Develop #90
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - develop # Thêm nhánh develop vào đây | |
| pull_request: | |
| branches: | |
| - main | |
| - develop # Thêm nhánh develop vào đây | |
| jobs: | |
| quality: | |
| name: Quality Gate | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout source | |
| uses: actions/checkout@v4 | |
| - name: Set up Java | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: temurin | |
| java-version: '21' | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '22' | |
| cache: npm | |
| cache-dependency-path: frontend/package-lock.json | |
| - name: Make mvnw executable | |
| working-directory: backend | |
| run: chmod +x mvnw | |
| - name: Backend tests | |
| working-directory: backend | |
| run: ./mvnw test | |
| - name: Frontend install | |
| working-directory: frontend | |
| run: npm ci | |
| - name: Frontend lint | |
| working-directory: frontend | |
| run: npm run lint | |
| - name: Frontend build | |
| working-directory: frontend | |
| run: npm run build | |
| - name: Trivy filesystem scan | |
| uses: aquasecurity/trivy-action@v0.36.0 | |
| with: | |
| scan-type: fs | |
| scan-ref: . | |
| scanners: vuln,secret,misconfig | |
| severity: CRITICAL | |
| exit-code: '1' | |
| ignore-unfixed: true | |
| docker: | |
| name: Build and Push Docker Images | |
| runs-on: ubuntu-latest | |
| needs: quality | |
| permissions: | |
| contents: read | |
| packages: write | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository }} | |
| steps: | |
| - name: Checkout source | |
| uses: actions/checkout@v4 | |
| - name: Log in to GHCR | |
| run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login $REGISTRY -u ${{ github.actor }} --password-stdin | |
| - name: Set image tags | |
| run: | | |
| BRANCH_NAME="${GITHUB_HEAD_REF:-$GITHUB_REF_NAME}" | |
| BRANCH_NAME="${BRANCH_NAME//\//-}" | |
| if [ "${BRANCH_NAME}" = "main" ]; then | |
| echo "BACKEND_TAGS=$REGISTRY/$IMAGE_NAME/backend:latest,$REGISTRY/$IMAGE_NAME/backend:${GITHUB_SHA}" >> $GITHUB_ENV | |
| echo "FRONTEND_TAGS=$REGISTRY/$IMAGE_NAME/frontend:latest,$REGISTRY/$IMAGE_NAME/frontend:${GITHUB_SHA}" >> $GITHUB_ENV | |
| elif [ "${BRANCH_NAME}" = "develop" ]; then | |
| echo "BACKEND_TAGS=$REGISTRY/$IMAGE_NAME/backend:dev,$REGISTRY/$IMAGE_NAME/backend:${GITHUB_SHA}" >> $GITHUB_ENV | |
| echo "FRONTEND_TAGS=$REGISTRY/$IMAGE_NAME/frontend:dev,$REGISTRY/$IMAGE_NAME/frontend:${GITHUB_SHA}" >> $GITHUB_ENV | |
| else | |
| echo "BACKEND_TAGS=$REGISTRY/$IMAGE_NAME/backend:${BRANCH_NAME},$REGISTRY/$IMAGE_NAME/backend:${GITHUB_SHA}" >> $GITHUB_ENV | |
| echo "FRONTEND_TAGS=$REGISTRY/$IMAGE_NAME/frontend:${BRANCH_NAME},$REGISTRY/$IMAGE_NAME/frontend:${GITHUB_SHA}" >> $GITHUB_ENV | |
| fi | |
| - name: Build backend image | |
| run: | | |
| IFS=',' read -ra TAGS <<< "$BACKEND_TAGS" | |
| BUILD_ARGS="" | |
| for tag in "${TAGS[@]}"; do | |
| BUILD_ARGS="$BUILD_ARGS -t $tag" | |
| done | |
| docker build $BUILD_ARGS ./backend | |
| - name: Build frontend image | |
| run: | | |
| IFS=',' read -ra TAGS <<< "$FRONTEND_TAGS" | |
| BUILD_ARGS="" | |
| for tag in "${TAGS[@]}"; do | |
| BUILD_ARGS="$BUILD_ARGS -t $tag" | |
| done | |
| docker build $BUILD_ARGS ./frontend | |
| - name: Trivy backend image scan | |
| uses: aquasecurity/trivy-action@v0.36.0 | |
| with: | |
| image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/backend:${{ github.sha }} | |
| scanners: vuln,secret | |
| severity: CRITICAL | |
| exit-code: '1' | |
| ignore-unfixed: true | |
| - name: Trivy frontend image scan | |
| uses: aquasecurity/trivy-action@v0.36.0 | |
| with: | |
| image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/frontend:${{ github.sha }} | |
| scanners: vuln,secret | |
| severity: CRITICAL | |
| exit-code: '1' | |
| ignore-unfixed: true | |
| - name: Push backend image | |
| if: github.event_name == 'push' | |
| run: | | |
| IFS=',' read -ra TAGS <<< "$BACKEND_TAGS" | |
| for tag in "${TAGS[@]}"; do | |
| docker push "$tag" | |
| done | |
| - name: Push frontend image | |
| if: github.event_name == 'push' | |
| run: | | |
| IFS=',' read -ra TAGS <<< "$FRONTEND_TAGS" | |
| for tag in "${TAGS[@]}"; do | |
| docker push "$tag" | |
| done |