pipeline.yml

name: "CI Pipeline"

on:
  push:
    branches: [main]
    paths-ignore:
      - "**/*.md"
  pull_request:
  # Allow to run this workflow manually
  workflow_dispatch:

jobs:
  ########################################
  # Jobs operating on the whole repository
  ########################################

  security-jobs:
    uses: ./.github/workflows/security-jobs.yml
    secrets: inherit # so the backend workflow can access "secrets.SLACK_WEBHOOK_URL" and others
    permissions:
      contents: read
      security-events: write # trivy scan needs this

  ###############
  # Frontend jobs
  ###############

  frontend-checks:
    uses: ./.github/workflows/frontend-checks.yml
    secrets: inherit

  frontend-build-image-and-scan:
    uses: ./.github/workflows/frontend-build-image-and-scan.yml
    secrets: inherit
    permissions:
      contents: read
      security-events: write
    with:
      run-id: ${{ github.run_id }}
      image-ref: ghcr.io/${{ github.repository }}-frontend:${{ github.event.pull_request.head.sha || github.sha }}

  frontend-push-image-to-registry:
    if: ${{ github.ref == 'refs/heads/main' }}
    # For PR releases, labels could be used like this:
    # if: ${{ github.ref == 'refs/heads/main' || contains(github.event.pull_request.labels.*.name, 'dev-env') || contains(github.event.labeled.labels.*.name, 'dev-env') }}
    needs:
      - security-jobs
      - frontend-checks
      - frontend-build-image-and-scan
    uses: ./.github/workflows/frontend-push-image-to-registry.yml
    secrets: inherit
    permissions:
      contents: read
      id-token: write # This is used to complete the identity challenge with sigstore/fulcio..
      packages: write
    with:
      run-id: ${{ github.run_id }}
      container-registry: ghcr.io
      image-ref: ghcr.io/${{ github.repository }}-frontend:${{ github.event.pull_request.head.sha || github.sha }}

  frontend-deploy-staging:
    if: ${{ github.ref == 'refs/heads/main' }}
    needs:
      - security-jobs
      - frontend-checks
      - frontend-build-image-and-scan
      - frontend-push-image-to-registry
    uses: ./.github/workflows/frontend-deploy-staging.yml
    permissions:
      id-token: write
    secrets: inherit
    with:
      container-image-version: ${{ github.event.pull_request.head.sha || github.sha }}