alpha.yaml

name: alpha

on:
  push:
    branches:
      - main

jobs:

  generate-tag:
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.get_tag.outputs.GIT_TAG }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Get tags
        id: get_tag
        uses: ./.github/actions/version-tag


  build-migrations-melange-packages:
    needs: [generate-tag]
    strategy:
      fail-fast: true
      matrix:
        runner: [
          {name: ubuntu-latest, arch: amd64},
          {name: arm64-runner-set, arch: arm64}
        ]
    runs-on: ${{ matrix.runner.name }}
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/build-custom-melange-package
        with:
          context: migrations/deploy
          component: kotsadm-migrations
          git-tag: ${{ needs.generate-tag.outputs.tag }}
          arch: ${{ matrix.runner.arch }}

  build-migrations:
    runs-on: ubuntu-latest
    needs: [generate-tag, build-migrations-melange-packages]
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/build-custom-image-with-apko
        with:
          context: migrations/deploy
          component: kotsadm-migrations
          git-tag: ${{ needs.generate-tag.outputs.tag }}
          image-name: index.docker.io/kotsadm/kotsadm-migrations:alpha
          registry-username: ${{ secrets.DOCKERHUB_USER }}
          registry-password: ${{ secrets.DOCKERHUB_PASSWORD }}


  build-kotsadm-melange-packages:
    needs: [generate-tag]
    strategy:
      fail-fast: true
      matrix:
        runner: [
          {name: ubuntu-latest, arch: amd64},
          {name: arm64-runner-set, arch: arm64}
        ]
    runs-on: ${{ matrix.runner.name }}
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/build-custom-melange-package
        with:
          context: deploy
          component: kotsadm
          git-tag: ${{ needs.generate-tag.outputs.tag }}
          arch: ${{ matrix.runner.arch }}

  build-kotsadm:
    runs-on: ubuntu-latest
    needs: [generate-tag, build-kotsadm-melange-packages]
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/build-custom-image-with-apko
        with:
          context: deploy
          component: kotsadm
          git-tag: ${{ needs.generate-tag.outputs.tag }}
          image-name: index.docker.io/kotsadm/kotsadm:alpha
          registry-username: ${{ secrets.DOCKERHUB_USER }}
          registry-password: ${{ secrets.DOCKERHUB_PASSWORD }}


  build-kurl-proxy-melange-packages:
    needs: [generate-tag]
    strategy:
      fail-fast: true
      matrix:
        runner: [
          {name: ubuntu-latest, arch: amd64},
          {name: arm64-runner-set, arch: arm64}
        ]
    runs-on: ${{ matrix.runner.name }}
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/build-custom-melange-package
        with:
          context: kurl_proxy/deploy
          component: kurl-proxy
          git-tag: ${{ needs.generate-tag.outputs.tag }}
          arch: ${{ matrix.runner.arch }}

  build-kurl-proxy:
    runs-on: ubuntu-latest
    needs: [generate-tag, build-kurl-proxy-melange-packages]
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/build-custom-image-with-apko
        with:
          context: kurl_proxy/deploy
          component: kurl-proxy
          git-tag: ${{ needs.generate-tag.outputs.tag }}
          image-name: index.docker.io/kotsadm/kurl-proxy:alpha
          registry-username: ${{ secrets.DOCKERHUB_USER }}
          registry-password: ${{ secrets.DOCKERHUB_PASSWORD }}


  scan_rqlite:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Read image tags from env file
        uses: falti/dotenv-action@v1
        id: dotenv
        with:
          path: .image.env
      - name: Scan rqlite for vulnerabilities
        id: scan
        uses: ./.github/actions/scan-image
        with:
          category-prefix: 'image-scan-'
          image-ref: "docker.io/kotsadm/rqlite:${{ steps.dotenv.outputs.RQLITE_TAG }}"
          only-fixed: 'true'
          output-file: 'rqlite-scan-output.sarif'
          retention-days: '90'
          severity-cutoff: 'medium'
          upload-sarif: 'true'
      - name: Print scan report
        if: ${{ !cancelled() }}
        run: cat rqlite-scan-output.sarif
      - name: Upload scan report
        if: ${{ !cancelled() }}
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: rqlite-scan-output.sarif


  scan_minio:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Read image tags from env file
        uses: falti/dotenv-action@v1
        id: dotenv
        with:
          path: .image.env
      - name: Scan minio for vulnerabilities
        id: scan
        uses: ./.github/actions/scan-image
        with:
          category-prefix: 'image-scan-'
          fail-build: 'false'
          image-ref: "docker.io/kotsadm/minio:${{ steps.dotenv.outputs.MINIO_TAG }}"
          only-fixed: 'true'
          output-file: 'minio-scan-output.sarif'
          retention-days: '90'
          severity-cutoff: 'medium'
          upload-sarif: 'true'
      - name: Print scan report
        if: ${{ !cancelled() }}
        run: cat minio-scan-output.sarif
      - name: Upload scan report
        if: ${{ !cancelled() }}
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: 'minio-scan-output.sarif'


  scan_dex:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Read image tags from env file
        uses: falti/dotenv-action@v1
        id: dotenv
        with:
          path: .image.env
      - name: Scan dex for vulnerabilities
        id: scan
        uses: ./.github/actions/scan-image
        with:
          category-prefix: 'image-scan-'
          fail-build: 'false'
          image-ref: "docker.io/kotsadm/dex:${{ steps.dotenv.outputs.DEX_TAG }}"
          only-fixed: 'true'
          output-file: 'dex-scan-output.sarif'
          retention-days: '90'
          severity-cutoff: 'medium'
          upload-sarif: 'true'
      - name: Print scan report
        if: ${{ !cancelled() }}
        run: cat dex-scan-output.sarif
      - name: Upload scan report
        if: ${{ !cancelled() }}
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: dex-scan-output.sarif


  scan_kurl_proxy:
    runs-on: ubuntu-latest
    needs: [build-kurl-proxy]
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Scan kurl-proxy for vulnerabilities
        id: scan
        uses: ./.github/actions/scan-image
        with:
          category-prefix: 'image-scan-'
          fail-build: 'false'
          image-ref: 'docker.io/kotsadm/kurl-proxy:alpha'
          only-fixed: 'true'
          output-file: 'kurl-proxy-scan-output.sarif'
          retention-days: '90'
          severity-cutoff: 'medium'
          upload-sarif: 'true'
      - name: Print scan report
        if: ${{ !cancelled() }}
        run: cat kurl-proxy-scan-output.sarif
      - name: Upload scan report
        if: ${{ !cancelled() }}
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: kurl-proxy-scan-output.sarif


  scan_local_volume_provider:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Read image tags from env file
        uses: falti/dotenv-action@v1
        id: dotenv
        with:
          path: .image.env
      - name: Scan replicated/local-volume-provider for vulnerabilities
        id: scan
        uses: ./.github/actions/scan-image
        with:
          category-prefix: 'image-scan-'
          fail-build: 'false'
          image-ref: "docker.io/replicated/local-volume-provider:${{ steps.dotenv.outputs.LVP_TAG }}"
          only-fixed: 'true'
          output-file: 'scan-output.sarif'
          retention-days: '90'
          severity-cutoff: 'medium'
          upload-sarif: 'true'
      - name: Print scan report
        if: ${{ !cancelled() }}
        run: cat scan-output.sarif
      - name: Upload scan report
        if: ${{ !cancelled() }}
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: scan-output.sarif


  scan_kotsadm:
    runs-on: ubuntu-latest
    needs: [build-kotsadm]
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Scan kotsadm for vulnerabilities
        id: scan
        uses: ./.github/actions/scan-image
        with:
          category-prefix: 'image-scan-'
          fail-build: 'true'
          image-ref: 'docker.io/kotsadm/kotsadm:alpha'
          only-fixed: 'true'
          output-file: 'kotsadm-scan-output.sarif'
          retention-days: '90'
          severity-cutoff: 'medium'
          upload-sarif: 'true'
      - name: Print scan report
        if: ${{ !cancelled() }}
        run: cat kotsadm-scan-output.sarif
      - name: Upload scan report
        if: ${{ !cancelled() }}
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: kotsadm-scan-output.sarif
          category: 'image-scan-kotsadm'

  scan_kotsadm_migrations:
    runs-on: ubuntu-latest
    needs: [build-migrations]
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Scan migrations for vulnerabilities
        id: scan
        uses: ./.github/actions/scan-image
        with:
          category-prefix: 'image-scan-'
          fail-build: 'true'
          image-ref: 'docker.io/kotsadm/kotsadm-migrations:alpha'
          only-fixed: 'true'
          output-file: 'kotsadm-migration-scan-output.sarif'
          retention-days: '90'
          severity-cutoff: 'medium'
          upload-sarif: 'true'
      - name: Print scan report
        if: ${{ !cancelled() }}
        run: cat kotsadm-migration-scan-output.sarif
      - name: Upload scan report
        if: ${{ !cancelled() }}
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: kotsadm-migration-scan-output.sarif