ci.yml

on:
  workflow_dispatch:
  workflow_call:
    outputs:
      image-tag:
        description: "image tag"
        value: ${{ jobs.build-and-test.outputs.image-tag }}
name: ci

jobs:

  build-and-test:
    runs-on: ubuntu-latest

    outputs:
      image-tag: ${{ steps.set-image-tag.outputs.IMAGE_TAG }}

    steps:
      - name: Checkout Code
        uses: actions/checkout@v3

      - name: Echo
        run: echo "CI..."  

      # TODO:
      # Configure dynamic credentials to AWS, check out the action: aws-actions/configure-aws-credentials
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v2
        with:
          role-to-assume: ${{ secrets.ROLE_TO_ASSUME }}
          aws-region: ${{vars.AWS_REGION}}

      # Lint the CloudFormation template (templates/), check out the action: scottbrenner/cfn-lint-action
      # Perform static analysis against the CloudFormation template, check out the action: stelligent/cfn_nag@master

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v1

      # Checkout Amplify Repo (we do this so that you can start to build the Amplify app from this repo)
      - name: Checkout Amplify Repo
        run: |
          cd $GITHUB_WORKSPACE
          git clone https://github.com/ProgramEquity/amplify app
          cp $GITHUB_WORKSPACE/Dockerfile $GITHUB_WORKSPACE/app
          ls -l $GITHUB_WORKSPACE/app

      # Build the Amplify app and create a docker image, relevant actions: aws-actions/amazon-ecr-login@v1
      
      - name: Build, tag, and push image to AWS ECR
        id: build-image
        env:
          AWS_REGION: ${{ vars.AWS_REGION }}
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          ECR_REPOSITORY: ${{ vars.ECR_REPO_NAME }}
          IMAGE_TAG: ${{ github.sha }}
        run: |
          echo "Building image $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG"
          cd $GITHUB_WORKSPACE/app
          docker build \
              -t $ECR_REPOSITORY:latest \
              -t $ECR_REGISTRY/$ECR_REPOSITORY:latest \
              -t $ECR_REPOSITORY:$IMAGE_TAG \
              -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG .
          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
          docker tag $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG $ECR_REGISTRY/$ECR_REPOSITORY:latest
          docker push $ECR_REGISTRY/$ECR_REPOSITORY:latest
          echo "Pushed image $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG"

      - name: Set new image tag
        id: set-image-tag
        run: |
          [[ -z $IMAGE_TAG ]] && echo "IMAGE_TAG=latest" >> $GITHUB_OUTPUT && echo "IMAGE_TAG=latest" >> $GITHUB_ENV || echo "IMAGE_TAG=$IMAGE_TAG" >> $GITHUB_OUTPUT && echo "IMAGE_TAG=$IMAGE_TAG" >> $GITHUB_ENV 
        
      - name: ECR image scan
        id: image-scan
        uses: alexjurkiewicz/ecr-scan-image@v1.7.1
        with:
          repository: ${{ vars.ECR_REPO_NAME }}
          tag: latest

      - name: Summary
        id: summary
        run: |
          echo "## ECR Container Vulnerabilities found:" >> $GITHUB_STEP_SUMMARY
          echo "${{ steps.image-scan.outputs.critical }} Critical" >> $GITHUB_STEP_SUMMARY
          echo "${{ steps.image-scan.outputs.high }} High" >> $GITHUB_STEP_SUMMARY
          echo "${{ steps.image-scan.outputs.medium }} Medium" >> $GITHUB_STEP_SUMMARY
          echo "${{ steps.image-scan.outputs.low }} Low" >> $GITHUB_STEP_SUMMARY
          echo "${{ steps.image-scan.outputs.informational }} Info" >> $GITHUB_STEP_SUMMARY
          echo "${{ steps.image-scan.outputs.undefined }} Undefined" >> $GITHUB_STEP_SUMMARY
          echo "${{ steps.image-scan.outputs.total }} Total" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY # this is a blank line
          echo "## ECR Container Image:" >> $GITHUB_STEP_SUMMARY
          echo "image-tag: ${{ steps.set-image-tag.outputs.IMAGE_TAG }}" >> $GITHUB_STEP_SUMMARY

      

      # Scan the docker image in ECR, check out the action: alexjurkiewicz/ecr-scan-image for inspiration
     
      # Create build summary output