microflow-execution.yml

---
name: microflow-execution

on:
  #workflow_dispatch:
  #  inputs:
  #    autor_proyecto:
  #      description: "Autor/proyecto a analizar"
  #      required: true
  #      default: ""
  #    java_version:
  #      type: choice
  #      description: "Java version"
  #      required: true
  #      options:
  #        - jdk-8
  #        - jdk-11
  issues:
    types:
      - labeled

env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  ISSUE_NUMBER: ${{ github.event.issue.number }}
  AWS_ACCOUNT_ID: ${{ secrets.AWS_ACCOUNT_ID }}
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
  AWS_REGION: ${{ secrets.AWS_REGION }}

jobs:
  retrieve-project:
    runs-on: ubuntu-20.04
    if: contains(join(github.event.label.name, ', '), 'microflow-start')
    outputs:
      PROJECT: ${{ steps.parsing.outputs.repo }}
      PROJECT_NAME: ${{ steps.parsing.outputs.repo_name }}
      JDK: ${{ steps.parsing.outputs.jdk_version }}
      DEPLOY: ${{ steps.parsing.outputs.deploy }}
    steps:
      - name: Get information from body
        id: parsing
        shell: python
        env:
          BODY: ${{ github.event.issue.body }}
        run: |
          import os
          import re
          import sys
          rawform = str(os.environ['BODY'])
          repo = re.search(r"(### GitHub Repository\s*)(.*)", rawform).group(2)
          repo_name = repo.split('/')[1]
          jdk_version = re.search(r"(### Java version used in the project\s*)(.*)", rawform).group(2)
          deploy = re.search(r"(### Deploy the project\s*)(.*)", rawform).group(2)

          print(f'::set-output name=repo::{repo}')
          print(f'::set-output name=repo_name::{repo_name}')
          print(f'::set-output name=jdk_version::{jdk_version}')
          print(f'::set-output name=deploy::{deploy}')

      - name: Return error
        if: ${{ always() && steps.parsing.outcome == 'failure' }}
        run: |
          gh issue comment -R "${{github.repository}}" "$ISSUE_NUMBER" \
          --body "#### :x: The introduced repository was not found

            In case it is a private repository, you should have the access permissions.
            See the [workflow log](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more details."

      - name: Return success
        if: ${{ always() && steps.parsing.outcome == 'success' }}
        run: |
          gh issue comment -R "${{github.repository}}" "$ISSUE_NUMBER" \
          --body "#### :heavy_check_mark: The introduced repository was found

            Checking if the project compiles..."

      - name: Checkout input project
        uses: actions/checkout@v3
        id: checkout
        with:
          repository: ${{ steps.parsing.outputs.repo }}
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Return error
        if: ${{ always() && steps.checkout.outcome == 'failure' }}
        run: |
          gh issue comment -R "${{github.repository}}" "$ISSUE_NUMBER" \
          --body "#### :x: The introduced repository was not found

            In case it is a private repository, you should have the access permissions.
            See the [workflow log](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more details."

      - name: Add project to directory
        run: mkdir ../project && mv * ../project && mv ../project .

      - name: Check correct compile of project
        id: compile
        run: |
          docker run --rm --workdir /app -v"$(pwd)":/app maven:3.8.5-"${{ steps.parsing.outputs.jdk_version }}" sh -c "mvn clean compile -f project"

      - name: Return error
        if: ${{ always() && steps.compile.outcome == 'failure' }}
        run: |
          gh issue comment -R "${{github.repository}}" "$ISSUE_NUMBER" \
          --body "#### :x: The introduced repository does not compile

            Tests could be failing.
            Check that the project compiles correctly in a local environment.
            Check if the introduced jdk is the one used in this project.

            See the [workflow log](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more details."

      - name: Return success
        if: ${{ always() && steps.compile.outcome == 'success' }}
        run: |
          gh issue comment -R "${{github.repository}}" "$ISSUE_NUMBER" \
          --body "#### :heavy_check_mark: The introduced project compiles successfully

            The SonarQube analysis has started..."

      - uses: actions/upload-artifact@v3
        with:
          name: project
          path: .

  sonarqube-scanner:
    runs-on: ubuntu-20.04
    needs: retrieve-project
    steps:
      - name: Checkout microflow project
        uses: actions/checkout@v3

      - name: Get project
        id: get-project
        uses: actions/download-artifact@v3
        with:
          name: project

      - name: Docker compose up
        run: |
          cd maven_sonarscanner
          JDK_VERSION=${{ needs.retrieve-project.outputs.JDK }} PROJECT_PATH=../project docker-compose up -d

      - name: Retrieve scanner results
        timeout-minutes: 15
        id: retrieve-results
        run: |
          while [[ $(docker container ps -q -f status=exited) == "" ]]; do
            true
          done

      - name: Return error
        if: ${{ always() && steps.retrieve-results.outcome == 'failure' }}
        run: |
          gh issue comment -R "${{github.repository}}" "$ISSUE_NUMBER" \
          --body "#### :x: The sonar scanner did not end correctly

          See the [workflow log](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more details."

      - name: Return success
        if: ${{ always() && steps.retrieve-results.outcome == 'success' }}
        run: |
          gh issue comment -R "${{github.repository}}" "$ISSUE_NUMBER" \
          --body "#### :heavy_check_mark: The SonarQube scanner ended successfully

            The checkstyle and spotbugs analysis have started..."

      - name: setup python
        uses: actions/setup-python@v3
        with:
          python-version: 3.8
          cache: "pip"

      - name: Install python dependencies
        run: pip install -r maven_sonarscanner/requirements.txt

      - name: Get analysis results via SonarQube API
        run: |
          python maven_sonarscanner/generate-results.py
          mkdir scanner_results
          mv *results.md scanner_results/
          mv *charts.html scanner_results/

      - name: Save scanner results
        uses: actions/upload-artifact@v3
        with:
          name: scanner_results
          path: ./scanner_results

      - name: Docker compose down
        run: |
          cd maven_sonarscanner
          docker-compose down -v

  checkstyle-spotbugs:
    needs: retrieve-project
    runs-on: ubuntu-20.04
    steps:
      - name: Checkout microflow project
        uses: actions/checkout@v3

      - name: Get project
        id: get-project
        uses: actions/download-artifact@v3
        with:
          name: project

      - name: Checkstyle execution and result publishing
        id: checkstyle
        run: |
          cd project
          docker run --rm --workdir /app -v"$(pwd)":/app maven:3.8.5-"${{ needs.retrieve-project.outputs.JDK }}" sh -c "mvn checkstyle:checkstyle-aggregate"
          mkdir checkstyle_results
          cp -r ./target/site checkstyle_results/

      - name: Return error
        if: ${{ always() && steps.checkstyle.outcome == 'failure' }}
        run: |
          gh issue comment -R "${{github.repository}}" "$ISSUE_NUMBER" \
          --body "#### :x: The checkstyle scan did not end correctly

          See the [workflow log](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more details."

      - name: Return success
        if: ${{ always() && steps.checkstyle.outcome == 'success' }}
        run: |
          gh issue comment -R "${{github.repository}}" "$ISSUE_NUMBER" \
          --body "#### :heavy_check_mark: The checkstyle scan ended successfully

            Publishing the results on the github page..."

      - name: Save checkstyle results
        uses: actions/upload-artifact@v3
        with:
          name: checkstyle_results
          path: ./project/checkstyle_results

      - name: setup python
        uses: actions/setup-python@v3
        with:
          python-version: 3.8
          cache: "pip"

      - name: Install python dependencies
        run: pip install -r maven_sonarscanner/requirements.txt

      - name: Spotbugs execution and result publishing
        id: spotbugs
        run: |
          cd project
          results=$(docker run --rm --workdir /app -v"$(pwd)":/app maven:3.8.5-"${{ needs.retrieve-project.outputs.JDK }}" sh -c "mvn clean compile com.github.spotbugs:spotbugs-maven-plugin:4.6.0.0:check -DincludeTests=true -Dplugins=com.h3xstream.findsecbugs:findsecbugs-plugin:LATEST -fn")
          mkdir spotbugs_results
          export bugs=$(echo "$results" | grep ERROR | grep line)
          python ../spotbugs/generate-spotbugs-results.py
          mv *bug_report.md spotbugs_results/

          if [[ -z $(echo $results | grep "BugInstance size is") ]]; then
            echo "## NO BUGS FOUND IN THE PROJECT" > spotbugs_results/*bug_report.md
          fi

      - name: Return error
        if: ${{ always() && steps.spotbugs.outcome == 'failure' }}
        run: |
          gh issue comment -R "${{github.repository}}" "$ISSUE_NUMBER" \
          --body "#### :x: The spotbugs scan did not end correctly

          See the [workflow log](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more details."

      - name: Return success
        if: ${{ always() && steps.spotbugs.outcome == 'success' }}
        run: |
          gh issue comment -R "${{github.repository}}" "$ISSUE_NUMBER" \
          --body "#### :heavy_check_mark: The spotbugs scan ended successfully

            Publishing the results on the github page..."

      - name: Save spotbugs results
        uses: actions/upload-artifact@v3
        with:
          name: spotbugs_results
          path: ./project/spotbugs_results

  web-update:
    runs-on: ubuntu-20.04
    needs: [sonarqube-scanner, checkstyle-spotbugs]
    steps:
      - name: Checkout to ghpages branch
        uses: actions/checkout@v3
        with:
          ref: gh-pages

      - name: Get results Sonar scanner
        id: get-results-scanner
        uses: actions/download-artifact@v3
        with:
          name: scanner_results

      - name: Get results checkstyle
        id: get-results-checkstyle
        uses: actions/download-artifact@v3
        with:
          name: checkstyle_results

      - name: Get results spotbugs
        id: get-results-spotbugs
        uses: actions/download-artifact@v3
        with:
          name: spotbugs_results

      - name: Update github page
        continue-on-error: true
        run: |
          git config --local user.email "action@github.com"
          git config --local user.name "GitHub Action"

          sonar_file=$(ls . | grep *results.md)
          charts_file=$(ls . | grep *charts.html)
          mv -f "$sonar_file" _posts/
          mv -f "$charts_file" _includes/

          spotbugs_file=$(ls . | grep *bug_report.md)
          mkdir analysis_history/${charts_file%%-charts.html}
          mv -f $spotbugs_file analysis_history/${charts_file%%-charts.html}
          mv -f site/checkstyle-aggregate.html analysis_history/${charts_file%%-charts.html}/${charts_file%%-charts.html}-checkstyle-aggregate.html

          urls="<section id=\"downloads\"><a href=\"https://pablocollazoc.github.io/microflow/${charts_file%%-charts.html}/checkstyle\" class=\"btn\">Checkstyle results</a><a href=\"https://pablocollazoc.github.io/microflow/${charts_file%%-charts.html}/spotbugs\" class=\"btn\">Spotbugs results</a><a href=\"{{ site.github.repository_url }}\" class=\"btn btn-github\"><span class=\"icon\"></span>View on GitHub</a></section>"

          sed -i "1s|^|---\nlayout: default\n---\n${urls}\n\n |" _posts/$sonar_file

          sed -i "1s|^|---\nlayout: default\ntitle: Checkstyle\npermalink: \/${charts_file%%-charts.html}\/checkstyle\/\n---\n<section id=\"downloads\"><a onclick=\"window.history.back\(\)\">Back</a></section>\n\n |" analysis_history/${charts_file%%-charts.html}/${charts_file%%-charts.html}-checkstyle-aggregate.html

          sed -i "1s|^|---\nlayout: default\ntitle: Spotbugs\npermalink: \/${charts_file%%-charts.html}\/spotbugs\/\n---\n<section id=\"downloads\">  \n<a onclick=\"window.history.back\(\)\">Back</a></section>\n\n |" analysis_history/${charts_file%%-charts.html}/$spotbugs_file

          git add _posts _includes analysis_history/
          git commit -m "Updated gh page with ${{ needs.retrieve-project.outputs.PROJECT }} analysis"

          git push

  build-test:
    runs-on: ubuntu-20.04
    needs: [retrieve-project, sonarqube-scanner, checkstyle-spotbugs]
    steps:
      - name: Get project
        id: get-project
        uses: actions/download-artifact@v3
        with:
          name: project
      - name: build & test project
        id: build
        run: |
          cd project
          docker run --rm --workdir /app -v"$(pwd)":/app maven:3.8.5-"${{ needs.retrieve-project.outputs.JDK }}" sh -c "mvn clean verify -DskipITs"

      - name: Return error
        if: ${{ always() && steps.build.outcome == 'failure' }}
        run: |
          gh issue comment -R "${{github.repository}}" "$ISSUE_NUMBER" \
          --body "#### :x: The project did not build correctly
          Tests could be failing.

          See the [workflow log](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more details."

      - name: Return success
        if: ${{ always() && steps.build.outcome == 'success' }}
        run: |
          gh issue comment -R "${{github.repository}}" "$ISSUE_NUMBER" \
          --body "#### :heavy_check_mark: The project has build successfully"

      - uses: actions/upload-artifact@v3
        with:
          name: packaged_project
          path: .

  deploy:
    runs-on: ubuntu-20.04
    needs: [retrieve-project, build-test]
    if: ${{ needs.retrieve-project.outputs.DEPLOY == '- [X] yes' }}
    steps:
      - name: Get project
        id: get-project
        uses: actions/download-artifact@v3
        with:
          name: packaged_project

      - name: Configure AWS credentials
        id: aws-login
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Return error
        if: ${{ always() && steps.aws-login.outcome == 'failure' }}
        run: |
          gh issue comment -R "${{github.repository}}" "$ISSUE_NUMBER" \
          --body "#### :x: Could not login in AWS
          Check the used aws credentials.

          See the [workflow log](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more details."

      - name: Return success
        if: ${{ always() && steps.aws-login.outcome == 'success' }}
        run: |
          gh issue comment -R "${{github.repository}}" "$ISSUE_NUMBER" \
          --body "#### :heavy_check_mark: Logged in AWS successfully"

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v1

      - name: Return error
        if: ${{ always() && steps.login-ecr.outcome == 'failure' }}
        run: |
          gh issue comment -R "${{github.repository}}" "$ISSUE_NUMBER" \
          --body "#### :x: Could not login in AWS ECR
          Check the used aws credentials.

          See the [workflow log](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more details."

      - name: Return success
        if: ${{ always() && steps.login-ecr.outcome == 'success' }}
        run: |
          gh issue comment -R "${{github.repository}}" "$ISSUE_NUMBER" \
          --body "#### :heavy_check_mark: Logged in AWS ECR successfully"

      - name: Build Images
        id: image-build
        run: |
          cd project
          docker-compose build

      - name: Return error
        if: ${{ always() && steps.image-build.outcome == 'failure' }}
        run: |
          gh issue comment -R "${{github.repository}}" "$ISSUE_NUMBER" \
          --body "#### :x: The docker images that compose the project could not be build
          A docker-compose file is needed in the root of the project in order to build it.

          See the [workflow log](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more details."

      - name: Return success
        if: ${{ always() && steps.image-build.outcome == 'success' }}
        run: |
          gh issue comment -R "${{github.repository}}" "$ISSUE_NUMBER" \
          --body "#### :heavy_check_mark: Docker images for every service were built successfully"

      - name: Create ECR registries and push images
        id: create-ecr
        env:
          REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          AWS_DEFAULT_REGION: $AWS_REGION
        run: |
          cd project
          docker image ls -f "reference=project_*" | awk '(NR>1) { print $1 }' > image_names
          cat image_names | xargs -I{} docker tag {} $REGISTRY/{}:latest
          cat image_names | xargs -I{} aws ecr create-repository \
            --repository-name {} \
            --image-scanning-configuration scanOnPush=true \
            --region $AWS_REGION
          cat image_names | xargs -I{} docker push $REGISTRY/{}:latest

      - name: Return error
        if: ${{ always() && steps.create-ecr.outcome == 'failure' }}
        run: |
          gh issue comment -R "${{github.repository}}" "$ISSUE_NUMBER" \
          --body "#### :x: The docker images that compose the project could not be pushed to the AWS ECR
          Check the following requirements:
            - The used aws credentials have rights to create AWS ECR repositories.
            - The aws region used is the one where you want to deploy the project and the one where the cluster is located.

          See the [workflow log](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more details."

      - name: Return success
        if: ${{ always() && steps.create-ecr.outcome == 'success' }}
        run: |
          gh issue comment -R "${{github.repository}}" "$ISSUE_NUMBER" \
          --body "#### :heavy_check_mark: Docker images were pushed to the private ECR registry successfully"

      - name: Tag images with ECR prefix
        id: tag-images
        env:
          REGISTRY: ${{ steps.login-ecr.outputs.registry }}
        run: |
          sed -i "s|${{ needs.retrieve-project.outputs.PROJECT_NAME }}|$REGISTRY/project|g" project/kubernetes-manifest.yaml

      - name: Return error
        if: ${{ always() && steps.tag-images.outcome == 'failure' }}
        run: |
          gh issue comment -R "${{github.repository}}" "$ISSUE_NUMBER" \
          --body "#### :x: The docker images that use the Kubernetes manifest could not be tagged with the ECR images
          Check the following requirements:
            - A Kubernetes manifest using the images composed by docker-compose exist in the root of the project (the image_name:tag should be the same).

          See the [workflow log](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more details."

      - name: Return success
        if: ${{ always() && steps.tag-images.outcome == 'success' }}
        run: |
          gh issue comment -R "${{github.repository}}" "$ISSUE_NUMBER" \
          --body "#### :heavy_check_mark: Docker images were updated in the Kubernetes manifest successfully"

      - name: Create VPC for EKS
        id: eks-vpc
        uses: aws-actions/aws-cloudformation-github-deploy@v1.0.4
        with:
          name: ${{ needs.retrieve-project.outputs.PROJECT_NAME }}-stack
          template: https://s3.us-west-2.amazonaws.com/amazon-eks/cloudformation/2020-10-29/amazon-eks-vpc-private-subnets.yaml
          no-fail-on-empty-changeset: "1"

      - name: Create Kubernetes cluster
        id: eks-cluster
        run: |

          rawoutput=$(aws cloudformation describe-stacks --stack-name ${{ needs.retrieve-project.outputs.PROJECT_NAME }}-stack |jq --raw-output '.Stacks[].Outputs[]')
          securitygroup=$(echo $rawoutput | jq --raw-output 'select(.OutputKey == "SecurityGroups").OutputValue')
          subnetids=$(echo $rawoutput | jq --raw-output 'select(.OutputKey == "SubnetIds").OutputValue')

          aws eks create-cluster --region ${{ env.AWS_REGION }} --name ${{ needs.retrieve-project.outputs.PROJECT_NAME }}-cluster --kubernetes-version 1.22 \
          --role-arn arn:aws:iam::${{ env.AWS_ACCOUNT_ID }}:role/eksClusterRoleMicroflow \
          --resources-vpc-config subnetIds=$subnetids,securityGroupIds=$securitygroup

          aws eks wait cluster-active --name ${{ needs.retrieve-project.outputs.PROJECT_NAME }}-cluster

          aws eks create-nodegroup --cluster-name ${{ needs.retrieve-project.outputs.PROJECT_NAME }}-cluster --nodegroup-name ${{ needs.retrieve-project.outputs.PROJECT_NAME }}-nodegroup \
            --subnets $(echo $subnetids | sed 's/,/ /g') --node-role arn:aws:iam::${{ env.AWS_ACCOUNT_ID }}:role/microflowClusterNodeGroupsRole \
            --scaling-config minSize=2,maxSize=3,desiredSize=3 --remote-access ec2SshKey=microflow-key-pair

      - name: Deploy to Kubernetes cluster
        id: deploy-k8s
        run: |

          aws eks wait nodegroup-active --nodegroup-name ${{ needs.retrieve-project.outputs.PROJECT_NAME }}-nodegroup --cluster-name ${{ needs.retrieve-project.outputs.PROJECT_NAME }}-cluster

          aws eks update-kubeconfig --region ${{ env.AWS_REGION }} --name ${{ needs.retrieve-project.outputs.PROJECT_NAME }}-cluster
          kubectl apply -f project/kubernetes-manifest.yaml

      - name: Return error
        if: ${{ always() && steps.deploy-k8s.outcome == 'failure' }}
        run: |
          gh issue comment -R "${{github.repository}}" "$ISSUE_NUMBER" \
          --body "#### :x: The Kubernetes manifest could not be applied
          Check the following requirements:
            - Check the kubernetes manifest file, that should be named, **kubernetes-manifest.yml**

          See the [workflow log](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more details."

      - name: Return success
        if: ${{ always() && steps.deploy-k8s.outcome == 'success' }}
        run: |
          gh issue comment -R "${{github.repository}}" "$ISSUE_NUMBER" \
          --body "#### :heavy_check_mark: The project was successfully deployed to the AWS EKS cluster"