OBP-API/.github/workflows/build_container.yml at develop · constantine2nd/OBP-API · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
name: Build and publish container develop

# read-write repo token
# access to secrets
on: [push]

env:
  DOCKER_HUB_ORGANIZATION: ${{ vars.DOCKER_HUB_ORGANIZATION }}
  DOCKER_HUB_REPOSITORY: obp-api

jobs:
  build:
    runs-on: ubuntu-latest
    services:
      redis:
        image: redis
        ports:
          - 6379:6379
        # Set health checks to wait until redis has started
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK 11
        uses: actions/setup-java@v4
        with:
          java-version: "11"
          distribution: "adopt"
          cache: maven
      - name: Build with Maven
        run: |
          set -o pipefail
          cp obp-api/src/main/resources/props/sample.props.template obp-api/src/main/resources/props/production.default.props
          echo connector=star > obp-api/src/main/resources/props/test.default.props
          echo starConnector_supported_types=mapped,internal >> obp-api/src/main/resources/props/test.default.props
          echo hostname=http://localhost:8016 >> obp-api/src/main/resources/props/test.default.props
          echo tests.port=8016 >> obp-api/src/main/resources/props/test.default.props
          echo End of minimum settings >> obp-api/src/main/resources/props/test.default.props
          echo payments_enabled=false >> obp-api/src/main/resources/props/test.default.props
          echo importer_secret=change_me >> obp-api/src/main/resources/props/test.default.props
          echo messageQueue.updateBankAccountsTransaction=false >> obp-api/src/main/resources/props/test.default.props
          echo messageQueue.createBankAccounts=false >> obp-api/src/main/resources/props/test.default.props
          echo allow_sandbox_account_creation=true >> obp-api/src/main/resources/props/test.default.props
          echo allow_sandbox_data_import=true >> obp-api/src/main/resources/props/test.default.props
          echo sandbox_data_import_secret=change_me >> obp-api/src/main/resources/props/test.default.props
          echo allow_account_deletion=true >> obp-api/src/main/resources/props/test.default.props
          echo allowed_internal_redirect_urls = /,/oauth/authorize >> obp-api/src/main/resources/props/test.default.props
          echo transactionRequests_enabled=true >> obp-api/src/main/resources/props/test.default.props
          echo transactionRequests_supported_types=SEPA,SANDBOX_TAN,FREE_FORM,COUNTERPARTY,ACCOUNT,SIMPLE >> obp-api/src/main/resources/props/test.default.props
          echo SIMPLE_OTP_INSTRUCTION_TRANSPORT=dummy >> obp-api/src/main/resources/props/test.default.props
          echo openredirects.hostname.whitlelist=http://127.0.0.1,http://localhost >> obp-api/src/main/resources/props/test.default.props
          echo remotedata.secret = foobarbaz >> obp-api/src/main/resources/props/test.default.props
          echo allow_public_views=true >> obp-api/src/main/resources/props/test.default.props

          echo SIMPLE_OTP_INSTRUCTION_TRANSPORT=dummy >> obp-api/src/main/resources/props/test.default.props
          echo ACCOUNT_OTP_INSTRUCTION_TRANSPORT=dummy >> obp-api/src/main/resources/props/test.default.props
          echo SEPA_OTP_INSTRUCTION_TRANSPORT=dummy >> obp-api/src/main/resources/props/test.default.props
          echo FREE_FORM_OTP_INSTRUCTION_TRANSPORT=dummy >> obp-api/src/main/resources/props/test.default.props
          echo COUNTERPARTY_OTP_INSTRUCTION_TRANSPORT=dummy >> obp-api/src/main/resources/props/test.default.props
          echo SEPA_CREDIT_TRANSFERS_OTP_INSTRUCTION_TRANSPORT=dummy >> obp-api/src/main/resources/props/test.default.props

          echo allow_oauth2_login=true >> obp-api/src/main/resources/props/test.default.props
          echo oauth2.jwk_set.url=https://www.googleapis.com/oauth2/v3/certs >> obp-api/src/main/resources/props/test.default.props

          echo ResetPasswordUrlEnabled=true >> obp-api/src/main/resources/props/test.default.props

          echo consents.allowed=true >> obp-api/src/main/resources/props/test.default.props
          MAVEN_OPTS="-Xmx3G -Xss2m -XX:MaxMetaspaceSize=1G" mvn clean package -T 4 -Pprod > maven-build.log 2>&1

      - name: Report failing tests (if any)
        if: always()
        run: |
          echo "Checking build log for failing tests via grep..."
          if [ ! -f maven-build.log ]; then
            echo "No maven-build.log found; skipping failure scan."
            exit 0
          fi
          if grep -C 3 -n "\*\*\* FAILED \*\*\*" maven-build.log; then
            echo "Failing tests detected above."
            exit 1
          else
            echo "No failing tests detected in maven-build.log."
          fi

      - name: Upload Maven build log
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: maven-build-log
          if-no-files-found: ignore
          path: |
            maven-build.log

      - name: Upload test reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: test-reports
          if-no-files-found: ignore
          path: |
            obp-api/target/surefire-reports/**
            obp-commons/target/surefire-reports/**
            **/target/scalatest-reports/**
            **/target/site/surefire-report.html
            **/target/site/surefire-report/*

      - name: Save .jar artifact
        continue-on-error: true
        run: |
          mkdir -p ./push
          cp obp-api/target/obp-api.jar ./push/
      - uses: actions/upload-artifact@v4
        with:
          name: ${{ github.sha }}
          path: push/

      - name: Build the Docker image
        if: vars.ENABLE_CONTAINER_BUILDING == 'true'
        run: |
          echo "${{ secrets.DOCKER_HUB_TOKEN }}" | docker login -u "${{ secrets.DOCKER_HUB_USERNAME }}" --password-stdin docker.io
          if [ "${{ github.ref }}" == "refs/heads/develop" ]; then
            docker build . --file .github/Dockerfile_PreBuild --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:$GITHUB_SHA --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:latest --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:${GITHUB_REF##*/}
          else
            docker build . --file .github/Dockerfile_PreBuild --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:$GITHUB_SHA --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:${GITHUB_REF##*/}
          fi
          docker push docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }} --all-tags
          echo docker done

      - uses: sigstore/cosign-installer@4d14d7f17e7112af04ea6108fbb4bfc714c00390

      - name: Write signing key to disk (only needed for `cosign sign --key`)
        if: vars.ENABLE_CONTAINER_BUILDING == 'true'
        run: echo "${{ secrets.COSIGN_PRIVATE_KEY }}" > cosign.key

      - name: Sign container image
        if: vars.ENABLE_CONTAINER_BUILDING == 'true'
        run: |
          cosign sign -y --key cosign.key \
            docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:${GITHUB_REF##*/}
          cosign sign -y --key cosign.key \
                      docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:$GITHUB_SHA
          if [ "${{ github.ref }}" == "refs/heads/develop" ]; then
            cosign sign -y --key cosign.key \
                        docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:latest
          fi
        env:
          COSIGN_PASSWORD: "${{secrets.COSIGN_PASSWORD}}"