore:
    - 'docs/**'
    - '.devcontainer/**'
    - '**.md'
    - 'TestFiles/**'

    tags:
      - v*

jobs:

  build:

    runs-on: ubuntu-latest
    env:
      # copy the config value to environment variables
      # do not copy the actual secrets!

      KEYVAULT_NAME: ${{ secrets.KEYVAULT_NAME }}
      DOCKER_REPO: ${{ secrets.DOCKER_REPO }}
      ACR_REPO: ${{ secrets.ACR_REPO }}
      ACR_IMAGE: ${{ secrets.ACR_IMAGE }}
      ACR_REG: ${{ secrets.ACR_REG }}

      # These are used in if: conditions
      AZURE_SET: false
      DOCKER_SET: false
      ACR_SET: false

    steps:
    - uses: actions/checkout@v2

    - name: Set conditions
      run: |
        # check that all Azure secrets are set
        if [[ "${{ secrets.SERVICE_PRINCIPAL_SECRET }}" != "" && "${{ secrets.TENANT }}" != "" && "${{ secrets.SERVICE_PRINCIPAL }}" != "" && "${{ secrets.KEYVAULT_NAME }}" != "" ]];
        then
          echo "AZURE_SET=true" >> $GITHUB_ENV
        fi

        # check that all Docker secrets are set
        if [[ "${{ secrets.DOCKER_PAT }}" != "" && "${{ secrets.DOCKER_REPO }}" != "" && "${{ secrets.DOCKER_USER }}" != "" ]];
        then
          echo "DOCKER_SET=true" >> $GITHUB_ENV
        fi

        # check that all ACR secrets are set
        if [[ "${{ secrets.ACR_REG }}" != "" && "${{ secrets.ACR_REPO }}" != "" && "${{ secrets.ACR_IMAGE }}" != "" ]];
        then
          echo "ACR_SET=true" >> $GITHUB_ENV
        fi

    - name: PR Closed
      if: ${{ github.event_name == 'pull_request' && github.event.action == 'closed' && ! github.event.pull_request.merged }}

      run: |

        # handle PR Closed event by building / pushing main branch

        # checkout parent branch (usually "main")
        git config pull.ff only
        git fetch --all
        git checkout ${{ github.base_ref }}
        git pull

    - name: PR Merged
      if: ${{ github.event_name == 'pull_request' && github.event.action == 'closed' && github.event.pull_request.merged }}

      run: |

        # Do not build on PR Merged

        # Skip remaining steps
        echo "AZURE_SET=false" >> $GITHUB_ENV
        echo "DOCKER_SET=false" >> $GITHUB_ENV
        echo "ACR_SET=false" >> $GITHUB_ENV

    - name: Validate Azure Access
      if: ${{ env.AZURE_SET == 'true' }}
      run: |
        # login to Azure
        az login --service-principal -u ${{ secrets.SERVICE_PRINCIPAL }} --tenant ${{ secrets.TENANT }} -p ${{ secrets.SERVICE_PRINCIPAL_SECRET }}

        # verify SP has access to Key Vault
        az keyvault secret show --name CosmosDatabase --vault-name ${{ secrets.KEYVAULT_NAME }}

    - name: Docker Login
      if: ${{ env.DOCKER_SET == 'true' }}
      run: |
        # login to dockerhub
        echo "${{ secrets.DOCKER_PAT }}" | docker login -u ${{ secrets.DOCKER_USER }} --password-stdin

    - name: Docker Pull Test
      if: ${{ env.AZURE_SET == 'true' || env.DOCKER_SET == 'true' || env.ACR_SET == 'true' }}
      run: |
        # Pull the latest image if needed
        # This doesn't have to be a separate step, but makes the output easier to read and debug
        docker pull mcr.microsoft.com/dotnet/core/sdk:3.1

    - name: Docker Build Test
      if: ${{ env.AZURE_SET == 'true' }}
      run: |
        # build test image
        docker build . -t test --target test

    - name: Install WebV
      if: ${{ env.AZURE_SET == 'true' }}
      run: |
        dotnet tool install -g webvalidate

    - name: Start helium container
      if: ${{ env.AZURE_SET == 'true' }}
      run: |
        # run the app
        docker run -d --name hcs -p 4120:4120 --env KEYVAULT_NAME=$KEYVAULT_NAME --env AUTH_TYPE=CLI -v ~/.azure:/root/.azure test

        echo "Waiting for web server to start and run initial tests ..."
        sleep 25

    - name: Run WebV
      if: ${{ env.AZURE_SET == 'true' }}
      run: |
        # run web validation test
        # fail on any validation errors
        cd TestFiles
        webv -s localhost:4120 --max-errors 1 -f baseline.json
        cd ..

    - name: Display coverage results
      if: ${{ env.AZURE_SET == 'true' }}
      run: |
        # wait for helium to shutdown
        sleep 15

        # display the results
        docker logs hcs | tail -n 24

    - name: Display full test results
      if: ${{ env.AZURE_SET == 'true' }}
      run: |
        # display the results
        docker logs hcs

    - name: Docker Pull Release
      if: ${{ env.DOCKER_SET == 'true' || env.ACR_SET == 'true' }}
      run: |
        # Pull the latest image if needed
        docker pull mcr.microsoft.com/dotnet/core/aspnet:3.1-alpine

    - name: Docker Build Release
      if: ${{ env.DOCKER_SET == 'true' || env.ACR_SET == 'true' }}
      run: |
        # build image
        if [[ "${{ github.ref }}" == "refs/tags/"* ]]
        then
          docker build . -t helium --build-arg TAG=true
        else
          docker build . -t helium
        fi

    - name: Docker Tag and Push
      if: ${{ env.DOCKER_SET == 'true' }}
      run: |
        # tag the repo with :beta
        docker tag helium $DOCKER_REPO:beta

        # Tag image based on repo tag if a github label
        if [[ "${{ github.ref }}" == "refs/tags/"* ]]
        then

          # Strip git ref prefix from version
          VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,'  | sed -e 's/^v//')

          # tag the image with :version and :stable
          docker tag helium $DOCKER_REPO:$VERSION
          docker tag helium $DOCKER_REPO:stable
        fi

        # Push to the repo
        docker push -a $DOCKER_REPO

    - name: ACR Push
      if: ${{ env.ACR_SET == 'true' && env.AZURE_SET == 'true' }}
      run: |
        # login to acr
        az acr login -n $ACR_REG

        # build the complete image name
        ACR_IMAGE=$ACR_REG.azurecr.io/$ACR_REPO/$ACR_IMAGE

        # build release image
        docker tag helium $ACR_IMAGE:beta

        # Tag image based on repo tag if a github label
        if [[ "${{ github.ref }}" == "refs/tags/"* ]]
        then

          # Strip git ref prefix from version
          VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')

          # Strip "v" prefix from tag name
          VERSION=$(echo $VERSION | sed -e 's/^v//')

          # tag the image with :version and :stable
          docker tag helium $ACR_IMAGE:$VERSION
          docker tag helium $ACR_IMAGE:stable
        fi

        # push the repo
        docker push -a $ACR_IMAGE