ci.yml

name: CI

on:
  push:
    tags:
      - '*'
  pull_request:

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - uses: coursier/cache-action@v6
      - name: Set up JDK 11
        uses: actions/setup-java@v1
        with:
          java-version: 11
      - name: Install sbt
        uses: sbt/setup-sbt@v1
      - name: Check Scala formatting
        run: sbt scalafmtCheckAll scalafmtSbtCheck
      - name: Run tests
        run: sbt test

  publish_docker:
    needs: test
    if: github.ref_type == 'tag'
    runs-on: ubuntu-latest
    strategy:
      matrix:
        app:
          - kafka
          - pubsub
          - kinesis
    steps:
      - name: Checkout Github
        uses: actions/checkout@v2
      - uses: coursier/cache-action@v6
      - name: Set up JDK 11 for loader and streaming transformer
        uses: actions/setup-java@v1
        with:
          java-version: 11
      - name: Install sbt
        uses: sbt/setup-sbt@v1
      - name: Docker login
        uses: docker/login-action@v1
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - name: Stage the Docker build
        run: sbt "project ${{ matrix.app}}" docker:stage
      - name: Stage the Docker Distroless build
        run: sbt "project ${{ matrix.app}}Distroless" docker:stage
      - name: Docker metadata
        id: meta
        uses: docker/metadata-action@v3
        with:
          images: "snowplow/snowflake-loader-${{ matrix.app }}"
          tags: |
            type=raw,value=latest,enable=${{ !contains(github.ref_name, 'rc') }}
            type=raw,value=latest-focal,enable=${{ !contains(github.ref_name, 'rc') }}
            type=raw,value=${{ github.ref_name }}
            type=raw,value=${{ github.ref_name }}-focal
          flavor: |
            latest=false
      - name: Docker metadata distroless
        id: metaDistroless
        uses: docker/metadata-action@v3
        with:
          images: "snowplow/snowflake-loader-${{ matrix.app }}"
          tags: |
            type=raw,value=latest-distroless,enable=${{ !contains(github.ref_name, 'rc') }}
            type=raw,value=${{ github.ref_name }}-distroless
          flavor: |
            latest=false
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v1
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v1
      - name: Push image
        uses: docker/build-push-action@v2
        with:
          context: modules/${{ matrix.app }}/target/docker/stage
          file: modules/${{ matrix.app }}/target/docker/stage/Dockerfile
          platforms: linux/amd64,linux/arm64/v8
          tags: ${{ steps.meta.outputs.tags }}
          push: true
      - name: Push distroless image
        uses: docker/build-push-action@v2
        with:
          context: modules/distroless/${{ matrix.app }}/target/docker/stage
          file: modules/distroless/${{ matrix.app }}/target/docker/stage/Dockerfile
          platforms: linux/amd64,linux/arm64/v8
          tags: ${{ steps.metaDistroless.outputs.tags }}
          push: true
      - name: Build local image, which is needed to run Snyk
        if: ${{ !contains(github.ref_name, 'rc') }}
        run: sbt "project ${{ matrix.app }}Distroless" docker:publishLocal
      - name: Run Snyk to check for vulnerabilities
        uses: snyk/actions/docker@master
        if: ${{ !contains(github.ref_name, 'rc') }}
        with:
          image: "snowplow/snowflake-loader-${{ matrix.app }}:${{ github.ref_name }}-distroless"
          args: "--app-vulns --org=data-processing-new"
          command: monitor
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}