release.yml

name: Release
on:
  create:
    tags:
      - '**'
env:
  REPONAME: litmuschaos
  IMAGENAME: chaos-ci-lib
  IMAGETAG: ci

jobs:
  pre-checks:
    runs-on: ubuntu-latest
    steps:
      # Install golang
      - uses: actions/setup-go@v2
        with:
          go-version: 1.14

      # Checkout to the latest commit
      # On specific directory/path
      - name: Checkout
        uses: actions/checkout@v2

      - name: gofmt check
        run: |
          if [ "$(gofmt -s -l . | wc -l)" -ne 0 ]
          then
           echo "The following files were found to be not go formatted:"
           gofmt -s -l .
           exit 1
          fi
      - name: golangci-lint
        uses: reviewdog/action-golangci-lint@v1

  image-build:
    runs-on: ubuntu-latest
    needs: pre-checks
    steps:
      # Checkout to the latest commit
      # On specific directory/path
      - name: Checkout
        uses: actions/checkout@v2

      - name: login to GitHub Container Registry
        run: echo ${{ secrets.DPASS }} | docker login -u ${{ secrets.DNAME }} --password-stdin

      - name: Set Tag
        run: |
          TAG="${GITHUB_REF#refs/*/}"
          echo "TAG=${TAG}" >> $GITHUB_ENV
          echo "RELEASE_TAG=${TAG}" >> $GITHUB_ENV

      - name: Build & Push Docker Image with version tag
        env:
          DOCKER_REPO: ${{ env.REPONAME }}
          DOCKER_IMAGE: ${{ env.IMAGENAME }}
          DOCKER_TAG: ${RELEASE_TAG}
          DNAME: ${{ secrets.DNAME }}
          DPASS: ${{ secrets.DPASS }}
        run: |
          make push

      - name: Build & Push Docker Image with latest tag
        env:
          DOCKER_REPO: ${{ env.REPONAME }}
          DOCKER_IMAGE: ${{ env.IMAGENAME }}
          DOCKER_TAG: latest
          DNAME: ${{ secrets.DNAME }}
          DPASS: ${{ secrets.DPASS }}
        run: |
          make push

  security-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'docker.io/${{ env.REPONAME }}/${{ env.IMAGENAME }}:${{ env.IMAGETAG }}'
          format: 'table'
          exit-code: '0'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'