@getarbiter/cli 0.5.0

package/dist/templates/github/workflows/04-deploy-test.yml.ejs

@@ -0,0 +1,425 @@
+# 04-deploy-test.yml — generated by arbiter — Deploy to TEST environment
+# Trigger: push to main branch (or develop when branchingStrategy=github-flow-with-develop)
+# Slot 04 reserved in CI-TIER-MODEL.md §2 — opt-in via deployTarget !== 'none'.
+#
+# Job graph:
+#   build-and-sign ──── deploy-test ──── post-deploy-smoke
+#       (failure)──── notify
+#
+# Security invariants:
+#   - Trivy HIGH/CRITICAL scan MUST precede container registry push
+#   - Cosign keyless signing (OIDC) after push
+#   - SBOM attestation (CycloneDX) linked to image digest
+#   - ACR idempotent retry tag: <sha>-<run_attempt> (H2-M3)
+#   - Sigstore preflight check before signing (H3-S1)
+#
+# Ref: docs/SYSTEM/CI-TIER-MODEL.md §2 (slot 04, deploy-test)
+
+<% const _bs = (typeof branchingStrategy !== 'undefined' ? branchingStrategy : 'github-flow'); %>
+name: Deploy Test
+
+on:
+  push:
+<% if (_bs === 'github-flow-with-develop') { %>
+    branches: [develop]
+<% } else { %>
+    branches: [main]
+<% } %>
+    paths-ignore:
+      - 'docs/**'
+      - '*.md'
+      - '.gitignore'
+      - '.editorconfig'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  id-token: write
+  packages: write
+
+jobs:
+  # === GROUP: build ===
+
+  build-and-sign:
+    name: Build, Scan, Sign & SBOM
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_BUILD || '["ubuntu-latest"]') }}
+    timeout-minutes: 40
+    outputs:
+      image-digest: ${{ steps.push.outputs.digest }}
+      image-tag: ${{ steps.tag.outputs.image_tag }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+
+<% if (language === 'java' && buildTool === 'maven') { %>
+      - name: Setup Java (Maven)
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95  # v5.6.0
+        with:
+          distribution: temurin
+          java-version: '21'
+          cache: maven
+
+<% } else if (language === 'java' && buildTool === 'gradle') { %>
+      - name: Setup Java (Gradle)
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95  # v5.6.0
+        with:
+          distribution: temurin
+          java-version: '21'
+          cache: gradle
+
+<% } else if (language === 'go') { %>
+      - name: Setup Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
+        with:
+          go-version-file: go.mod
+          cache: true
+
+<% } else if (language === 'python') { %>
+      - name: Setup Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version-file: pyproject.toml
+          cache: pip
+
+<% } else if (language === 'rust') { %>
+      - name: Setup Rust toolchain
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable
+
+<% } else { %>
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+        with:
+          node-version-file: '.nvmrc'
+          package-manager-cache: false
+
+<% } %>
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3
+        with:
+          driver: docker
+
+      # #1650: GitHub Actions does NOT auto-authenticate the docker CLI to the
+      # container registry; `packages: write` only scopes GITHUB_TOKEN. Without an
+      # explicit login, every `docker push` / `cosign sign` below returns
+      # `denied: requested access to the resource is denied`. Mirrors 05-release.
+      - name: Log in to container registry
+        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c  # v4.5.2
+        with:
+          registry: ${{ vars.CONTAINER_REGISTRY || 'ghcr.io' }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Restore Trivy DB cache
+        uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684  # v4.2.3
+        with:
+          path: ${{ runner.temp }}/trivy-db
+          key: ${{ runner.os }}-trivy-db-v1-${{ github.run_id }}
+          restore-keys: |
+            ${{ runner.os }}-trivy-db-v1-
+
+      - name: Build Docker image
+        run: |
+          docker build --load \
+            -t "${{ vars.IMAGE_NAME || 'app' }}:ci-${{ github.sha }}" \
+            .
+
+      - name: Export image to tar
+        run: docker save "${{ vars.IMAGE_NAME || 'app' }}:ci-${{ github.sha }}" -o "${{ runner.temp }}/image.tar"
+
+      - name: Trivy scan — block on HIGH/CRITICAL (security invariant before push)
+        id: trivy_scan
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25  # v0.36.0
+        with:
+          input: ${{ runner.temp }}/image.tar
+          format: table
+          exit-code: '1'
+          severity: 'HIGH,CRITICAL'
+          trivyignores: .trivyignore
+          cache-dir: ${{ runner.temp }}/trivy-db
+
+      - name: Trivy full report (informational)
+        if: always() && steps.trivy_scan.conclusion != 'skipped'
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25  # v0.36.0
+        with:
+          input: ${{ runner.temp }}/image.tar
+          format: table
+          exit-code: '0'
+          severity: 'CRITICAL,HIGH,MEDIUM,LOW'
+          trivyignores: .trivyignore
+          cache-dir: ${{ runner.temp }}/trivy-db
+          output: trivy-report.txt
+
+      - name: Save Trivy DB cache
+        if: always()
+        uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684  # v4.2.3
+        with:
+          path: ${{ runner.temp }}/trivy-db
+          key: ${{ runner.os }}-trivy-db-v1-${{ github.run_id }}
+
+      - name: Tag image for registry (idempotent retry tag H2-M3)
+        id: tag
+        env:
+          RUN_ATTEMPT: ${{ github.run_attempt }}
+          REGISTRY: ${{ vars.CONTAINER_REGISTRY || 'ghcr.io' }}
+          IMAGE_NAME: ${{ vars.IMAGE_NAME || 'app' }}
+        run: |
+          IMAGE_TAG="${REGISTRY}/${IMAGE_NAME}:${{ github.sha }}"
+          IMAGE_TAG_RETRY="${REGISTRY}/${IMAGE_NAME}:${{ github.sha }}-${RUN_ATTEMPT}"
+          docker tag "${{ vars.IMAGE_NAME || 'app' }}:ci-${{ github.sha }}" "$IMAGE_TAG"
+          docker tag "${{ vars.IMAGE_NAME || 'app' }}:ci-${{ github.sha }}" "$IMAGE_TAG_RETRY"
+          echo "image_tag=$IMAGE_TAG" >> "$GITHUB_OUTPUT"
+
+      - name: Push to container registry
+        id: push
+        env:
+          REGISTRY: ${{ vars.CONTAINER_REGISTRY || 'ghcr.io' }}
+          IMAGE_NAME: ${{ vars.IMAGE_NAME || 'app' }}
+        run: |
+          docker push "${REGISTRY}/${IMAGE_NAME}:${{ github.sha }}"
+          docker push "${REGISTRY}/${IMAGE_NAME}:${{ github.sha }}-${{ github.run_attempt }}"
+          DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' \
+            "${REGISTRY}/${IMAGE_NAME}:${{ github.sha }}" 2>/dev/null | cut -d@ -f2 || echo "")
+          echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"
+
+      - name: Install cosign (keyless OIDC)
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6  # v4.1.2
+
+<%- include('_partials/sigstore-preflight.ejs') %>
+
+      - name: cosign sign image (OCI manifest, H3-M2)
+        env:
+          IMAGE_DIGEST: ${{ steps.push.outputs.digest }}
+          REGISTRY: ${{ vars.CONTAINER_REGISTRY || 'ghcr.io' }}
+          IMAGE_NAME: ${{ vars.IMAGE_NAME || 'app' }}
+        run: |
+          [[ -z "$IMAGE_DIGEST" ]] && { echo "::warning::No digest — skip cosign sign"; exit 0; }
+          cosign sign --yes "${REGISTRY}/${IMAGE_NAME}@${IMAGE_DIGEST}"
+
+<% if (language === 'java' && buildTool === 'maven') { %>
+      - name: Generate SBOM (CycloneDX)
+        env:
+          IMAGE_TAG: ${{ steps.tag.outputs.image_tag }}
+          MAVEN_SETTINGS_PATH: ${{ vars.MAVEN_SETTINGS_PATH || '.github/workflows/maven-settings.xml' }}
+        run: |
+          mvn -s "$MAVEN_SETTINGS_PATH" -B cyclonedx:makeAggregateBom \
+              -DskipTests \
+              -Dspotless.check.skip=true \
+              -Dcheckstyle.skip=true \
+              -Dspotbugs.skip=true \
+              -Dpmd.skip=true \
+              -Djacoco.skip=true
+<% } else if (language === 'java' && buildTool === 'gradle') { %>
+      - name: Generate SBOM (CycloneDX)
+        env:
+          IMAGE_TAG: ${{ steps.tag.outputs.image_tag }}
+        run: ./gradlew cyclonedxBom -x test
+<% } else { %>
+      - name: Generate SBOM (CycloneDX)
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610  # v0.24.0
+        with:
+          image: ${{ steps.tag.outputs.image_tag }}
+          format: cyclonedx-json
+          output-file: bom.json
+<% } %>
+
+      - name: cosign attest SBOM (CycloneDX, H3-M2)
+        env:
+          IMAGE_DIGEST: ${{ steps.push.outputs.digest }}
+          REGISTRY: ${{ vars.CONTAINER_REGISTRY || 'ghcr.io' }}
+          IMAGE_NAME: ${{ vars.IMAGE_NAME || 'app' }}
+        run: |
+          [[ -z "$IMAGE_DIGEST" ]] && { echo "::warning::No digest — skip cosign attest"; exit 0; }
+          BOM_FILE=$([ -f "target/bom.json" ] && echo "target/bom.json" || echo "bom.json")
+          cosign attest --yes \
+            --predicate "$BOM_FILE" \
+            --type cyclonedx \
+            "${REGISTRY}/${IMAGE_NAME}@${IMAGE_DIGEST}"
+
+      - name: Upload SBOM artifact (14d retention)
+        # INTENTIONAL-NON-BLOCKING: artifact upload failures must not block CI
+        continue-on-error: true
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: sbom-develop-${{ github.sha }}
+          path: |
+            target/bom.json
+            bom.json
+          if-no-files-found: warn
+          retention-days: 14
+
+      - name: Upload Trivy report
+        if: always() && steps.trivy_scan.conclusion != 'skipped'
+        # INTENTIONAL-NON-BLOCKING: artifact upload failures must not block CI
+        continue-on-error: true
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: trivy-report-develop-${{ github.sha }}
+          path: trivy-report.txt
+          if-no-files-found: ignore
+          retention-days: 7
+
+      - name: Cleanup Docker image and tar
+        if: always()
+        run: |
+          docker rmi "${{ vars.IMAGE_NAME || 'app' }}:ci-${{ github.sha }}" 2>/dev/null || true
+          rm -f "${{ runner.temp }}/image.tar"
+
+  # === GROUP: deploy ===
+
+  deploy-test:
+    name: Deploy to TEST environment
+    needs: [build-and-sign]
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_DEPLOY || '["ubuntu-latest"]') }}
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+
+<%
+// RT-2: coalesce undefined (absent from legacy configs) to 'none' before comparison
+// RT-7: whitelist — prevent path traversal if deployTarget is hand-edited
+const _dt = ({
+  'ghcr': 'ghcr',
+  'azure-container-app': 'azure-container-app',
+  'aws-ecs': 'aws-ecs',
+  'gcp-cloud-run': 'gcp-cloud-run',
+  'nas-compose': 'nas-compose'
+})[typeof deployTarget !== 'undefined' ? deployTarget : 'none'] ?? 'none';
+%>
+<% if (_dt !== 'none') { %>
+      - name: Export IMAGE_TAG from build output
+        run: |
+          echo "IMAGE_TAG=${{ needs.build-and-sign.outputs.image-tag }}" >> "$GITHUB_ENV"
+<%- include('_deploy/' + _dt + '.ejs') %>
+<% } %>
+
+  # === GROUP: smoke ===
+
+  post-deploy-smoke:
+    name: Post-Deploy Smoke (k6 LT1)
+    needs: [deploy-test]
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_BUILD || '["ubuntu-latest"]') }}
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+
+      - name: k6 smoke (LT1 — post-deploy gate)
+        env:
+          BASE_URL: ${{ secrets.TEST_BASE_URL }}
+          AUTH_TOKEN: ${{ secrets.K6_TEST_AUTH_TOKEN }}
+          # Sanctioned opt-out: set repo/org variable SKIP_SMOKE_K6=true to deliberately skip this
+          # gate. With it unset, an empty TEST_BASE_URL secret FAILS loud — never a silent green.
+          SKIP_SMOKE_K6: ${{ vars.SKIP_SMOKE_K6 }}
+          VUS: "1"
+          DURATION: "30s"
+        run: |
+          test -n "$BASE_URL" || { [ "${SKIP_SMOKE_K6}" = "true" ] \
+            && { echo "::notice::SKIP_SMOKE_K6=true — k6 smoke explicitly skipped"; exit 0; } \
+            || { echo "::error::TEST_BASE_URL secret is empty and SKIP_SMOKE_K6 is not 'true'"; exit 1; }; }
+          k6 run \
+            --env BASE_URL="$BASE_URL" \
+            --env AUTH_TOKEN="$AUTH_TOKEN" \
+            --env VUS="$VUS" \
+            --env DURATION="$DURATION" \
+            tests/load/smoke.js
+
+      - name: Upload k6 summary
+        if: always()
+        # INTENTIONAL-NON-BLOCKING: artifact upload failures must not block CI
+        continue-on-error: true
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: k6-smoke-post-deploy-${{ github.sha }}
+          path: k6-smoke-post-deploy.json
+          if-no-files-found: ignore
+          retention-days: 7
+
+  # === GROUP: dast ===
+
+  # E4 (#1502): DAST baseline moved off the PR path (02-pr-extended) to here, where
+  # it runs against the ephemeral TEST environment that deploy-test just provisioned —
+  # a live URL actually exists at this cadence. Skips gracefully (like post-deploy-smoke)
+  # when TEST_BASE_URL is unset, so a non-web deploy never fails on a missing target.
+  # The deep counterpart (full active scan) lives at nightly cadence (06-nightly dast-full).
+  dast-baseline:
+    name: DAST Baseline (ZAP — ephemeral TEST env)
+    needs: [deploy-test]
+    # #1756: pinned to a LITERAL GitHub-hosted runner, not the usual
+    # `vars.RUNNER_LABELS_BUILD` self-hosted-capable fallback. zaproxy/action-baseline
+    # is a Docker-outside-of-Docker action (it internally runs `docker run` against the
+    # ZAP image) — on a self-hosted runner whose own process runs inside a container,
+    # the workspace bind-mount resolves against the DOCKER HOST path, not the runner's
+    # own checkout. GitHub-hosted runners are not containerized this way and are
+    # unaffected. Enforced by scripts/check-docker-action-runner-safety.mjs.
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+
+      - name: Resolve DAST target
+        id: target
+        env:
+          BASE_URL: ${{ secrets.TEST_BASE_URL }}
+          # Sanctioned opt-out: set repo/org variable SKIP_DAST_BASELINE=true to skip.
+          # With it unset, an empty TEST_BASE_URL FAILS loud — never a silent green.
+          SKIP_DAST_BASELINE: ${{ vars.SKIP_DAST_BASELINE }}
+        run: |
+          if [ -z "$BASE_URL" ]; then
+            if [ "${SKIP_DAST_BASELINE}" = "true" ]; then
+              echo "::notice::SKIP_DAST_BASELINE=true — DAST baseline explicitly skipped"
+              echo "run=false" >> "$GITHUB_OUTPUT"
+            else
+              echo "::error::TEST_BASE_URL secret is empty and SKIP_DAST_BASELINE is not 'true'"
+              exit 1
+            fi
+          else
+            echo "run=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: OWASP ZAP baseline scan (ephemeral TEST env)
+        if: steps.target.outputs.run == 'true'
+        uses: zaproxy/action-baseline@66042c8e7e24680119199a017e5b0e8603bf4dae  # v0.12.0
+        with:
+          target: ${{ secrets.TEST_BASE_URL }}
+          fail_action: true
+          rules_file_name: '.zap/rules.tsv'
+          # #1887-E: authenticated-scan context — baseline-auth.context is emitted by
+          # generateSecurity (security.ts) for the user to fill in login URL/credentials.
+          context_file: '.zap/baseline-auth.context'
+          cmd_options: '-J zap-report.json'
+          allow_issue_writing: false
+<% if (archetype === 'backend-web-db' && enableSecurityScanning) { %>
+      # #898/#1887-E: scripts/ingest-zap-report.mjs is emitted by generateSecurity
+      # under this same (archetype === 'backend-web-db' && enableSecurityScanning)
+      # gate — its own header comment already documents action-baseline-scan as one
+      # of its two supported producers. Only runs when the scan itself ran.
+      - name: Ingest ZAP report (HIGH/MEDIUM threshold gate)
+        if: steps.target.outputs.run == 'true'
+        run: node scripts/ingest-zap-report.mjs --report zap-report.json
+<% } %>
+  # === GROUP: notify ===
+
+  notify:
+    name: Notify on Failure
+    needs: [build-and-sign, deploy-test, post-deploy-smoke, dast-baseline]
+    if: failure()
+    uses: ./.github/workflows/_notify.yml
+    with:
+      workflow_name: "Deploy to TEST"
+      area: deploy
+      severity: P1
+      branch: ${{ github.ref_name }}
+      run_url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+      failure_summary: "04-deploy-test.yml failed on develop branch."
+      status: failure
+    permissions:
+      contents: read
+      issues: write
+    secrets: inherit