name: CICD Workflow for DEV Env

on:
  push:
    branches:
      - operator_BR

env:
  GIT_HELM_BRANCH: "main"

jobs:

  gitleaks-scan:
    uses: SG-ContentHub/sg-multiplay/.github/workflows/gitleaks-scan.yaml@ilottery-demo
  
  build-job:
    runs-on: arc-runners-content-hub
    env:
      AWS_REGION: ${{ vars.AWS_REGION }}
      SNYK_VERSION: ${{ vars.SNYK_VERSION }}
      SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
      SNYK_ORG_ID: ${{ secrets.SNYK_ORG_ID }}
      PROJECT_NAME: ${{ github.event.repository.name }}
      PLATFORM_ECR_ACCOUNT: ${{ vars.PLATFORM_ECR_ACCOUNT }}

    steps:
      - name: Checkout Code
        uses: actions/checkout@v4
  build:
    name: Build
    runs-on: arc-runners-content-hub
    steps:
      - name: Checkout code
        uses: actions/checkout@v4       

      - name: Extract branch name and SHA_SHORT
        id: extract_sha_branch
        run: |
          echo "branch=$(echo ${GITHUB_REF#refs/heads/})" >> $GITHUB_OUTPUT
          echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
    
      - name: Authenticate with Vault using AppRole
        run: |
          export VAULT_ADDR=${{ vars.VAULT_ADDR }}
          export VAULT_NAMESPACE=${{ vars.VAULT_NAMESPACE }}
          VAULT_TOKEN=$(vault write -field=token auth/approle/login role_id="${{ secrets.VAULT_ROLE_ID }}" secret_id="${{ secrets.VAULT_SECRET_ID }}")
          echo "VAULT_TOKEN=$VAULT_TOKEN" >> $GITHUB_ENV
          echo "::add-mask::$VAULT_TOKEN"
        shell: bash

      - name: Retrieve Dynamic AWS Credentials from Vault
        run: |
          export VAULT_ADDR=${{ vars.VAULT_ADDR }}
          export VAULT_NAMESPACE=${{ vars.VAULT_NAMESPACE }}
          export VAULT_TOKEN=${{ env.VAULT_TOKEN }}
          vault read -format=json aws-platform-services/creds/sg-platformservices-platformsupport > aws-creds.json
          export AWS_ACCESS_KEY_ID=$(jq -r '.data.access_key' < aws-creds.json)
          export AWS_SECRET_ACCESS_KEY=$(jq -r '.data.secret_key' < aws-creds.json)
          echo "AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}" >> $GITHUB_ENV
          echo "AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}" >> $GITHUB_ENV
          echo "::add-mask::${AWS_ACCESS_KEY_ID}"
          echo "::add-mask::${AWS_SECRET_ACCESS_KEY}"
        shell: bash

      - name: Log in to Amazon ECR
        run: |
          echo "Sleeping for 10 seconds..."
          sleep 10
          export AWS_ACCESS_KEY_ID=${{ env.AWS_ACCESS_KEY_ID }}
          export AWS_SECRET_ACCESS_KEY=${{ env.AWS_SECRET_ACCESS_KEY }}
          unset AWS_SESSION_TOKEN
          aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin ${{ secrets.platform_ecr }}
        shell: bash

      - name: Build Docker image
        run: docker build -t sgch-overlay .

      - name: Run Snyk to check for vulnerabilities
        uses: snyk/actions/maven-3-jdk-21@master
        continue-on-error: true
        with:
          command: test
          args: --all-projects
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

      - name: Send Image Snyk results to Snyk Web UI
        if: always()
        uses: snyk/actions/maven-3-jdk-21@master
        with:
          command: monitor
          args: --project-name=${{ env.PROJECT_NAME }} --org=${{ env.SNYK_ORG_ID }}
        continue-on-error: true
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

      - name: Tag Docker image
        run: docker tag sgch-overlay:latest ${{ secrets.platform_ecr }}/content-hub/overlay:${{ steps.extract_sha_branch.outputs.branch }}-${{ steps.extract_sha_branch.outputs.sha_short }}

      # - name: Tag Docker image with Git tag
      #   run: |
      #     docker tag sgch-irgs:latest ${{ secrets.platform_ecr }}/content-hub/irgs:${{ steps.extract_tag.outputs.tag_name }}

      - name: Run Snyk Scan on Built Image (Pre-Push)
        id: snyk_container_test
        continue-on-error: true
        run: |
          echo "Running Snyk Container Test..."
          snyk container test --target-reference="Dockerfile" ${{ vars.DOCKER_REGISTRY }}/${{ vars.CONTENTHUB_NAMESPACE }}/${{ vars.IMAGE_NAME }}:${{ github.event.inputs.version || github.ref_name }} \
            --file=Dockerfile \
            --json-stream | tee snyk-container-results.json
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}


      - name: Push Docker image
        run: docker push ${{ secrets.platform_ecr }}/content-hub/overlay:${{ steps.extract_sha_branch.outputs.branch }}-${{ steps.extract_sha_branch.outputs.sha_short }}          

      # - name: Push Docker image
      #   run: docker push ${{ secrets.platform_ecr }}/content-hub/irgs:${{ steps.extract_tag.outputs.tag_name }}

      - name: Clone Helm Charts Repository
        run: |
          git clone https://${{ secrets.GH_DEVOPS_RW_USER_NAME }}:${{ secrets.GH_DEVOPS_RW_USER_TOKEN }}@github.com/sg-is-devops/contenthub-values.git
          cd contenthub-values
          git checkout ${GIT_HELM_BRANCH}

      - name: Configure Git Credentials
        run: |
          git config --global user.name "sgghdevops.rw"
          git config --global user.email "sgghdevops.rw@sgilottery.com"
          git config --global credential.helper cache

      - name: Update Helm Image Tag
            
        run: |
          pwd
          ls -l
          cd ./contenthub-values
          sed -i "/sgch-overlay:/,/tag:/ s|^\(\s*tag:\s*\).*|\1${{ steps.extract_sha_branch.outputs.branch }}-${{ steps.extract_sha_branch.outputs.sha_short }}|" values-us-ch-dev.yaml
          cat ./values-us-ch-dev.yaml
          git add .
          git commit -m "CI/CD pipeline updated ${{ steps.extract_sha_branch.outputs.branch }}-${{ steps.extract_sha_branch.outputs.sha_short }} image to new image tag"
          git push origin ${{ env.GIT_HELM_BRANCH }}     

      - name: Verify Deployment
        run: |

          echo "Deployment completed successfully! to env"