systems-pr.yml

name: Main System

on:
  pull_request:

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  auth:
    name: Auth
    runs-on: ubuntu-latest
    container: golang:1.20
    timeout-minutes: 30
    defaults:
      run:
        working-directory: ./auth
    services:
      db:
        image: redis:7-bookworm
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: TruffleHog OSS
        uses: trufflesecurity/trufflehog@main
        with:
          path: ./
          base: ${{ github.event.repository.default_branch }}
          head: HEAD
          extra_args: --debug --only-verified

      - name: Build test
        run: go build -buildvcs=false .

      - name: Run test
        run: go test -v -coverprofile=coverage.out -covermode=atomic ./...
        env:
          ENVIRONMENT: github-actions
          SENTRY_DSN: ""
          REDIS_URL: redis://@db:6379

      - name: Codecov
        uses: codecov/codecov-action@v3
        with:
          flags: auth

  rce:
    name: RCE
    runs-on: ubuntu-latest
    container: node:18.17.0
    timeout-minutes: 30
    defaults:
      run:
        working-directory: ./rce
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: TruffleHog OSS
        uses: trufflesecurity/trufflehog@main
        with:
          path: ./
          base: ${{ github.event.repository.default_branch }}
          head: HEAD
          extra_args: --debug --only-verified

      - name: Setup packages && nosocket
        run: >
          apt-get update &&
          apt-get install -y coreutils binutils build-essential libseccomp-dev gcc apt-utils &&
          make -C ./nosocket/ all && make -C ./nosocket/ install

      - name: Install other language packages
        run: >
          apt-get install -y python3 sqlite3 lua5.4

      - name: Setup directory
        run: mkdir -p /code/$(whoami)

      - name: Install dependencies
        run: npm ci

      - name: Lint
        run: npx eslint --ext .ts,.js,.cjs .

      - name: Build
        run: npm run build

      - name: Test & coverage
        run: npm run test
        env:
          LANGUAGE_JAVASCRIPT: true
          LANGUAGE_C: true
          LANGUAGE_LUA: true
          LANGUAGE_PYTHON: true
          LANGUAGE_SQLITE: true

      - name: Codecov
        uses: codecov/codecov-action@v3
        with:
          flags: rce

  landing:
    name: Landing
    runs-on: ubuntu-latest
    container: node:18.17.0
    timeout-minutes: 30
    defaults:
      run:
        working-directory: ./landing
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: TruffleHog OSS
        uses: trufflesecurity/trufflehog@main
        with:
          path: ./
          base: ${{ github.event.repository.default_branch }}
          head: HEAD
          extra_args: --debug --only-verified

      - name: Install pnpm
        uses: pnpm/action-setup@v2
        with:
          version: latest

      - name: Install dependencies
        run: pnpm install

      - name: Check formatting
        run: pnpm fmt:check

      - name: Build
        run: pnpm build

  registration:
    name: Registration
    runs-on: ubuntu-latest
    container: mcr.microsoft.com/dotnet/sdk:7.0
    timeout-minutes: 30
    defaults:
      run:
        working-directory: ./registration
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: TruffleHog OSS
        uses: trufflesecurity/trufflehog@main
        with:
          path: ./
          base: ${{ github.event.repository.default_branch }}
          head: HEAD
          extra_args: --debug --only-verified

      - name: Restore
        run: dotnet restore "Registration.csproj"

      - name: Build
        run: dotnet build "Registration.csproj" --no-restore -c Release

  build-auth:
    name: Build Auth
    runs-on: ubuntu-latest
    timeout-minutes: 30
    needs:
      - auth
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Log in to the Container registry
        uses: docker/login-action@v2
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v4
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-auth
          flavor: |
            latest=false
          tags: |
            type=ref,event=pr

      - name: Build and push Docker image
        uses: docker/build-push-action@v3
        with:
          context: "{{defaultContext}}:auth"
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

  build-landing:
    name: Build Landing
    runs-on: ubuntu-latest
    timeout-minutes: 30
    needs:
      - landing
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Log in to the Container registry
        uses: docker/login-action@v2
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v4
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-landing
          flavor: |
            latest=false
          tags: |
            type=ref,event=pr

      - name: Build and push Docker image
        uses: docker/build-push-action@v3
        with:
          context: "{{defaultContext}}:landing"
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

  build-rce:
    name: Build RCE
    runs-on: ubuntu-latest
    timeout-minutes: 720
    needs:
      - rce
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Log in to the Container registry
        uses: docker/login-action@v2
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v4
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-rce
          flavor: |
            latest=false
          tags: |
            type=ref,event=pr

      - name: Build and push Docker image
        uses: docker/build-push-action@v3
        with:
          context: "{{defaultContext}}:rce"
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

  build-registration:
    name: Build Registration
    runs-on: ubuntu-latest
    timeout-minutes: 30
    needs:
      - registration
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Log in to the Container registry
        uses: docker/login-action@v2
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v4
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-registration
          flavor: |
            latest=false
          tags: |
            type=ref,event=pr

      - name: Build and push Docker image
        uses: docker/build-push-action@v3
        with:
          context: "{{defaultContext}}:registration"
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

  dogfood:
    name: Dogfood Integration Tests
    runs-on: ubuntu-latest
    timeout-minutes: 60
    needs:
      - build-rce
      - rce
    services:
      pesto_rce:
        image: ghcr.io/teknologi-umum/pesto-rce:pr-${{github.event.number}}
        env:
          PORT: 50051
          ENVIRONMENT: production
        ports:
          - 50051:50051
        options: >-
          --health-cmd "curl -f http://localhost:50051/healthz"
          --health-interval 30s
          --health-timeout 15s
          --health-retries 10
          --health-start-period 90s
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - uses: actions/setup-node@v3
        with:
          node-version: latest
          check-latest: true
      
      - name: Run tests
        run: >
          npm ci &&
          node --test
        working-directory: ./dogfood
        env:
          PESTO_URL: http://localhost:50051/