deploy-DEV.yml

---
#########################
#########################
## Deploy Docker Image ##
#########################
#########################

#
# Documentation:
# https://help.github.com/en/articles/workflow-syntax-for-github-actions
#

#######################################
# Start the job on all push to main #
#######################################
name: "Build & Deploy - DEV"
on:
  push:
    branches-ignore:
      - main
    paths-ignore:
      - .github/CONTRIBUTING.md
      - CHANGELOG.md
      - README.md
      - .github/workflows/slash-command-dispatch.yml
      - .github/workflows/help-command.yml
      - .github/workflows/build-command.yml
  pull_request:

###############
# Set the Job #
###############
permissions: {}

concurrency:
  group: ${{ github.ref_name }}-${{ github.workflow }}
  cancel-in-progress: true

jobs:
  ##################################################################
  # Producer: build the image, populate GHA buildx cache (no push) #
  ##################################################################
  build:
    name: Build Docker Image - DEV
    runs-on: ubuntu-latest
    permissions:
      contents: read
    # Prevent duplicate run from happening when a forked push is committed
    if: (github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository) && !contains(github.event.head_commit.message, 'skip deploy')
    timeout-minutes: 90
    outputs:
      image-tag: ${{ steps.meta.outputs.tags }}
      image-version: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}
      dockerfile: ${{ steps.setup.outputs.dockerfile }}
      cache-scope: ${{ steps.setup.outputs.cache-scope }}
      build-args: ${{ steps.setup.outputs.build-args }}
      is-quick: ${{ steps.setup.outputs.is-quick }}
    steps:
      - name: Checkout Code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Free Disk space
        shell: bash
        run: |
          sudo rm -rf /usr/local/lib/android  # will release about 10 GB if you don't need Android
          sudo rm -rf /usr/share/dotnet # will release about 20GB if you don't need .NET
          sudo rm -rf /opt/ghc
          sudo rm -rf "$AGENT_TOOLSDIRECTORY"
          sudo rm -rf /opt/hostedtoolcache/CodeQL # large cache
          sudo rm -rf /opt/hostedtoolcache/go # Go toolcache

      - name: Docker Metadata action
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
        id: meta
        with:
          images: |
            ${{ github.repository }}

      - name: Select Dockerfile, cache scope, and build args
        id: setup
        shell: bash
        env:
          COMMIT_MSG: ${{ github.event.head_commit.message }}
          META_CREATED: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }}
          META_VERSION: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}
          META_REVISION: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
        run: |
          if [[ "${COMMIT_MSG}" == *"quick build"* ]]; then
            {
              echo "is-quick=true"
              echo "dockerfile=Dockerfile-quick"
              echo "cache-scope=dev-quick"
              echo "build-args<<EOF"
              echo "BUILD_DATE=${META_CREATED}"
              echo "BUILD_VERSION=${META_VERSION}"
              echo "BUILD_REVISION=${META_REVISION}"
              echo "MEGALINTER_BASE_IMAGE=ghcr.io/oxsecurity/megalinter:beta"
              echo "EOF"
            } >> "${GITHUB_OUTPUT}"
          else
            {
              echo "is-quick=false"
              echo "dockerfile=Dockerfile"
              echo "cache-scope=dev-main"
              echo "build-args<<EOF"
              echo "BUILD_DATE=${META_CREATED}"
              echo "BUILD_VERSION=${META_VERSION}"
              echo "BUILD_REVISION=${META_REVISION}"
              echo "EOF"
            } >> "${GITHUB_OUTPUT}"
          fi

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4

      # Build once and export the image as a Docker tarball.
      # DEV is read-only on the layer cache: it consumes the warm caches
      # produced by the BETA workflow on main and never writes back. Writing
      # a fresh cache for a throwaway PR branch costs ~14 min of cache export
      # per build that nobody else reads, so we skip `cache-to` entirely here.
      - name: Build MegaLinter Docker Image
        id: docker_build
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        continue-on-error: true
        with:
          context: .
          file: ${{ steps.setup.outputs.dockerfile }}
          platforms: linux/amd64
          build-args: ${{ steps.setup.outputs.build-args }}
          secrets: |
            GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
          tags: ${{ steps.meta.outputs.tags }}
          cache-from: type=gha,scope=beta-main,ignore-error=true
          outputs: type=docker,dest=/tmp/megalinter-image.tar,compression=zstd,compression-level=3,force-compression=true
        timeout-minutes: 90

      # Fallback: if the cached build above failed (e.g. GHA cache returned a
      # stale manifest pointing to an evicted blob — buildx surfaces this as
      # 'ERROR: blob sha256:...: not found'), rebuild from scratch with no
      # cache-from. Slower but never blocks on cache corruption.
      - name: Build MegaLinter Docker Image (no-cache fallback)
        if: steps.docker_build.outcome == 'failure'
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        with:
          context: .
          file: ${{ steps.setup.outputs.dockerfile }}
          platforms: linux/amd64
          build-args: ${{ steps.setup.outputs.build-args }}
          secrets: |
            GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
          tags: ${{ steps.meta.outputs.tags }}
          outputs: type=docker,dest=/tmp/megalinter-image.tar,compression=zstd,compression-level=3,force-compression=true
        timeout-minutes: 90

      - name: Upload image artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: megalinter-image
          path: /tmp/megalinter-image.tar
          retention-days: 1
          if-no-files-found: error
          compression-level: 0

  ###############################################################
  # Consumer: Run linter test cases against the cached image    #
  ###############################################################
  test-cases:
    name: Run Test Cases - DEV
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: read
      # Require writing security events to upload SARIF file to security tab
      security-events: write
    timeout-minutes: 120
    steps:
      - name: Checkout Code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Free Disk space
        shell: bash
        run: |
          sudo rm -rf /usr/local/lib/android
          sudo rm -rf /usr/share/dotnet
          sudo rm -rf /opt/ghc
          sudo rm -rf "$AGENT_TOOLSDIRECTORY"
          sudo rm -rf /opt/hostedtoolcache/CodeQL
          sudo rm -rf /opt/hostedtoolcache/go

      - name: Download image artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: megalinter-image
          path: /tmp

      - name: Load Docker image
        shell: bash
        run: |
          set -euo pipefail
          docker load -i /tmp/megalinter-image.tar
          rm -f /tmp/megalinter-image.tar
          docker image ls

      - name: Run Test Cases
        shell: bash
        env:
          EVENT_NAME: ${{ github.event_name }}
          PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
          GH_REPOSITORY: ${{ github.repository }}
          HEAD_REF: ${{ github.head_ref }}
          REF_NAME: ${{ github.ref_name }}
          COMMIT_MSG: ${{ github.event.head_commit.message }}
          DOCKER_IMAGE: ${{ needs.build.outputs.image-tag }}
          GH_SHA: ${{ github.sha }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          GITHUB_REPOSITORY=$([ "$EVENT_NAME" == "pull_request" ] && echo "$PR_HEAD_REPO" || echo "$GH_REPOSITORY")
          GITHUB_BRANCH=$([ "$EVENT_NAME" == "pull_request" ] && echo "$HEAD_REF" || echo "$REF_NAME")

          CI_ENV="$(bash <(curl -s https://codecov.io/env)) -e GITHUB_ACTIONS"
          export CI_ENV
          TEST_KEYWORDS_TO_USE=""
          if [[ "${COMMIT_MSG}" == *"TEST_KEYWORDS="* ]]; then
            TEST_KEYWORDS_TO_USE=${COMMIT_MSG#*TEST_KEYWORDS=}
            echo "Run only tests with keywords ${TEST_KEYWORDS_TO_USE}"
            if [[ "${TEST_KEYWORDS_TO_USE}" =~ $'\r' ]]; then
                echo "Problem while parsing test keywords: switch back to all tests"
                TEST_KEYWORDS_TO_USE=""
            fi
          fi
          docker image ls
          # shellcheck disable=SC2086
          docker run $CI_ENV -e TEST_CASE_RUN=true -e OUTPUT_FORMAT=text -e OUTPUT_FOLDER="${GH_SHA}" -e OUTPUT_DETAIL=detailed -e GITHUB_SHA="${GH_SHA}" -e GITHUB_REPOSITORY="${GITHUB_REPOSITORY}" -e GITHUB_BRANCH="${GITHUB_BRANCH}" -e GITHUB_TOKEN="${GITHUB_TOKEN}" -e TEST_KEYWORDS="${TEST_KEYWORDS_TO_USE}" -e MEGALINTER_VOLUME_ROOT="${GITHUB_WORKSPACE}" -v "/var/run/docker.sock:/var/run/docker.sock:rw" -v "${GITHUB_WORKSPACE}:/tmp/lint" "${DOCKER_IMAGE}"
        timeout-minutes: 120

      - name: Archive production artifacts (test-cases)
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: MegaLinter reports (test-cases)
          include-hidden-files: "true"
          path: |
            megalinter-reports
            mega-linter.log
            linter-helps.json
            linter-versions.json

  ###############################################################
  # Consumer: Run megalinter against the entire code base       #
  ###############################################################
  run-all-code:
    name: Run against all code base - DEV
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: read
    if: needs.build.outputs.is-quick != 'true'
    timeout-minutes: 30
    steps:
      - name: Checkout Code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Free Disk space
        shell: bash
        run: |
          sudo rm -rf /usr/local/lib/android
          sudo rm -rf /usr/share/dotnet
          sudo rm -rf /opt/ghc
          sudo rm -rf "$AGENT_TOOLSDIRECTORY"
          sudo rm -rf /opt/hostedtoolcache/CodeQL
          sudo rm -rf /opt/hostedtoolcache/go

      - name: Download image artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: megalinter-image
          path: /tmp

      - name: Load Docker image
        shell: bash
        run: |
          set -euo pipefail
          docker load -i /tmp/megalinter-image.tar
          rm -f /tmp/megalinter-image.tar
          docker image ls

      - name: Run against all code base
        shell: bash
        env:
          DOCKER_IMAGE: ${{ needs.build.outputs.image-tag }}
          GH_REPOSITORY: ${{ github.repository }}
          GH_SHA: ${{ github.sha }}
          GH_TOKEN_VALUE: ${{ github.token }}
          GH_RUN_ID: ${{ github.run_id }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: docker run -e GITHUB_REPOSITORY="${GH_REPOSITORY}" -e GITHUB_SHA="${GH_SHA}" -e GITHUB_TOKEN="${GH_TOKEN_VALUE}" -e GITHUB_RUN_ID="${GH_RUN_ID}" -e GITHUB_TOKEN="${GITHUB_TOKEN}" -v "/var/run/docker.sock:/var/run/docker.sock:rw" -v "${GITHUB_WORKSPACE}:/tmp/lint" "${DOCKER_IMAGE}"
        timeout-minutes: 15

      - name: Archive production artifacts (run-all-code)
        if: success() || failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: MegaLinter reports (run-all-code)
          include-hidden-files: "true"
          path: |
            megalinter-reports
            mega-linter.log
            linter-helps.json
            linter-versions.json

  ###############################################################
  # Consumer: mega-linter-runner tests against the cached image #
  ###############################################################
  runner-tests:
    name: mega-linter-runner tests - DEV
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: read
    if: needs.build.outputs.is-quick != 'true'
    timeout-minutes: 30
    steps:
      - name: Checkout Code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Free Disk space
        shell: bash
        run: |
          sudo rm -rf /usr/local/lib/android
          sudo rm -rf /usr/share/dotnet
          sudo rm -rf /opt/ghc
          sudo rm -rf "$AGENT_TOOLSDIRECTORY"
          sudo rm -rf /opt/hostedtoolcache/CodeQL
          sudo rm -rf /opt/hostedtoolcache/go

      - name: Download image artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: megalinter-image
          path: /tmp

      - name: Load Docker image
        shell: bash
        run: |
          set -euo pipefail
          docker load -i /tmp/megalinter-image.tar
          rm -f /tmp/megalinter-image.tar
          docker image ls

      - name: Setup Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "24.x"

      - name: Install NPM dependencies
        run: cd mega-linter-runner && yarn install --frozen-lockfile && npm link

      - name: Run mega-linter-runner tests
        env:
          MEGALINTER_RELEASE: ${{ needs.build.outputs.image-version }}
          MEGALINTER_IMAGE: ${{ needs.build.outputs.image-tag }}
        run: cd mega-linter-runner && MEGALINTER_RELEASE="${MEGALINTER_RELEASE}" MEGALINTER_IMAGE="${MEGALINTER_IMAGE}" MEGALINTER_NO_DOCKER_PULL=true npm run test

  ###############################################################
  # Consumer: Trivy vulnerability scan                          #
  ###############################################################
  trivy:
    name: Trivy scan - DEV
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    timeout-minutes: 30
    steps:
      - name: Checkout Code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Free Disk space
        shell: bash
        run: |
          sudo rm -rf /usr/local/lib/android
          sudo rm -rf /usr/share/dotnet
          sudo rm -rf /opt/ghc
          sudo rm -rf "$AGENT_TOOLSDIRECTORY"
          sudo rm -rf /opt/hostedtoolcache/CodeQL
          sudo rm -rf /opt/hostedtoolcache/go

      - name: Download image artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: megalinter-image
          path: /tmp

      - name: Load Docker image
        shell: bash
        run: |
          set -euo pipefail
          docker load -i /tmp/megalinter-image.tar
          rm -f /tmp/megalinter-image.tar
          docker image ls

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          # renovate: datasource=github-releases depName=aquasecurity/trivy
          version: "v0.72.0"
          image-ref: "${{ needs.build.outputs.image-tag }}"
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          scanners: vuln
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'
          timeout: 15m0s

      # - name: Run OSV-Scanner vulnerability scanner
      #   uses: google/osv-scanner-action/osv-scanner-action@v2.3.5
      #   with:
      #     scan-args: |-
      #       --docker ${{ needs.build.outputs.image-tag }}