stack/.gitea/workflows/deploy.yml

# DO NOT EDIT — generated by gen_config.py from stack.toml
# Re-generate: uv run python dev/scripts/gen_config.py

name: Deploy

on:
  push:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: https://github.com/actions/checkout@v4

      - name: Set up Docker Buildx
        uses: https://github.com/docker/setup-buildx-action@v3

      - name: Log in to container registry
        uses: https://github.com/docker/login-action@v3
        with:
          registry: gitea.homelab.fhirworx.io
          username: ${{ secrets.REGISTRY_USER }}
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Compute short SHA
        run: echo "SHORT_SHA=${{GITHUB_SHA::8}}" >> "$GITHUB_ENV"

      - name: Build notebooks
        uses: https://github.com/docker/build-push-action@v6
        with:
          context: notebooks/
          file: notebooks/Dockerfile
          push: true
          tags: gitea.homelab.fhirworx.io/homelab/stack/notebooks:${{ env.SHORT_SHA }},gitea.homelab.fhirworx.io/homelab/stack/notebooks:latest

      - name: Build zotero
        uses: https://github.com/docker/build-push-action@v6
        with:
          context: zotero/
          file: zotero/Dockerfile
          push: true
          tags: gitea.homelab.fhirworx.io/homelab/stack/zotero:${{ env.SHORT_SHA }},gitea.homelab.fhirworx.io/homelab/stack/zotero:latest

      - name: Build docs
        uses: https://github.com/docker/build-push-action@v6
        with:
          context: .
          file: docs/Dockerfile
          push: true
          tags: gitea.homelab.fhirworx.io/homelab/stack/docs:${{ env.SHORT_SHA }},gitea.homelab.fhirworx.io/homelab/stack/docs:latest

      - name: Build api
        uses: https://github.com/docker/build-push-action@v6
        with:
          context: .
          file: api/Dockerfile
          push: true
          tags: gitea.homelab.fhirworx.io/homelab/stack/api:${{ env.SHORT_SHA }},gitea.homelab.fhirworx.io/homelab/stack/api:latest

      - name: Build mc
        uses: https://github.com/docker/build-push-action@v6
        with:
          context: rustfs/
          file: rustfs/Dockerfile.mc
          push: true
          tags: gitea.homelab.fhirworx.io/homelab/stack/mc:${{ env.SHORT_SHA }},gitea.homelab.fhirworx.io/homelab/stack/mc:latest

  scan:
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Checkout
        uses: https://github.com/actions/checkout@v4

      - name: Compute short SHA
        run: echo "SHORT_SHA=${{GITHUB_SHA::8}}" >> "$GITHUB_ENV"

      - name: Scan notebooks
        uses: https://github.com/aquasecurity/trivy-action@master
        with:
          image-ref: gitea.homelab.fhirworx.io/homelab/stack/notebooks:${{ env.SHORT_SHA }}
          severity: HIGH,CRITICAL
          exit-code: "0"
          format: json
          output: notebooks-scan.json

      - name: Scan zotero
        uses: https://github.com/aquasecurity/trivy-action@master
        with:
          image-ref: gitea.homelab.fhirworx.io/homelab/stack/zotero:${{ env.SHORT_SHA }}
          severity: HIGH,CRITICAL
          exit-code: "0"
          format: json
          output: zotero-scan.json

      - name: Scan docs
        uses: https://github.com/aquasecurity/trivy-action@master
        with:
          image-ref: gitea.homelab.fhirworx.io/homelab/stack/docs:${{ env.SHORT_SHA }}
          severity: HIGH,CRITICAL
          exit-code: "0"
          format: json
          output: docs-scan.json

      - name: Scan api
        uses: https://github.com/aquasecurity/trivy-action@master
        with:
          image-ref: gitea.homelab.fhirworx.io/homelab/stack/api:${{ env.SHORT_SHA }}
          severity: HIGH,CRITICAL
          exit-code: "0"
          format: json
          output: api-scan.json

      - name: Upload scan results
        uses: https://github.com/actions/upload-artifact@v4
        with:
          name: trivy-scans
          path: "*-scan.json"

  report-vulns:
    runs-on: ubuntu-latest
    needs: scan
    steps:
      - name: Checkout
        uses: https://github.com/actions/checkout@v4

      - name: Set up uv
        run: curl -LsSf https://astral.sh/uv/install.sh | sh
        env:
          UV_INSTALL_DIR: /usr/local/bin

      - name: Download scan results
        uses: https://github.com/actions/download-artifact@v4
        with:
          name: trivy-scans

      - name: Report vulnerabilities
        env:
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
        run: |
          uv sync --no-dev
          for f in notebooks-scan.json zotero-scan.json docs-scan.json api-scan.json; do
            [ -f "$f" ] && uv run python -m api.diag.vuln "$f" || true
          done