ci.yml

# Copyright 2021-2022 MONAI Consortium
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.


name: ci

on:
  # Triggers on pushes and on pull requests
  push:
    paths-ignore:
      - 'demos/**'

  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  BUILD_CONFIG: "Release"
  SOLUTION: "Monai.Deploy.InformaticsGateway.sln"
  TEST_RESULTS: "results/"

jobs:
  calc-version:
    runs-on: ubuntu-latest

    outputs:
      semVer: ${{ steps.gitversion.outputs.semVer }}
      preReleaseLabel: ${{ steps.gitversion.outputs.preReleaseLabel }}
      majorMinorPatch: ${{ steps.gitversion.outputs.majorMinorPatch }}

    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - uses: actions/setup-dotnet@v3
        with:
          dotnet-version: "6.0.x"

      - name: Install GitVersion
        run: dotnet tool install --global GitVersion.Tool

      - name: Determine Version
        id: gitversion
        uses: gittools/actions/gitversion/execute@v0.10.2
        with:
          useConfigFile: true
          updateAssemblyInfo: true
          updateAssemblyInfoFilename: src/AssemblyInfo.cs
          configFilePath: .github/.gitversion.yml

      - name: Print AssemblyInfo
        run: cat src/AssemblyInfo.cs

      - name: Upload AssemblyInfo
        uses: actions/upload-artifact@v3.1.2
        if: always()
        with:
          name: assembly-info
          path: src/AssemblyInfo.cs
          retention-days: 30

  CodeQL-Analyze:
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
    - name: Checkout repository
      uses: actions/checkout@v3
      with:
        fetch-depth: 0

    - uses: actions/setup-dotnet@v3
      with:
        dotnet-version: "6.0.x"

    - name: Enable NuGet cache
      uses: actions/cache@v3.3.1
      with:
        path: ~/.nuget/packages
        key: ${{ runner.os }}-nuget-${{ hashFiles('**/packages.lock.json') }}
        restore-keys: |
          ${{ runner.os }}-nuget

    - name: Initialize CodeQL
      uses: github/codeql-action/init@v2
      with:
        languages: csharp

    - name: Restore dependencies
      run: dotnet restore
      working-directory: ./src

    - name: Build Solution
      run: dotnet build -c ${{ env.BUILD_CONFIG }} --nologo ${{ env.SOLUTION }}
      working-directory: ./src

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v2

  analyze:
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
    - name: Checkout repository
      uses: actions/checkout@v3
      with:
        fetch-depth: 0

    - uses: actions/setup-dotnet@v3
      with:
        dotnet-version: "6.0.x"

    - name: Enable Homebrew
      run: echo "/home/linuxbrew/.linuxbrew/bin:/home/linuxbrew/.linuxbrew/sbin" >> $GITHUB_PATH

    - name: Install License Finder tool with Homebrew
      uses: tecoli-com/actions-use-homebrew-tools@v1.1
      with:
        tools: licensefinder
        cache: yes

    - name: Enable NuGet cache
      uses: actions/cache@v3.3.1
      with:
        path: ~/.nuget/packages
        key: ${{ runner.os }}-nuget-${{ hashFiles('**/packages.lock.json') }}
        restore-keys: |
          ${{ runner.os }}-nuget

    - name: Nuget Vulnerabiilty Scan
      run: |
        dotnet list package --vulnerable 2>&1 | tee vulnerable.txt
        echo "Analyzing dotnet list package command log output..."
        sh -c "! grep 'has the following vulnerable packages' vulnerable.txt"
      working-directory: ./src

    - name: Restore dependencies
      run: dotnet restore
      working-directory: ./src

    - name: Build Solution
      run: dotnet build -c ${{ env.BUILD_CONFIG }} --nologo ${{ env.SOLUTION }}
      working-directory: ./src

    - name: Secret detection
      uses: gitleaks/gitleaks-action@v1.6.0

    - name: Perform License Scanning
      run: license_finder -r

    - name: Check License Header
      uses: apache/skywalking-eyes@v0.4.0

  unit-test:
    runs-on: ubuntu-latest
    services:
      mongo:
        image: mongo
        env:
          MONGO_INITDB_ROOT_USERNAME: root
          MONGO_INITDB_ROOT_PASSWORD: rootpassword
        ports:
        - 27017:27017
    steps:
      - name: Set up JDK 11
        uses: actions/setup-java@v3
        with:
          distribution: zulu
          java-version: '11'

      - uses: actions/setup-dotnet@v3
        with:
          dotnet-version: "6.0.x"

      - name: Enable NuGet cache
        uses: actions/cache@v3.3.1
        with:
          path: ~/.nuget/packages
          key: ${{ runner.os }}-nuget-${{ hashFiles('**/packages.lock.json') }}
          restore-keys: |
            ${{ runner.os }}-nuget

      - uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Install SonarCloud scanner
        if: steps.cache-sonar-scanner.outputs.cache-hit != 'true'
        run: dotnet tool install --global dotnet-sonarscanner

      - name: Restore dependencies
        run: dotnet restore
        working-directory: ./src

      - name: Begin SonarScanner
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        run: dotnet sonarscanner begin /k:"Project-MONAI_monai-deploy-informatics-gateway" /o:"project-monai" /d:sonar.login="${{ secrets.SONAR_TOKEN }}" /d:sonar.host.url="https://sonarcloud.io" /d:sonar.cs.opencover.reportsPaths="${{ env.TEST_RESULTS }}/**/*.xml"
        working-directory: ./src

      - name: Build
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        run: dotnet build -c ${{ env.BUILD_CONFIG }} --nologo "${{ env.SOLUTION }}"
        working-directory: ./src

      - name: Test
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        run: find ~+ -type f -name "*.Test.csproj" | xargs -L1 dotnet test -c ${{ env.BUILD_CONFIG }} -v=minimal -r "${{ env.TEST_RESULTS }}" --collect:"XPlat Code Coverage" --settings coverlet.runsettings
        working-directory: ./src

      - name: End SonarScanner
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        run: dotnet sonarscanner end /d:sonar.login="${{ secrets.SONAR_TOKEN }}"
        working-directory: ./src

      - uses: codecov/codecov-action@v3
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          directory: "src/${{ env.TEST_RESULTS }}"
          files: "**/coverage.opencover.xml"
          flags: unittests
          name: codecov-umbrella
          fail_ci_if_error: true
          verbose: true

  integration-test:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    strategy:
      matrix:
        feature: [AcrApi, DicomDimseScp, DicomDimseScu, DicomWebExport, DicomWebStow, HealthLevel7, Fhir, RemoteAppExecutionPlugIn]
        database: [ef, mongodb]
      fail-fast: false
    env:
      TAG: ${{ needs.build.outputs.TAG }}
      DOTNET_TEST: ${{ matrix.database }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - uses: actions/setup-dotnet@v3
        with:
          dotnet-version: "6.0.x"

      - name: Enable NuGet cache
        uses: actions/cache@v3.3.1
        with:
          path: ~/.nuget/packages
          key: ${{ runner.os }}-nuget-${{ hashFiles('**/packages.lock.json') }}
          restore-keys: |
            ${{ runner.os }}-nuget

      - name: Restore dependencies
        run: dotnet restore
        working-directory: ./src

      - name: Build Solution
        run: dotnet build -c ${{ env.BUILD_CONFIG }} --nologo ${{ env.SOLUTION }}
        working-directory: ./src

      - name: Integration Test
        run: |
          pushd tests/Integration.Test
          ./run.sh --feature ${{ matrix.feature }}
          popd

      - name: Upload Integration Test Results
        uses: actions/upload-artifact@v3.1.2
        if: always()
        with:
          name: integration-${{ matrix.feature }}
          path: |
            ${{ github.workspace }}/LivingDoc.html
            ${{ github.workspace }}/services.log
            ${{ github.workspace }}/run.log
          retention-days: 30

  build:
    runs-on: ${{ matrix.os }}
    needs: [calc-version]
    env:
      NUGETVER: ${{ needs.calc-version.outputs.nuGetVersionV2 }}
      SEMVER: ${{ needs.calc-version.outputs.semVer }}
      PRERELEASELABEL: ${{ needs.calc-version.outputs.preReleaseLabel }}
      MAJORMINORPATCH: ${{ needs.calc-version.outputs.majorMinorPatch }}
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest]
      fail-fast: true

    outputs:
      TAG: ${{ steps.output.outputs.ubuntu-latest-TAG }}

    permissions:
      contents: write
      packages: write
      checks: write
      security-events: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - uses: actions/setup-dotnet@v3
        with:
          dotnet-version: "6.0.x"

      - name: Enable NuGet cache
        uses: actions/cache@v3.3.1
        with:
          path: ~/.nuget/packages
          key: ${{ runner.os }}-nuget-${{ hashFiles('**/packages.lock.json') }}
          restore-keys: |
            ${{ runner.os }}-nuget

      - name: Download AssemblyInfo.cs
        id: download
        uses: actions/download-artifact@v3
        with:
          name: assembly-info
          path: src/
          
      - name: Print AssemblyInfo
        run: cat src/AssemblyInfo.cs

      - name: Restore dependencies
        run: dotnet restore
        working-directory: ./src

      - name: Build Solution
        run: dotnet build -c ${{ env.BUILD_CONFIG }} --nologo ${{ env.SOLUTION }}
        working-directory: ./src

      - name: Build CLI (linux-x64)
        if: ${{ matrix.os == 'ubuntu-latest' }}
        run: |
          mkdir ~/release
          dotnet publish --self-contained -c ${{ env.BUILD_CONFIG }} -r linux-x64 -o cli/ src/CLI/Monai.Deploy.InformaticsGateway.CLI.csproj
          pushd cli && rm *.pdb
          zip -r ~/release/mig-cli-$SEMVER-linux-x64.zip *
          popd
          ls -lR ~/release

      - name: Build CLI (windows-x64)
        if: ${{ matrix.os == 'windows-latest' }}
        run: |
          mkdir ~/release
          dotnet publish --self-contained -c ${{ env.BUILD_CONFIG }} -r win-x64 -o cli/ src/CLI/Monai.Deploy.InformaticsGateway.CLI.csproj
          pushd cli && rm *.pdb
          Compress-Archive -Path * -DestinationPath ~/release/mig-cli-${{ env.SEMVER }}-win-x64.zip
          popd
          dir -r ~/release

      - name: Package API
        env:
          PACKAGEDIR: '${{ github.workspace }}/nupkg/'
        if: ${{ (matrix.os == 'ubuntu-latest') }}
        run: |
          mkdir $PACKAGEDIR
          dotnet pack --no-build -c ${{ env.BUILD_CONFIG }} -o $PACKAGEDIR -p:PackageVersion=${{ env.NUGETVER }}
          ls -lR $PACKAGEDIR
        working-directory: ./src/Api

      - name: Upload CLI
        uses: actions/upload-artifact@v3.1.2
        with:
          name: artifacts
          path: ~/release
          retention-days: 7
          
      - name: Upload Nuget
        if: ${{ matrix.os == 'ubuntu-latest' }}
        uses: actions/upload-artifact@v3.1.2
        env:
          PACKAGEDIR: '${{ github.workspace }}/nupkg/'
        with:
          name: nuget
          path: ${{ PACKAGEDIR }}*.nupkg
          retention-days: 30

      - name: Log in to the Container registry
        uses: docker/login-action@v2.2.0
        if: ${{ (matrix.os == 'ubuntu-latest') }}
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v4.6.0
        if: ${{ (matrix.os == 'ubuntu-latest') }}
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=raw,value=${{ env.SEMVER }}
            type=raw,value=latest,enable=${{ endsWith(github.ref, github.event.repository.default_branch) }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v4.1.1
        if: ${{ (matrix.os == 'ubuntu-latest') }}
        with:
          context: .
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

      - name: Scan image with Azure Container Scan
        env:
          TRIVY_TIMEOUT_SEC: 360s
        uses: Azure/container-scan@v0.1
        if: ${{ (matrix.os == 'ubuntu-latest') }}
        with:
          image-name: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}

      - name: Anchore container scan
        id: anchore-scan
        uses: anchore/scan-action@v3.3.6
        if: ${{ (matrix.os == 'ubuntu-latest') }}
        with:
          image: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
          fail-build: true
          severity-cutoff: critical

      - name: Upload Anchore scan SARIF report
        uses: github/codeql-action/upload-sarif@v2
        if: ${{ (matrix.os == 'ubuntu-latest') }}
        with:
          sarif_file: ${{ steps.anchore-scan.outputs.sarif }}
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Output
        id: output
        if: ${{ (matrix.os == 'ubuntu-latest') }}
        run: echo "::set-output name=${{ matrix.os }}-TAG::${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}"

  docs:
    runs-on: windows-latest
    needs: [calc-version]
    env:
      SEMVER: ${{ needs.calc-version.outputs.semVer }}
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - uses: actions/setup-dotnet@v3
        with:
          dotnet-version: "6.0.x"

      - name: Enable NuGet cache
        uses: actions/cache@v3.3.1
        with:
          path: ~/.nuget/packages
          key: ${{ runner.os }}-nuget-${{ hashFiles('**/packages.lock.json') }}
          restore-keys: |
            ${{ runner.os }}-nuget

      - name: Setup DocFX
        uses: crazy-max/ghaction-chocolatey@v2
        with:
          args: install docfx

      - name: Restore dependencies
        run: dotnet restore
        working-directory: ./src

      - name: Build Solution
        run: dotnet build -c ${{ env.BUILD_CONFIG }} --nologo ${{ env.SOLUTION }}
        working-directory: ./src

      - name: Update docs version
        run: |
          sed -i -e "s,v0.0.0,v${{ env.SEMVER }},g" ./docs/docfx.json
          sed -i -e "s,v0.0.0,v${{ env.SEMVER }},g" ./docs/index.md

      - name: Build Docs
        working-directory: docs
        run: docfx docfx.json
        continue-on-error: false

      - name: Package docs
        run: |
          mkdir ~\release
          Compress-Archive -Path docs\_site\* -DestinationPath ~\release\mig-docs-${{ env.SEMVER }}.zip
          Get-ChildItem ~\release -Recurse

      - name: Upload docs
        uses: actions/upload-artifact@v3.1.2
        with:
          name: artifacts
          path: ~/release
          retention-days: 7
          
  publish:
    name: Publish to GitHub Packages
    runs-on: ubuntu-latest
    needs: [build, unit-test]
    if: ${{ ! ( github.event.inputs.nuget ) && ! ( contains(github.ref, 'refs/heads/main') ) }}
    steps:
      - uses: actions/download-artifact@v3
        id: download

      - name: List artifacts
        run: ls -ldR ${{steps.download.outputs.download-path}}/**/*

      - name: Install grp
        run: dotnet tool install gpr -g

      - uses: actions/setup-dotnet@v3
        env:
          NUGET_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}}
        with:
          dotnet-version: "6.0.x"
          source-url: https://nuget.pkg.github.com/Project-MONAI/index.json

      - name: Publish to GitHub
        run: gpr push '${{ steps.download.outputs.download-path }}/nuget/*.nupkg' --repository ${{ github.repository }} -k ${{ secrets.GITHUB_TOKEN }}

  release:
    if: ${{ contains(github.ref, 'refs/heads/main') || contains(github.ref, 'refs/heads/develop') ||contains(github.head_ref, 'release/') || contains(github.head_ref, 'feature/') || contains(github.head_ref, 'develop') }}
    runs-on: ubuntu-latest
    needs: [calc-version, unit-test, docs, integration-test, analyze]
    env:
      SEMVER: ${{ needs.calc-version.outputs.semVer }}
      PRERELEASELABEL: ${{ needs.calc-version.outputs.preReleaseLabel }}
      MAJORMINORPATCH: ${{ needs.calc-version.outputs.majorMinorPatch }}

    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - uses: actions/download-artifact@v3
        id: download

      - name: List artifacts
        run: ls -ldR ${{steps.download.outputs.download-path}}/**/*
        
      - name: Install grp
        run: dotnet tool install gpr -g

      - uses: actions/setup-dotnet@v3
        env:
          NUGET_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}}
        with:
          dotnet-version: "6.0.x"
          source-url: https://nuget.pkg.github.com/Project-MONAI/index.json

      - name: Publish to GitHub
        run: gpr push '${{ steps.download.outputs.download-path }}/nuget/*.nupkg' --repository ${{ github.repository }} -k ${{ secrets.GITHUB_TOKEN }}

      - name: Publish to NuGet.org
        run: dotnet nuget push  ${{ steps.download.outputs.download-path }}/nuget/*.nupkg -s https://api.nuget.org/v3/index.json --api-key ${{ secrets.NUGET }} --skip-duplicate

      - name: Extract owner and repo
        uses: jungwinter/split@v2
        id: repo
        with:
          separator: "/"
          msg: ${{ github.repository }}

      - name: Install GitReleaseManager
        uses: gittools/actions/gitreleasemanager/setup@v0.10.2
        with:
          versionSpec: "0.13.x"

      - name: Create release with GitReleaseManager
        uses: gittools/actions/gitreleasemanager/create@v0.10.2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          owner: ${{ steps.repo.outputs._0 }}
          repository: ${{ steps.repo.outputs._1 }}
          milestone: ${{ env.MAJORMINORPATCH }}
          name: "Release v${{ env.MAJORMINORPATCH }}"
          assets: |
            artifacts/mig-cli-${{ env.SEMVER }}-linux-x64.zip
            artifacts/mig-cli-${{ env.SEMVER }}-win-x64.zip
            artifacts/mig-docs-${{ env.SEMVER }}.zip

      - name: Publish release with GitReleaseManager
        uses: gittools/actions/gitreleasemanager/publish@v0.10.2
        if: ${{ contains(github.ref, 'refs/heads/main') }}
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          owner: ${{ steps.repo.outputs._0 }}
          repository: ${{ steps.repo.outputs._1 }}
          tagName: ${{ env.MAJORMINORPATCH }}

      - name: Close release with GitReleaseManager
        uses: gittools/actions/gitreleasemanager/close@v0.10.2
        if: ${{ contains(github.ref, 'refs/heads/main') }}
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          owner: ${{ steps.repo.outputs._0 }}
          repository: ${{ steps.repo.outputs._1 }}
          milestone: ${{ env.MAJORMINORPATCH }}

      - name: Unzip docs
        if: ${{ contains(github.ref, 'refs/heads/main') }}
        run: |
          mkdir userguide
          unzip artifacts/mig-docs-${{ env.SEMVER }}.zip -d userguide/
          ls -lR userguide/

      - name: Deploy Docs
        uses: peaceiris/actions-gh-pages@v3
        if: ${{ contains(github.ref, 'refs/heads/main') }}
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          publish_dir: userguide/
          publish_branch: docs