image-and-helm-publish-check-deploy-on-push-scheduled.yml

# Scan & Publish helm chart on push, deployment on push, delete deployment on branch deletion, scheduled trivy scanner
name: "Dev Pipeline"

# All triggers have to be in one file, so that the trivy results can be compared to identify introduced vulnerabilities
# See DBP-340
on:
  push:
    branches:
      - "**"
  delete:

concurrency:
  group: dbildungs-iam-ldap-${{ github.event.ref }}
  cancel-in-progress: true

jobs:
  scan_helm:
    if: ${{ github.event_name == 'push' && !startsWith(github.ref_name,'dependabot/') }}
    uses: dBildungsplattform/dbp-github-workflows/.github/workflows/check-helm-kics.yaml@5
    permissions:
      contents: read

  select_helm_version_generation_and_image_tag_generation:
    if: ${{ github.event_name == 'push' && !startsWith(github.ref_name,'dependabot/') }}
    runs-on: ubuntu-latest
    outputs: 
      SELECT_HELM_VERION_GENERATION: ${{ steps.select_generation.outputs.SELECT_HELM_VERION_GENERATION }}
      SELECT_IMAGE_TAG_GENERATION: ${{ steps.select_generation.outputs.SELECT_IMAGE_TAG_GENERATION }}
    steps:
      - id: select_generation
        shell: bash
        run: |
          if ${{ github.ref_name == 'main' }}; then
            echo "SELECT_HELM_VERION_GENERATION=timestamp" >> "$GITHUB_OUTPUT"
            echo "SELECT_IMAGE_TAG_GENERATION=commit_hash" >> "$GITHUB_OUTPUT"
          else
            echo "SELECT_HELM_VERION_GENERATION=ticket_from_branch_timestamp" >> "$GITHUB_OUTPUT"
            echo "SELECT_IMAGE_TAG_GENERATION=ticket_from_branch" >> "$GITHUB_OUTPUT"
          fi

  release_helm:
    if: ${{ github.event_name == 'push' && !startsWith(github.ref_name,'dependabot/') }}
    needs: 
      - select_helm_version_generation_and_image_tag_generation
    uses: dBildungsplattform/dbp-github-workflows/.github/workflows/chart-release.yaml@7
    secrets: inherit
    with:
      chart_name: dbildungs-iam-ldap
      helm_chart_version_generation: ${{ needs. select_helm_version_generation_and_image_tag_generation.outputs.SELECT_HELM_VERION_GENERATION  }}
      image_tag_generation: ${{ needs. select_helm_version_generation_and_image_tag_generation.outputs.SELECT_IMAGE_TAG_GENERATION  }}

  wait_for_helm_chart_to_get_published:
    needs:
      - release_helm
    runs-on: ubuntu-latest
    steps:
      - shell: bash
        run: |
          sleep 1m 

  branch_meta:
    if: ${{ github.event_name == 'push' && !startsWith(github.ref_name,'dependabot/') }}
    uses: dBildungsplattform/spsh-app-deploy/.github/workflows/get-branch-meta.yml@3

  create_branch_identifier:
    if: ${{ github.event_name == 'push' && !startsWith(github.ref_name,'dependabot/') }}
    needs: 
      - branch_meta
    uses: dBildungsplattform/spsh-app-deploy/.github/workflows/deploy-branch-to-namespace.yml@3
    with:
      branch: ${{ needs.branch_meta.outputs.branch }}

  deploy:
    if: ${{ github.event_name == 'push' && !startsWith(github.ref_name,'dependabot/') }}
    needs:
      - branch_meta
      - create_branch_identifier
      - wait_for_helm_chart_to_get_published
    uses: dBildungsplattform/spsh-app-deploy/.github/workflows/deploy.yml@5 
    with:
      dbildungs_iam_server_branch: ${{ needs.branch_meta.outputs.ticket }}
      schulportal_client_branch: ${{ needs.branch_meta.outputs.ticket }}
      dbildungs_iam_keycloak_branch: ${{ needs.branch_meta.outputs.ticket }}
      dbildungs_iam_ldap_branch: ${{ needs.branch_meta.outputs.ticket }}
      namespace: ${{ needs.create_branch_identifier.outputs.namespace_from_branch }}
    secrets: inherit

  # On Delete
  create_branch_identifier_for_deletion:
    if: ${{ github.event_name == 'delete' && github.event.ref_type == 'branch' }}
    uses: dBildungsplattform/spsh-app-deploy/.github/workflows/deploy-branch-to-namespace.yml@3
    with:
      branch: ${{ github.event.ref }}

  delete_namespace:
    if: ${{ github.event_name == 'delete' && github.event.ref_type == 'branch'}}
    needs:
      - create_branch_identifier_for_deletion
    uses: dBildungsplattform/spsh-app-deploy/.github/workflows/delete-namespace.yml@5
    with:
      namespace: ${{ needs.create_branch_identifier_for_deletion.outputs.namespace_from_branch }}
    secrets:
      SPSH_DEV_KUBECONFIG: ${{ secrets.SPSH_DEV_KUBECONFIG }}

  delete_successful:
    if: ${{ github.event_name == 'delete' && github.event.ref_type == 'branch' }}
    needs:
      - delete_namespace
      - create_branch_identifier_for_deletion
    runs-on: ubuntu-latest
    steps:
      - run: echo "Deletion workflow of namespace" ${{ needs.create_branch_identifier_for_deletion.outputs.namespace_from_branch }} "done"