_meta-build.yaml

# This file is part of Dependency-Track.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# SPDX-License-Identifier: Apache-2.0
# Copyright (c) OWASP Foundation. All Rights Reserved.
permissions: {}

on:
  workflow_call:
    inputs:
      app-version:
        type: string
        required: true
        description: 'Set the version that should be set/used as tag for the container image'
      publish-container:
        type: boolean
        required: false
        default: false
        description: 'Set if the container image gets publish and scan once its build'
      ref-name:
        type: string
        required: true
        description: 'Short ref name of the branch or tag that triggered the workflow run'
    secrets:
      registry-0-usr:
        required: true
      registry-0-psw:
        required: true

jobs:
  build-node:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout Repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
        with:
          persist-credentials: false

      - name: Set up NodeJs
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # tag=v6.4.0
        with:
          node-version: '20'
          cache: 'npm'

      - name: Run Npm Build
        env:
          CI: true
        run: |-
          npm ci
          npm run build --if-present

      - name: Upload Artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # tag=v7.0.1
        with:
          name: assembled-frontend
          path: |-
            dist/
            bom.*

  build-container:
    runs-on: ubuntu-latest
    permissions:
      packages: write # Required to push images to ghcr.io
    needs:
      - build-node

    steps:
      - name: Checkout Repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
        with:
          persist-credentials: false

      - name: Download Artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # tag=v8.0.1
        with:
          name: assembled-frontend

      - name: Set up QEMU
        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # tag=v4.1.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # tag=v4.1.0
        id: buildx
        with:
          install: true

      - name: Login to GitHub Container Registry
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # tag=v4.2.0
        if: ${{ inputs.publish-container }}
        with:
          registry: ghcr.io
          username: ${{ secrets.registry-0-usr }}
          password: ${{ secrets.registry-0-psw }}

      - name: Set Container Tags
        id: tags
        env:
          REF_NAME: ${{ inputs.ref-name }}
          APP_VERSION: ${{ inputs.app-version }}
        run: |-
          shopt -s nocasematch
          if [[ ! "$APP_VERSION" =~ ^([0-9]+-snapshot|[0-9]+\.[0-9]+\.[0-9]+(-[A-Za-z0-9.]+)?(\+[A-Za-z0-9.]+)?)$ ]]; then
            echo "::error::app-version must be '<major>-snapshot' or a semver version, got: '${APP_VERSION}'"
            exit 1
          fi
          if [[ ! "$REF_NAME" =~ ^[a-zA-Z0-9_][a-zA-Z0-9._/-]{0,127}$ ]]; then
            echo "::error::ref-name is not a valid git ref: '${REF_NAME}'"
            exit 1
          fi

          IMAGE_NAME="ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/frontend"
          TAGS=""

          if [[ "$REF_NAME" == feature-* ]]; then
            # OCI tags disallow '/', but git refs allow it (e.g. feature-foo/bar).
            # Lowercase and substitute '/' for '-' to produce a valid tag.
            REF_TAG="${REF_NAME,,}"
            REF_TAG="${REF_TAG//\//-}"
            TAGS="${IMAGE_NAME}:${REF_TAG}"
          else
            TAGS="${IMAGE_NAME}:${APP_VERSION}"
          fi
          echo "tags=${TAGS}" >> "$GITHUB_OUTPUT"

      - name: Build multi-arch Container Image
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # tag=v7.2.0
        with:
          tags: ${{ steps.tags.outputs.tags }}
          build-args: |-
            APP_VERSION=${{ inputs.app-version }}
            COMMIT_SHA=${{ github.sha }}
          platforms: linux/amd64,linux/arm64
          push: ${{ inputs.publish-container }}
          context: .
          file: docker/Dockerfile.alpine