build-latest.yaml

name: build-latest
on:
  workflow_dispatch:
  pull_request:
    branches:
      - 2.28.5
    paths:
      - 'Dockerfile'
      - 'scripts/**'
      - 'build_data/**'
      - '.github/workflows/**'
  push:
    branches:
      - 2.28.5
    paths:
      - 'Dockerfile'
      - 'scripts/**'
      - 'build_data/**'
      - '.github/workflows/**'
#permissions:
#  contents: read
jobs:

  build-geoserver-docker-image:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    if: |
      github.actor != 'dependabot[bot]' &&
      !(
        contains(github.event.pull_request.title, '[skip-release]') ||
        contains(github.event.comment.body, '/skiprelease')
      )
    strategy:
      matrix:

        stablePluginBaseURL:
          - https://sourceforge.net/projects/geoserver/files/GeoServer
    steps:
      - uses: actions/checkout@v6
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
        
      - name: Check latest GeoServer version
        id: geoserver_check
        shell: bash
        run: |
          IMAGE_VERSION=3.12-slim
          docker run --rm \
            -v "$PWD/.github/workflows/scripts:/scripts" \
            -v "$GITHUB_OUTPUT:/github_output/github_output.txt" \
            python:${IMAGE_VERSION} \
            bash /scripts/check_geoserver_version.sh

      - name: Check tomcat version in the series
        id: tomcat_check
        shell: bash
        run: |
          IMAGE_VERSION=3.12-slim
          docker run --rm \
            -v "$PWD/.github/workflows/scripts:/scripts" \
            -v "$GITHUB_OUTPUT:/github_output/github_output.txt" \
            python:${IMAGE_VERSION} \
            bash /scripts/check_tomcat_version.sh

      - name: Check Java Home path
        id: java_home_check
        shell: bash
        run: |
          IMAGE_VERSION=${{ steps.tomcat_check.outputs.tomcat_version }}
          JAVA_HOME=$(
              docker run --rm \
                "tomcat:${IMAGE_VERSION}" \
                sh -c 'printf "%s" "$JAVA_HOME"'
            )
          echo "${JAVA_HOME}"
          echo "java_home=${JAVA_HOME}" >> $GITHUB_OUTPUT

      - name: Check GDAL version
        id: gdal_version_check
        shell: bash
        run: |
          IMAGE_VERSION=${{ steps.tomcat_check.outputs.tomcat_version }}
          docker run --rm \
            -v "$PWD/.github/workflows/scripts:/scripts" \
            -v "$GITHUB_OUTPUT:/github_output/github_output.txt" \
            tomcat:${IMAGE_VERSION} \
            bash /scripts/get_gdal_version.sh

      - name: Tomcat Digest for image used in build
        id: tomcat_digest
        shell: bash
        run: |
          PUBLISHED_TOMCAT="${{ steps.tomcat_check.outputs.tomcat_version }}"
          TOMCAT_DIGEST=$(docker inspect \
            --format='{{index .RepoDigests 0}}' \
            tomcat:${PUBLISHED_TOMCAT})
          echo "${TOMCAT_DIGEST}"
          echo "tomcat_sha=${TOMCAT_DIGEST}" >> $GITHUB_OUTPUT
          

      - name: Build image for production
        id: docker_build_production_image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: Dockerfile
          push: false
          load: true
          outputs: type=docker,dest=/tmp/geoserver_production.tar
          build-args: |
            IMAGE_VERSION=${{ steps.tomcat_check.outputs.tomcat_version }}
            JAVA_HOME=${{ steps.java_home_check.outputs.java_home }}
            GS_VERSION=${{ steps.geoserver_check.outputs.major }}.${{ steps.geoserver_check.outputs.minor }}.${{ steps.geoserver_check.outputs.bugfix }}
            WAR_URL=https://downloads.sourceforge.net/project/geoserver/GeoServer/${{ steps.geoserver_check.outputs.major }}.${{ steps.geoserver_check.outputs.minor }}.${{ steps.geoserver_check.outputs.bugfix }}/geoserver-${{ steps.geoserver_check.outputs.major }}.${{ steps.geoserver_check.outputs.minor }}.${{ steps.geoserver_check.outputs.bugfix }}-war.zip
            STABLE_PLUGIN_BASE_URL=${{ matrix.stablePluginBaseURL }}
            GDAL_VERSION=${{ steps.gdal_version_check.outputs.gdal_version }}
            TOMCAT_IMAGE_SHA=${{ steps.tomcat_digest.outputs.tomcat_sha }}
          cache-from: |
            type=gha,scope=prod
          cache-to: type=gha,scope=prod
          target: geoserver-prod
      - name: Build image for testing
        id: docker_build_testing_image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: Dockerfile
          push: false
          load: true
          tags: kartoza/geoserver:manual-build
          outputs: type=docker,dest=/tmp/geoserver.tar
          build-args: |
            IMAGE_VERSION=${{ steps.tomcat_check.outputs.tomcat_version }}
            JAVA_HOME=${{ steps.java_home_check.outputs.java_home }}
            GS_VERSION=${{ steps.geoserver_check.outputs.major }}.${{ steps.geoserver_check.outputs.minor }}.${{ steps.geoserver_check.outputs.bugfix }}
            WAR_URL=https://downloads.sourceforge.net/project/geoserver/GeoServer/${{ steps.geoserver_check.outputs.major }}.${{ steps.geoserver_check.outputs.minor }}.${{ steps.geoserver_check.outputs.bugfix }}/geoserver-${{ steps.geoserver_check.outputs.major }}.${{ steps.geoserver_check.outputs.minor }}.${{ steps.geoserver_check.outputs.bugfix }}-war.zip
            STABLE_PLUGIN_BASE_URL=${{ matrix.stablePluginBaseURL }}
            GDAL_VERSION=${{ steps.gdal_version_check.outputs.gdal_version }}
            TOMCAT_IMAGE_SHA=${{ steps.tomcat_digest.outputs.tomcat_sha }}
          cache-from: |
            type=gha,scope=prod
          cache-to: type=gha,scope=test
          target: geoserver-test
      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: kartoza-geoserver
          path: /tmp/geoserver.tar

  scan_image:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    if: |
      github.actor != 'dependabot[bot]' &&
      !(
        contains(github.event.pull_request.title, '[skip-release]') ||
        contains(github.event.comment.body, '/skiprelease')
      )
    #needs: [run-scenario-tests]
    needs: [build-geoserver-docker-image]
    steps:
      - uses: actions/checkout@v6
      - name: Download artifact
        uses: actions/download-artifact@v8
        with:
          name: kartoza-geoserver
          path: /tmp
      - name: Load image
        run: |
          docker load --input /tmp/geoserver.tar
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          format: 'sarif'
          ignore-unfixed: true
          image-ref: kartoza/geoserver:manual-build
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'
          vuln-type: 'os,library'

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: 'trivy-results.sarif'

  run-scenario-tests:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    if: |
      github.actor != 'dependabot[bot]' &&
      !(
        contains(github.event.pull_request.title, '[skip-release]') ||
        contains(github.event.comment.body, '/skiprelease')
      )
    needs: [ build-geoserver-docker-image]
    strategy:
      matrix:
        scenario:
          - gwc
          - login
          - stores
          - context
          - disk-quota
#          - clustering
#          - jdbconfig
          - libjpeg
#          - backup_restore
          - logging_profile
          - metrics
          - telemetry
          - upgrade
    steps:
      - uses: actions/checkout@v6
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
      - name: Build image for testing activeqm
        if: matrix.scenario == 'clustering'
        id: docker_build_testing_image_activeqm
        uses: docker/build-push-action@v7
        with:
          context: ./clustering/activemq-docker/
          file: ./clustering/activemq-docker/Dockerfile
          push: false
          load: true
          tags: kartoza/activemq-docker:manual-build
          outputs: type=docker,dest=/tmp/activemq.tar
          cache-from: |
            type=gha,scope=test
            type=gha,scope=prod
          cache-to: type=gha,scope=test
          target: activemq-prod
      - name: Upload artifact
        if: matrix.scenario == 'clustering'
        uses: actions/upload-artifact@v7
        with:
          name: kartoza-activemq
          path: /tmp/activemq.tar

      - uses: actions/checkout@v6
      - name: Download Geoserver artifact
        uses: actions/download-artifact@v8
        with:
          name: kartoza-geoserver
          path: /tmp
      - name: Load Geoserver image
        run: |
          docker load --input /tmp/geoserver.tar
      - name: Download ActiveMQ artifact
        if: matrix.scenario == 'clustering'
        uses: actions/download-artifact@v8
        with:
          name: kartoza-activemq
          path: /tmp
      - name: Load ActiveMQ image
        if: matrix.scenario == 'clustering'
        run: |
          docker load --input /tmp/activemq.tar
      - name: Run scenario test ${{ matrix.scenario }}
        working-directory: scenario_tests/${{ matrix.scenario }}
        env:
          COMPOSE_INTERACTIVE_NO_CLI: 1
          PRINT_TEST_LOGS: 1
        run: |
          # Use the built Docker image to run scenario tests
          bash ./test.sh