w09-solution/.github/workflows/ci.yml at main · AET-DevOps25/w09-solution · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
# Copyright © TUM AET 2025 - 2025
#
# Licensed under the MIT License
#
# Authors: Benedikt Hofmann, Patrick Stoeckle, and other contributors
#
# SPDX-FileCopyrightText: 2025 TUM AET
#
# SPDX-License-Identifier: MIT

name: devops demo CI parent workflow

on:
  push: { branches: [main] }
  pull_request:

jobs:
  hawkeye:
    permissions:
      contents: read
    name: hawkeye
    uses: ./.github/workflows/hawkeye.yml
  gitleaks:
    permissions:
      security-events: write
      actions: read
      contents: read
      pull-requests: write
    name: gitleaks
    uses: ./.github/workflows/gitleaks.yml
  java_linting:
    permissions:
      contents: read
      pull-requests: write
    name: java
    uses: ./.github/workflows/java.yml
  terraform_linting:
    uses: ./.github/workflows/tflint.yml
  sast_1:
    permissions:
      contents: read
    uses: ./.github/workflows/semgrep.yml
  sast_2:
    permissions:
      security-events: write
      actions: read
      contents: read
      pull-requests: write
    uses: ./.github/workflows/kics.yml
  spellcheck:
    uses: ./.github/workflows/spelling.yml
  npm-audit:
    uses: ./.github/workflows/npm-audit.yml

  build-server-container:
    uses: ./.github/workflows/build-container.yml
    with:
      context: ./server
      dockerfile: ./server/Dockerfile
      image-authors: "Patrick Stoeckle"
      image-description: "Canteen App Backend built with Spring Boot"
      image-registry: ghcr.io
      image-name: aet-devops25/w09-solution/server
      image-tag: ${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}
      image-title: "Canteen App Backend"
    permissions:
      contents: read
      packages: write
    secrets:
      cosign-key: ${{ secrets.COSIGN_PRIVATE_KEY }}

  build-client-container:
    uses: ./.github/workflows/build-container.yml
    with:
      context: ./client
      dockerfile: ./client/Dockerfile
      ignore-codes: "CIS-DI-0010"
      image-authors: "Benedikt Hofmann"
      image-description: "Canteen App Frontend built with Svelte Kit"
      image-registry: ghcr.io
      image-name: aet-devops25/w09-solution/client
      image-tag: ${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}
      image-title: "Canteen App Frontend"
    permissions:
      contents: read
      packages: write
    secrets:
      cosign-key: ${{ secrets.COSIGN_PRIVATE_KEY }}

  build-llm-container:
    uses: ./.github/workflows/build-container.yml
    with:
      context: ./llm
      dockerfile: ./llm/Dockerfile
      ignore-codes: "CIS-DI-0010"
      image-authors: "Benedikt Hofmann"
      image-description: "Canteen App LLM Connector built with FastAPI"
      image-registry: ghcr.io
      image-name: aet-devops25/w09-solution/llm
      image-tag: ${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}
      image-title: "Canteen App LLM Connector"
    permissions:
      contents: read
      packages: write
    secrets:
      cosign-key: ${{ secrets.COSIGN_PRIVATE_KEY }}