github-actions.yml

# This is a basic workflow to help you get started with Actions
name: Build & Deploy - Dev

# Controls when the action will run. Invokes the workflow on push events but only for the main branch
on:
  push:
    branches: [5165-cicd]
  pull_request:
    branches: [5165-cicd]

env:
  ENVIRONMENT: development
  ECR_REPOSITORY: test  # set this to your Amazon ECR repository name
  ECS_SERVICE: geonetwork4-service #MY_ECS_SERVICE                 # set this to your Amazon ECS service name
  ECS_CLUSTER: aodn-imos-v2                 # set this to your Amazon ECS cluster name
  ECS_TASK_DEFINITION: ./geonetwork4-td.json     #MY_ECS_TASK_DEFINITION # set this to the path to your Amazon ECS task definition
  CONTAINER_NAME: geonetwork4-container     # set this to the name of the container in the
  CA_DOMAIN: test
  CA_DOMAIN_OWNER: test
  CA_REPO: test
  CA_PACKAGE: test
  CA_NAMESPACE: test
  
             
# Permission can be added at job level or workflow level
permissions:
  id-token: write   # This is required for requesting the JWT
  contents: read    # This is required for actions/checkout

jobs:
  build-deploy:
    runs-on: ubuntu-latest
    environment: development
    steps:
      - name: Git clone the repository
        uses: actions/checkout@v3

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.ROLE_ARN }}
          role-session-name: GitHub_to_AWS_via_FederatedOIDC
          aws-region: ${{ vars.AWS_REGION }}

      # Hello from AWS: WhoAmI
      - name: Sts GetCallerIdentity
        run: |
          aws sts get-caller-identity
          
      - name: Install jq
        run: sudo apt-get update && sudo apt-get install -y jq
  
      - name: Retrieve Parameters - ssm parameter store
        id: getParameters
        run: |
          # Replace '--path' with your specific path from Parameter Store
          parameters=$(aws ssm get-parameters-by-path --path "/core/geonetwork4/dev_ecr_ecs_config/" --recursive --query 'Parameters[*].[Name,Value]' --output json)
          echo "$parameters" > parameters.json
          echo "::set-output name=parameters_json::$parameters"
        
      - name: Process Parameters - ssm parameter store
        run: |
          parameters=$(cat parameters.json)
          # Loop through the JSON array of parameters using jq
          for row in $(echo "${parameters}" | jq -r '.[] | @base64'); do
            _jq() {
              echo "${row}" | base64 --decode | jq -r "${1}"
            }
            name=$(_jq '.[0]')
            value=$(_jq '.[1]')

            echo "Name: $name, Value: $value"

            # Perform actions using parameter values here
            # For example, set environment variables
            if [ "$name" = "/core/geonetwork4/dev_ecr_ecs_config/ecr_repo" ]; then
              echo "ECR_REPOSITORY=$value" >> "$GITHUB_ENV"
            fi
            if [ "$name" = "/core/geonetwork4/dev_ecr_ecs_config/ecs_cluster" ]; then
              echo "ECS_CLUSTER=$value" >> "$GITHUB_ENV"
            fi
            if [ "$name" = "/core/geonetwork4/dev_ecr_ecs_config/ecs_service" ]; then
              echo "ECS_SERVICE=$value" >> "$GITHUB_ENV"
            fi
            if [ "$name" = "/core/geonetwork4/dev_ecr_ecs_config/container_name" ]; then
              echo "CONTAINER_NAME=$value" >> "$GITHUB_ENV"
            fi
            if [ "$name" = "/core/geonetwork4/dev_ecr_ecs_config/ca_domain" ]; then
              echo "CA_DOMAIN=$value" >> "$GITHUB_ENV"
            fi
            if [ "$name" = "/core/geonetwork4/dev_ecr_ecs_config/ca_domain_owner" ]; then
              echo "CA_DOMAIN_OWNER=$value" >> "$GITHUB_ENV"
            fi
            if [ "$name" = "/core/geonetwork4/dev_ecr_ecs_config/ca_repo" ]; then
              echo "CA_REPO=$value" >> "$GITHUB_ENV"
            fi
            if [ "$name" = "/core/geonetwork4/dev_ecr_ecs_config/ca_package" ]; then
              echo "CA_PACKAGE=$value" >> "$GITHUB_ENV"
            fi
            if [ "$name" = "/core/geonetwork4/dev_ecr_ecs_config/ca_namespace" ]; then
              echo "CA_NAMESPACE=$value" >> "$GITHUB_ENV"
            fi
          done
          
      - name: Prepare Build-ID
        id: prep
        run: |
          BRANCH=${GITHUB_REF##*/}
          TS=$(date +%F%H%M%S | sed 's/-//g')
          echo "TimeStamp=$TS"
          REVISION=${GITHUB_SHA::8}
          BUILD_ID="${BRANCH}-${REVISION}-${TS}"
          LATEST_ID=canary
          if [[ $GITHUB_REF == refs/tags/* ]]; then
            BUILD_ID=${GITHUB_REF/refs\/tags\//}
            LATEST_ID=latest
          fi
          echo "BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
          echo "LATEST_ID=$LATEST_ID"
          echo "BUILD_ID=$BUILD_ID" >> $GITHUB_OUTPUT

      - name: Get and calculate latest package version - AWS CodeArtifact
        id: ca-getversion
        env:
          BUILD_ID: ${{ steps.prep.outputs.BUILD_ID }}
        run: |
          FLAG_INITIAL=false
          
          CURRENT_VERSION=$(aws codeartifact list-package-versions --domain $CA_DOMAIN --repository $CA_REPO --format generic --package $CA_PACKAGE --namespace $CA_NAMESPACE --query defaultDisplayVersion | jq -r ".")
          echo "current version: $CURRENT_VERSION"
          
          if [ -z "$CURRENT_VERSION" ] || [ "$CURRENT_VERSION" == "null" ]; then
            CURRENT_VERSION="1.0.0"
            FLAG_INITIAL=true
          fi
          IFS='.' read -ra version_parts <<< "$CURRENT_VERSION"
          MAJOR=${version_parts[0]}
          MINOR=${version_parts[1]}
          NEW_MINOR=$((MINOR + 1))
          if [ "$FLAG_INITIAL" == "true" ]; then
            NEW_MINOR="0"
          fi
          
          #version format[major.minor.build_number] 
          #build_number format{BRANCH}-${REVISION}-${TS}
          echo "latest_version=v$MAJOR.$NEW_MINOR.${{ env.BUILD_ID }}" >> $GITHUB_OUTPUT

      - name: Checkout
        uses: actions/checkout@v3
      
      - name: Set up JDK 17
        uses: actions/setup-java@v3
        with:
          distribution: 'temurin'
          java-version: '17'
          cache: 'maven'
          
      - name: Build with Maven
        run: mvn -B package --file pom.xml
      
      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build and tag image
        id: build-image
        env:
          IMAGE_TAG: ${{ steps.ca-getversion.outputs.latest_version }}
        run: |
          # Build a docker container and
          # be deployed to ECS.
          # docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG .
          # echo "image=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" >> $GITHUB_OUTPUT
          # aws ecr get-login-password --region ap-southeast-2 | docker login --username AWS --password-stdin $ACCOUNT_ID
          docker build -t $ECR_REPOSITORY:$IMAGE_TAG .
          echo "image=$ECR_REPOSITORY:$IMAGE_TAG" >> $GITHUB_OUTPUT

      - name: Run Trivy vulnerability scanner in docker mode
        uses: aquasecurity/trivy-action@master
        with:
            image-ref: ${{ steps.build-image.outputs.image }}
            format: 'table'
            severity: 'HIGH,CRITICAL'
            vuln-type: 'os,library'
            exit-code: 1
            ignore-unfixed: true
        continue-on-error: true
      
      - name: Push image to Amazon ECR
        id: push-image
        env:
          IMAGE_TAG: ${{ steps.ca-getversion.outputs.latest_version }}
        run: |
          # Build a docker container and
          # be deployed to ECS.
          # docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG .
          # echo "image=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" >> $GITHUB_OUTPUT
          # aws ecr get-login-password --region ap-southeast-2 | docker login --username AWS --password-stdin $ACCOUNT_ID
          docker push $ECR_REPOSITORY:$IMAGE_TAG
          echo "image=$ECR_REPOSITORY:$IMAGE_TAG" >> $GITHUB_OUTPUT

      - name: Fill in the new image ID in the Amazon ECS task definition
        id: task-def
        uses: aws-actions/amazon-ecs-render-task-definition@v1
        with:
          task-definition: ${{ env.ECS_TASK_DEFINITION }}
          container-name: ${{ env.CONTAINER_NAME }}
          image: ${{ steps.push-image.outputs.image }}
          environment-variables: |
            IMAGE=${{ steps.push-image.outputs.image }}
            ES_HOST=${{ vars.ES_HOST }}
            ES_PROTOCOL=${{ vars.ES_PROTOCOL }}
            ES_PORT=${{ vars.ES_PORT }}
            ES_USERNAME=${{ vars.ES_USERNAME }}
            ES_PASSWORD=${{ secrets.ES_PASSWORD }}
            GEONETWORK_DB_PASSWORD=${{ secrets.GEONETWORK_DB_PASSWORD }}

            GEONETWORK_DB_TYPE=${{ vars.GEONETWORK_DB_TYPE }}
            GEONETWORK_DB_HOST=${{ vars.GEONETWORK_DB_HOST }}
            GEONETWORK_DB_PORT=${{ vars.GEONETWORK_DB_PORT }}
            GEONETWORK_DB_NAME=${{ vars.GEONETWORK_DB_NAME }}
            GEONETWORK_DB_USERNAME=${{ vars.GEONETWORK_DB_USERNAME }}

            INDEXER_HOST=${{ vars.INDEXER_HOST }}
            INDEXER_PORT=${{ vars.INDEXER_PORT }}
            INDEXER_APIKEY=${{ secrets.INDEXER_APIKEY }}
            
      - name: Deploy Amazon ECS task definition
        uses: aws-actions/amazon-ecs-deploy-task-definition@v1
        id: ecs-deploy
        with:
          task-definition: ${{ steps.task-def.outputs.task-definition }}
          service: ${{ env.ECS_SERVICE }}
          cluster: ${{ env.ECS_CLUSTER }}
          wait-for-service-stability: true
          
      - name: Check if deployment was successful
        id: check-deployment
        run: |
            CURRENT_TASK_DEF_ARN=$(aws ecs describe-services --cluster ${{ env.ECS_CLUSTER }} --services ${{ env.ECS_SERVICE }} --query services[0].deployments[0].taskDefinition | jq -r ".")
            NEW_TASK_DEF_ARN=${{ steps.ecs-deploy.outputs.task-definition-arn }}
            REVISION=${GITHUB_SHA::8}
            echo "Current task arn: $CURRENT_TASK_DEF_ARN"
            echo "New task arn: $NEW_TASK_DEF_ARN"
            echo "Latest revision: $REVISION"
            if [ "$CURRENT_TASK_DEF_ARN" != "$NEW_TASK_DEF_ARN" ]; then
              echo "Deployment failed with latest code revision."
              exit 1
            else
              echo "Deployment successfull."
            fi

      - name: Publish JAR file - AWS CodeArtifact
        id: ca-deploy
        env:
          CA_VERSION: ${{ steps.ca-getversion.outputs.latest_version }}
        run: |
          export ASSET_SHA256=$(sha256sum ${{ vars.CA_SOURCE_PATH }} | awk '{print $1;}')
          #ASSET_SHA256:- This value is used as an integrity check to verify that the assetContent has not changed after it was originally sent or published.
          
          aws codeartifact publish-package-version \
          --repository $CA_REPO \
          --domain $CA_DOMAIN \
          --domain-owner $CA_DOMAIN_OWNER \
          --format generic \
          --package $CA_PACKAGE \
          --asset-content ${{ vars.CA_SOURCE_PATH }} \
          --package-version ${{ env.CA_VERSION }} \
          --asset-name $CA_PACKAGE \
          --asset-sha256 $ASSET_SHA256 \
          --namespace $CA_NAMESPACE  \
          --output text