publish-azure-cc-enclave-docker.yaml

name: Publish Azure CC Operator
run-name: ${{ format('Publish {0} Azure CC Operator', inputs.release_type) }}
on:
  workflow_dispatch:
    inputs:
      release_type:
        type: choice
        description: The type of release
        options:
        - Snapshot
        - Patch
        - Minor
        - Major
      version_number_input:
        description: If set, the version number will not be incremented and the given number will be used.
        type: string
        default: ''
      vulnerability_severity:
        description: The severity to fail the workflow if such vulnerability is detected. DO NOT override it unless a Jira ticket is raised.
        type: choice
        options:
        - CRITICAL,HIGH
        - CRITICAL,HIGH,MEDIUM
        - CRITICAL (DO NOT use if JIRA ticket not raised)

  workflow_call:
    inputs:
      release_type:
        description: The type of version number to return. Must be one of [Snapshot, Patch, Minor or Major]
        required: true
        type: string
      version_number_input:
        description: If set, the version number will not be incremented and the given number will be used.
        type: string
        default: ''
      commit_sha:
        description: The commit SHA for committing the new version for pom.xml.
        type: string
        default: ''
      vulnerability_severity:
        description: The severity to fail the workflow if such vulnerability is detected. DO NOT override it unless a Jira ticket is raised. Must be one of ['CRITICAL', 'CRITICAL,HIGH' or 'CRITICAL,HIGH,MEDIUM'] (without space in between).
        type: string
        default: 'CRITICAL,HIGH'

    outputs:
      image_tag:
        description: The tag used to describe the image in Docker
        value: ${{ jobs.buildImage.outputs.image_tag }}

env:
  REGISTRY: ghcr.io
  MAVEN_PROFILE: azure
  ENCLAVE_PROTOCOL: azure-cc
  IMAGE_NAME: ${{ github.repository }}
  DOCKER_CONTEXT_PATH: scripts/azure-cc
  ARTIFACTS_OUTPUT_DIR: ${{ github.workspace }}/deployment-artifacts
  MANIFEST_OUTPUT_DIR: ${{ github.workspace }}/manifest

jobs:
  buildImage:
    name: Build Image
    runs-on: ubuntu-latest
    permissions:
      contents: write
      security-events: write
      packages: write
      id-token: write
      pull-requests: write
    outputs:
      jar_version: ${{ steps.update_version.outputs.new_version }}
      image_tag: ${{ steps.update_version.outputs.image_tag }}
    steps:
      - name: Update Operator Version
        id: update_version
        uses: IABTechLab/uid2-operator/.github/actions/update_operator_version@main
        with:
          release_type: ${{ inputs.release_type }}
          version_number_input: ${{ inputs.version_number_input }}
          image_tag_suffix: ${{ env.ENCLAVE_PROTOCOL }}
          commit_sha: ${{ inputs.commit_sha }}

      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '21'

      - name: Package JAR
        id: package
        run: |
          mvn -B package -P ${{ env.MAVEN_PROFILE }} 
          echo "jar_version=$(mvn help:evaluate -Dexpression=project.version | grep -e '^[1-9][^\[]')" >> $GITHUB_OUTPUT
          echo "git_commit=$(git show --format="%h" --no-patch)" >> $GITHUB_OUTPUT
          cp -r target ${{ env.DOCKER_CONTEXT_PATH }}/
          cp scripts/confidential_compute.py ${{ env.DOCKER_CONTEXT_PATH }}/

      - name: Log in to the Docker container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=raw,value=${{ steps.update_version.outputs.image_tag }}

      - name: Build and export to Docker
        uses: docker/build-push-action@v5
        with:
          context: ${{ env.DOCKER_CONTEXT_PATH }}
          load: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            JAR_VERSION=${{ steps.update_version.outputs.new_version }}
            IMAGE_VERSION=${{ steps.update_version.outputs.new_version }}
            BUILD_TARGET=${{ env.ENCLAVE_PROTOCOL }}

      - name: Generate Trivy vulnerability scan report
        uses: aquasecurity/trivy-action@0.14.0
        with:
          image-ref: ${{ steps.meta.outputs.tags }}
          format: 'sarif'
          exit-code: '0'
          ignore-unfixed: true
          severity: 'CRITICAL,HIGH'
          output: 'trivy-results.sarif'
          hide-progress: true

      - name: Upload Trivy scan report to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'

      - name: Test with Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@0.14.0
        with:
          image-ref: ${{ steps.meta.outputs.tags }}
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          severity: ${{ inputs.vulnerability_severity }}
          hide-progress: true

      - name: Push to Docker
        id: push-to-docker
        uses: docker/build-push-action@v5
        with:
          context: ${{ env.DOCKER_CONTEXT_PATH }}
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            JAR_VERSION=${{ steps.update_version.outputs.new_version }}
            IMAGE_VERSION=${{ steps.update_version.outputs.new_version }}

      - name: uninstall azure-cli 
        run: |
          sudo apt-get remove -y azure-cli
      
      - name: install azure-cli 2.61.0
        run: |
          sudo apt-get update
          sudo apt-get install apt-transport-https ca-certificates curl gnupg lsb-release
          sudo mkdir -p /etc/apt/keyrings
          curl -sLS https://packages.microsoft.com/keys/microsoft.asc |
            gpg --dearmor | sudo tee /etc/apt/keyrings/microsoft.gpg > /dev/null
          sudo chmod go+r /etc/apt/keyrings/microsoft.gpg
          AZ_DIST=$(lsb_release -cs)
          echo "Types: deb
          URIs: https://packages.microsoft.com/repos/azure-cli/
          Suites: ${AZ_DIST}
          Components: main
          Architectures: $(dpkg --print-architecture)
          Signed-by: /etc/apt/keyrings/microsoft.gpg" | sudo tee /etc/apt/sources.list.d/azure-cli.sources
          sudo apt-get update
          sudo apt-get install azure-cli

          apt-cache policy azure-cli
          # Obtain the currently installed distribution
          AZ_DIST=$(lsb_release -cs)
          # Store an Azure CLI version of choice
          AZ_VER=2.61.0
          # Install a specific version
          sudo apt-get install azure-cli=${AZ_VER}-1~${AZ_DIST} --allow-downgrades

      - name: check azure-cli version
        run: |
          az --version

      - name: Generate Azure deployment artifacts
        env:
          IMAGE: ${{ steps.meta.outputs.tags }}
          OUTPUT_DIR: ${{ env.ARTIFACTS_OUTPUT_DIR }}
          MANIFEST_DIR: ${{ env.MANIFEST_OUTPUT_DIR }}
          VERSION_NUMBER: ${{ steps.update_version.outputs.new_version }}
        run: |
          bash ./scripts/azure-cc/deployment/generate-deployment-artifacts.sh

      - name: Upload deployment artifacts
        uses: actions/upload-artifact@v4
        with:
          name: azure-cc-deployment-files-${{ steps.update_version.outputs.new_version }}
          path: ${{ env.ARTIFACTS_OUTPUT_DIR }}
          if-no-files-found: error

      - name: Upload manifest
        uses: actions/upload-artifact@v4
        with:
          name: azure-cc-enclave-id-${{ steps.update_version.outputs.new_version }}
          path: ${{ env.MANIFEST_OUTPUT_DIR }}
          if-no-files-found: error

      - name: Generate release archive
        if: ${{ inputs.version_number_input == '' && steps.update_version.outputs.is_release == 'true' }}
        run: |
          zip -j ${{ env.ARTIFACTS_OUTPUT_DIR }}/uid2-operator-deployment-artifacts-${{ steps.meta.outputs.version }}.zip ${{ env.ARTIFACTS_OUTPUT_DIR }}/*

      - name: Build changelog
        id: github_release
        if: ${{ inputs.version_number_input == '' && steps.update_version.outputs.is_release == 'true' }}
        uses: mikepenz/release-changelog-builder-action@v4
        with:
          configurationJson: |
            {
              "template": "#{{CHANGELOG}}\n## Installation\n```\ndocker pull ${{ steps.meta.outputs.tags }}\n```\n\n## Image reference to deploy: \n```\n${{ steps.update_version.outputs.image_tag }}\n```\n\n## Changelog\n#{{UNCATEGORIZED}}",
              "pr_template": " - #{{TITLE}} - ( PR: ##{{NUMBER}} )"
            }
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Create release
        if: ${{ inputs.version_number_input == '' && steps.update_version.outputs.is_release == 'true' }}
        uses: softprops/action-gh-release@v2
        with:
          name: ${{ steps.update_version.outputs.new_version }}
          body: ${{ steps.github_release.outputs.changelog }}
          draft: true
          files: |
            ${{ env.ARTIFACTS_OUTPUT_DIR }}/uid2-operator-deployment-artifacts-${{ steps.update_version.outputs.new_version }}.zip
            ${{ env.MANIFEST_OUTPUT_DIR }}/azure-cc-operator-digest-${{ steps.update_version.outputs.new_version }}.txt

  e2e:
    name: E2E
    uses: ./.github/workflows/run-e2e-tests-on-operator.yaml
    needs: buildImage
    with:
      operator_type: azure
      operator_image_version: ${{ needs.buildImage.outputs.image_tag }}
    secrets: inherit