main.yaml

name: samuel nwoye website pipeline

on:
  push:
    branches: [ main ]

env:
  HUGO_VERSION: 0.111.3

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
    - name: checkout
      uses: actions/checkout@v3
    
    - name: static code analysis
      uses: aquasecurity/trivy-action@master
      with:
        scan-type: 'config'
        scan-ref: 'terraform'
        format: table
        exit-code: '0'
        ignore-unfixed: true
        vuln-type: 'os,library'
        severity: 'CRITICAL,HIGH,MEDIUM'

    - name: repository analysis
      uses: aquasecurity/trivy-action@master
      with:
        scan-type: 'repo'
        scan-ref: 'https://github.com/knoxknot/knoxknot.github.io'
        format: table
        exit-code: '0'
        ignore-unfixed: true
        vuln-type: 'os,library'
        severity: 'CRITICAL,HIGH,MEDIUM'

    - name: filesystem analysis
      uses: aquasecurity/trivy-action@master
      with:
        scan-type: 'fs'
        scan-ref: '.'
        format: table
        exit-code: '0'
        ignore-unfixed: true
        vuln-type: 'os,library'
        severity: 'CRITICAL,HIGH'

    - name: sbom analysis
      uses: aquasecurity/trivy-action@master
      with:
        scan-type: 'fs'
        image-ref: '.'
        format: 'github'
        output: 'dependency-results.sbom.json'
        github-pat: ${{ secrets.GITHUB_TOKEN }}

  build:
    runs-on: ubuntu-latest
    steps:
    - name: checkout
      uses: actions/checkout@v3
    
    - name: setup hugo
      uses: peaceiris/actions-hugo@v2
      with:
        hugo-version: '${{ env.HUGO_VERSION }}'
        extended: true
    
    - name: setup pages
      id: pages
      uses: actions/configure-pages@v3
    
    - name: build with hugo
      run: hugo --gc --minify --baseURL "${{ steps.pages.output.base_url}}"
      env:
        HUGO_ENVIRONMENT: production
        TZ: 'Africa/Lagos'
    
    - name: upload artifact
      uses: actions/upload-pages-artifact@v1
      with:
        path: ./public

  deploy:
    runs-on: ubuntu-latest
    needs: 
    - test
    - build
    permissions:
      pages: write
      id-token: write
    if: contains(github.ref, 'main')
    steps:
    - name: checkout and filter
      uses: actions/checkout@v3
    
    # - name: filter directories
    #   uses: dorny/paths-filter@v2
    #   id: filter
    #   with:
    #     filters: |
    #       terraform: 
    #       - 'terraform/**'
    # - names: deploy dns to namecheap
    #   if: steps.filter.outputs.terraform == 'true'
    #   uses: dflook/terraform-apply@v1
    
    - name: deploy to github pages
      id: deployment
      uses: actions/deploy-pages@v2
    
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url}}