ci-spring-boot-build-publish-image.yml

# Workflow Name: Build/publish Spring Boot container image
#
# Owner: Digdir Platform team
#
# Purpose:
#   This is the golden path workflow for building and publishing Spring Boot
#   container images. The workflow should not be used directly, but called from
#.  the ci-build-publish-image workflow, which will handle input validation and
#   trigger this workflow with the correct parameters. The workflow will build
#   a Spring Boot image based on the 'application-path' and 'module-name' input
#.  parameters, which determines whether to build from a module or the root
#   application. The workflow will use Paketo buildpacks for building the
#   image, and the specific builder image can be configured through inputs.
#   After building the image, the workflow will run Trivy vulnerability scans,
#   push the image to the specified container registry, and optionally sign the
#   image. The workflow will also set outputs for the image version and digest,
#   which can be used in subsequent steps or workflows. If any step fails, a
#   Slack notification will be sent to the specified channel(s).
#
#   Flow:
#     1. Set image metadata (name and tag)
#     2. Checkout repository
#     3. Set up JDK
#.    4. Optionally update versions in application.yaml with the generated
#        image tag
#     5. Build Spring Boot image using Paketo buildpacks. The image will be
#        built based on the application path or module name (if provided)
#     6. Run Trivy vulnerability scan on the built image
#     7. Login to container registry
#     8. Push image to container registry
#     9. Set image digest output
#     10. Run Trivy SBOM generation
#     11. Optionally sign the image
#     12. If any step fails, send Slack notification to specified channel(s)
#
# Trigger:
#   Triggered by workflow calls (workflow_call)
#
# Inputs:
#   See input section
#
# Outputs:
#   See output section
#

name: Build and publish Spring Boot container image

permissions: {}

on:
  workflow_call:
    inputs:
      image-name:
        description: Name of Docker image
        required: false
        type: string
      image-pack:
        description: Paketo builder image to use. See https://paketo.io/docs/reference/builders-reference/ for choices
        default: builder-noble-java-tiny
        required: false
        type: string
      image-pack-tag:
        description: Docker image pack version tag
        default: "latest"
        required: false
        type: string
      image-signing:
        description: Flag to toggle image signing on/off - default off
        default: true
        required: false
        type: boolean
      java-version:
        description: Main version of java
        default: "25"
        required: false
        type: string
      java-distribution:
        description: Java distribution to use
        default: "liberica"
        required: false
        type: string
      slack-channel-id:
        description: Team channel id
        default: ""
        required: false
        type: string
      application-path:
        description: Path to the application to build, relative to the repository root
        default: "./"
        required: false
        type: string
      module-name:
        description: Name of the module to build, if using a multi-module Maven project. If not provided, the workflow will attempt to build the application based on the application-path input
        default: ""
        required: false
        type: string
      image-tag:
        description: Custom image tag, if not provided a tag will be auto-generated
        default: ""
        required: false
        type: string
      cache-path:
        description: Path to cache dependencies, relative to the repository root
        default: "**/pom.xml"
        required: false
        type: string
      update-versions:
        description: Flag to toggle whether to update versions in application.yaml with the generated image tag
        default: "true"
        required: false
        type: string
      container-registry:
        description: Container Registry url
        default: "creiddev.azurecr.io"
        required: false
        type: string
      sp-container-registry-client-id:
        description: Service Principal used for container registry in inputs
        required: false
        default: "AZURE_CLIENT_ID"
        type: string
      trivy-library-disable-scan:
        description: Disable Trivy library scan
        type: boolean
        required: false
        default: false
      trivy-library-ignore-unfixed:
        description: Ignore unfixed vulnerabilities in Trivy library scan
        type: boolean
        required: false
        default: true
      trivy-library-severity:
        description: When to fail the scan with Trivy library vulnerabilities
        type: string
        required: false
        default: 'HIGH,CRITICAL'
      trivy-os-disable-scan:
        description: Disable Trivy OS scan
        type: boolean
        required: false
        default: false
      trivy-os-ignore-unfixed:
        description: Ignore unfixed vulnerabilities in Trivy OS scan
        type: boolean
        required: false
        default: true
      trivy-os-severity:
        description: When to fail the scan with Trivy OS vulnerabilities
        type: string
        required: false
        default: 'CRITICAL'
      trivy-version:
        description: Version of Trivy to use for scanning
        type: string
        required: false
        default: ''

    outputs:
      image-version:
        description: "Docker image version"
        value: ${{ jobs.build-publish-image.outputs.image-tag }}
      image-digest:
        description: "Docker image SHA256 digest"
        value: ${{ jobs.build-publish-image.outputs.image-digest }}

jobs:
  inputs-to-summary:
    runs-on: ubuntu-latest
    steps:
      - name: Write inputs to summary
        uses: felleslosninger/github-workflows/.github/actions/json-to-summary@main
        with:
          json-payload: ${{ toJson(inputs) }}

  build-publish-image:
    runs-on: ubuntu-latest

    outputs:
      image-tag: ${{ steps.image-metadata.outputs.image-tag }}
      image-digest: ${{ steps.set-image-digest.outputs.image-digest }}

    permissions:
      id-token: write
      contents: write
      packages: write

    steps:
      - name: Set image metadata
        id: image-metadata
        uses: felleslosninger/github-workflows/.github/actions/image-metadata@main
        with:
          image-name: ${{ inputs.image-name }}
          container-registry: ${{ inputs.container-registry }}
          image-tag: ${{ inputs.image-tag }}

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.2

      - name: Set up JDK ${{ inputs.java-version }}
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # pin@v5.2.0
        with:
          distribution: "${{ inputs.java-distribution }}"
          java-version: ${{ inputs.java-version }}
          cache: maven
          cache-dependency-path: ${{ inputs.cache-path }}
          server-id: github
          server-username: GH_PACKAGES_READ_USER
          server-password: GH_PACKAGES_READ_PAT

      - name: Maven update version used in application.yaml
        env:
          GH_PACKAGES_READ_USER: ${{ secrets.GH_PACKAGES_READ_USER }}
          GH_PACKAGES_READ_PAT: ${{ secrets.GH_PACKAGES_READ_PAT }}
          UPDATE_VERSIONS: ${{ inputs.update-versions }}
          IMAGE_TAG: ${{ steps.image-metadata.outputs.image-tag }}
        run: |
          if [ "$UPDATE_VERSIONS" == "true" ]; then
            mvn versions:set -B -DnewVersion="$IMAGE_TAG"
            echo "- \`mvn versions\` was executed" >> "$GITHUB_STEP_SUMMARY"
          else
            echo "- \`mvn versions\` was not executed" >> "$GITHUB_STEP_SUMMARY"
          fi

      - name: Build image with Maven/Spring Boot (module-name)
        if: inputs.module-name != ''
        env:
          GH_PACKAGES_READ_USER: ${{ secrets.GH_PACKAGES_READ_USER }}
          GH_PACKAGES_READ_PAT: ${{ secrets.GH_PACKAGES_READ_PAT }}
          MODULE_NAME: ${{ inputs.module-name }}
          IMAGE_NAME: ${{ steps.image-metadata.outputs.image-name }}
          IMAGE_TAG: ${{ steps.image-metadata.outputs.image-tag }}
          IMAGE_PACK: ${{ inputs.image-pack }}
          IMAGE_PACK_TAG: ${{ inputs.image-pack-tag }}
        run: |
          mvn install -B spring-boot:build-image \
            -pl "$MODULE_NAME" -am  \
            -Dspring-boot.build-image.imageName="$IMAGE_NAME:$IMAGE_TAG" \
            -Dspring-boot.build-image.builder="paketobuildpacks/$IMAGE_PACK:$IMAGE_PACK_TAG" \
            -Dspring-boot.build-image.createdDate=now

      - name: Build image with Maven/Spring Boot (application-path)
        if: inputs.module-name == ''
        env:
          GH_PACKAGES_READ_USER: ${{ secrets.GH_PACKAGES_READ_USER }}
          GH_PACKAGES_READ_PAT: ${{ secrets.GH_PACKAGES_READ_PAT }}
          APP_PATH: ${{ inputs.application-path }}
          IMAGE_NAME: ${{ steps.image-metadata.outputs.image-name }}
          IMAGE_TAG: ${{ steps.image-metadata.outputs.image-tag }}
          IMAGE_PACK: ${{ inputs.image-pack }}
          IMAGE_PACK_TAG: ${{ inputs.image-pack-tag }}
        run: |
          mvn -B spring-boot:build-image \
            --file "${APP_PATH}pom.xml" \
            -Dspring-boot.build-image.imageName="$IMAGE_NAME:$IMAGE_TAG" \
            -Dspring-boot.build-image.builder="paketobuildpacks/$IMAGE_PACK:$IMAGE_PACK_TAG" \
            -Dspring-boot.build-image.createdDate=now

      - name: Run Trivy vulnerability scanner
        uses: felleslosninger/github-workflows/.github/actions/trivy-scan@main
        with:
          image-ref: ${{ steps.image-metadata.outputs.image-name }}:${{ steps.image-metadata.outputs.image-tag }}
          application-path: ${{ inputs.application-path }}
          library-disable-scan: ${{ inputs.trivy-library-disable-scan }}
          library-ignore-unfixed: ${{ inputs.trivy-library-ignore-unfixed }}
          library-severity: ${{ inputs.trivy-library-severity }}
          os-disable-scan: ${{ inputs.trivy-os-disable-scan }}
          os-ignore-unfixed: ${{ inputs.trivy-os-ignore-unfixed }}
          os-severity: ${{ inputs.trivy-os-severity }}
          trivy-version: ${{ inputs.trivy-version }}

      # Login to GHCR if container-registry starts with ghcr.io
      - name: Login to GitHub Container Registry
        if: contains(inputs.container-registry, 'ghcr.io')
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # pin@v4.1.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: ACR login
        if: contains(inputs.container-registry, 'azurecr.io')
        uses: felleslosninger/github-workflows/.github/actions/acr-login@main
        with:
          client-id: ${{ secrets[inputs.sp-container-registry-client-id] }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          acr-name: ${{ inputs.container-registry }}

      - name: Push image
        env:
          IMAGE_NAME: ${{ steps.image-metadata.outputs.image-name }}
          IMAGE_TAG: ${{ steps.image-metadata.outputs.image-tag }}
        run: docker push "$IMAGE_NAME:$IMAGE_TAG"

      - name: Set image digest
        id: set-image-digest
        env:
          IMAGE_NAME: ${{ steps.image-metadata.outputs.image-name }}
          IMAGE_TAG: ${{ steps.image-metadata.outputs.image-tag }}
        run: |
          image_digest=$(docker inspect \
            --format='{{.RepoDigests}}' "$IMAGE_NAME:$IMAGE_TAG" \
            | cut -d '@' -f 2 \
            | cut -d ']' -f 1)
          echo "image-digest=$image_digest" >> "$GITHUB_OUTPUT"
          echo "- Image digest: $image_digest" >> "$GITHUB_STEP_SUMMARY"

      - name: Run Trivy SBOM generation
        uses: felleslosninger/github-workflows/.github/actions/trivy-sbom@main
        with:
          scan-type: image
          artifact-id: ${{ steps.image-metadata.outputs.image-name }}
          image-ref: "${{ steps.image-metadata.outputs.image-name }}@${{ steps.set-image-digest.outputs.image-digest }}"
          version: ${{ steps.image-metadata.outputs.image-tag }}
          # This is already done in Trivy vuln scan step
          skip-setup: true

      - name: Image signing
        if: inputs.image-signing == true
        uses: felleslosninger/github-workflows/.github/actions/image-signing@main
        with:
          image: ${{ steps.image-metadata.outputs.image-name }}:${{ steps.image-metadata.outputs.image-tag }}

  notify-on-errors:
    runs-on: ubuntu-latest
    needs: [build-publish-image]
    if: always() && contains(needs.*.result, 'failure')
    strategy:
      matrix:
        slack-channel: ["${{ inputs.slack-channel-id }}", "C05G4B8R2GG"]
    steps:
      - name: Send Slack notification
        uses: felleslosninger/github-actions/send-slack-notification@d7888fecafbf48e5845c8a0c76389f71c517ee6d # pin@v0.8.0
        with:
          slack-channel-id: ${{ matrix.slack-channel }}
          slack-bot-token: ${{ secrets.SLACK_CICD_NOTIFICATION_TOKEN }}
          failed: "true"