diff --git a/.github/workflows/release-image-and-helm-chart.yaml b/.github/workflows/release-image-and-helm-chart.yaml index 47b0b76..e338e4e 100644 --- a/.github/workflows/release-image-and-helm-chart.yaml +++ b/.github/workflows/release-image-and-helm-chart.yaml @@ -94,4 +94,93 @@ jobs: helm_chart_version_generation: specified image_tag_generation: specified helm_chart_version: "${{ inputs.release_tag }}" - image_tag: "${{ inputs.release_tag }}" \ No newline at end of file + image_tag: "${{ inputs.releaname: Release Image and Helm Chart +on: + workflow_call: + inputs: + release_tag: + type: string + description: "Provide the release tag" + required: true + image_name: + type: string + description: "Provide Image name" + required: true + helm_chart_name: + type: string + description: "Provide Helm Chart name" + required: true + deploy_stage: + type: string + description: "Provide Deploy Stage" + required: false + default: "" + node_version: + type: string + description: "Provide Node Version" + required: false + default: '18' + +jobs: + # GHRC Image + codeql_analyze: + name: "CodeQL" + uses: dBildungsplattform/dbp-github-workflows/.github/workflows/check-codeql.yaml@5 + permissions: + actions: read + contents: read + security-events: write + + nest_lint: + name: "Linting" + uses: dBildungsplattform/dbp-github-workflows/.github/workflows/check-nest-lint.yaml@5 + with: + node_version: "${{ inputs.node_version }}" + permissions: + contents: read + + tests_and_sonarcloud: + name: "Tests and Sonarcloud" + uses: dBildungsplattform/dbp-github-workflows/.github/workflows/check-nest-test-sonarcloud.yaml@5 + with: + node_version: "${{ inputs.node_version }}" + deploy_stage: "${{ inputs.deploy_stage }}" + permissions: + contents: read + secrets: inherit + + release_image: + name: "Publish image and scan with trivy" + needs: + - codeql_analyze + - nest_lint + - tests_and_sonarcloud + permissions: + packages: write + security-events: write + contents: read + uses: dBildungsplattform/dbp-github-workflows/.github/workflows/image-publish-trivy.yaml@5 + with: + image_name: "${{ inputs.image_name }}" + run_trivy_scan: true + image_tag_generation: version_git_tag + container_registry: "ghcr.io" + fail_on_vulnerabilites: true + report_location: "Dockerfile" + + # Helm Chart + scan_helm: + uses: dBildungsplattform/dbp-github-workflows/.github/workflows/check-helm-kics.yaml@5 + permissions: + contents: read + + release_helm: + needs: scan_helm + uses: dBildungsplattform/dbp-github-workflows/.github/workflows/chart-release.yaml@5 + secrets: inherit + with: + chart_name: "${{ inputs.helm_chart_name }}" + helm_chart_version_generation: specified + image_tag_generation: specified + helm_chart_version: "${{ inputs.release_tag }}" + image_tag: "${{ inputs.relea \ No newline at end of file