DevOps-Project-41

.github/workflows/project-41-ci.yml

@@ -0,0 +1,89 @@
+name: "[P41] CI"
+
+on:
+  push:
+    branches: [devops-project, master]
+    paths:
+      - "DevOps-Project-41/app/**"
+      - ".github/workflows/project-41-ci.yml"
+  pull_request:
+    branches: [master]
+    paths:
+      - "DevOps-Project-41/app/**"
+      - ".github/workflows/project-41-ci.yml"
+
+permissions:
+  contents: read
+
+env:
+  APP_DIR: DevOps-Project-41/app
+
+jobs:
+  build-test:
+    name: Build & Test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "8.0.x"
+
+      - name: Restore
+        working-directory: ${{ env.APP_DIR }}
+        run: dotnet restore
+
+      - name: Build
+        working-directory: ${{ env.APP_DIR }}
+        run: dotnet build -c Release --no-restore
+
+      - name: Test
+        working-directory: ${{ env.APP_DIR }}
+        run: dotnet test -c Release --no-build --logger trx --results-directory TestResults
+
+      - name: Upload test results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-results
+          path: ${{ env.APP_DIR }}/TestResults
+
+  docker-build:
+    name: Docker Build (smoke test)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build API image
+        uses: docker/build-push-action@v6
+        with:
+          context: ${{ env.APP_DIR }}
+          file: ${{ env.APP_DIR }}/Dockerfile
+          target: api
+          push: false
+          load: true
+          tags: ai-api:ci
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Build Worker image
+        uses: docker/build-push-action@v6
+        with:
+          context: ${{ env.APP_DIR }}
+          file: ${{ env.APP_DIR }}/Dockerfile
+          target: worker
+          push: false
+          load: true
+          tags: ai-worker:ci
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/project-41-release.yml

@@ -0,0 +1,163 @@
+name: "[P41] Release"
+
+on:
+  push:
+    tags:
+      - "p41-v*.*.*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Image tag (e.g. 1.0.0)"
+        required: true
+        default: "1.0.0"
+
+permissions:
+  contents: read
+  packages: write
+  id-token: write
+  security-events: write
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_OWNER: ${{ github.repository_owner }}
+  APP_DIR: DevOps-Project-41/app
+
+jobs:
+  build-push-sign:
+    name: Build, Push and Sign
+    runs-on: ubuntu-latest
+    outputs:
+      api-digest: ${{ steps.push-api.outputs.digest }}
+      worker-digest: ${{ steps.push-worker.outputs.digest }}
+      image-tag: ${{ steps.meta.outputs.version }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Extract image metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/ai-api
+            ${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/ai-worker
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=sha,prefix=sha-
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "8.0.x"
+
+      - name: Run tests before release
+        working-directory: ${{ env.APP_DIR }}
+        run: dotnet test -c Release --logger trx
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push API image
+        id: push-api
+        uses: docker/build-push-action@v6
+        with:
+          context: ${{ env.APP_DIR }}
+          file: ${{ env.APP_DIR }}/Dockerfile
+          target: api
+          push: true
+          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/ai-api:${{ steps.meta.outputs.version }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Build and push Worker image
+        id: push-worker
+        uses: docker/build-push-action@v6
+        with:
+          context: ${{ env.APP_DIR }}
+          file: ${{ env.APP_DIR }}/Dockerfile
+          target: worker
+          push: true
+          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/ai-worker:${{ steps.meta.outputs.version }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@v3
+
+      - name: Sign API image (keyless)
+        run: |
+          cosign sign --yes \
+            ${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/ai-api@${{ steps.push-api.outputs.digest }}
+
+      - name: Sign Worker image (keyless)
+        run: |
+          cosign sign --yes \
+            ${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/ai-worker@${{ steps.push-worker.outputs.digest }}
+
+      - name: Generate SBOM for API (SPDX)
+        uses: aquasecurity/trivy-action@0.24.0
+        with:
+          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/ai-api@${{ steps.push-api.outputs.digest }}
+          format: spdx-json
+          output: sbom-api.spdx.json
+
+      - name: Generate SBOM for API (CycloneDX)
+        uses: aquasecurity/trivy-action@0.24.0
+        with:
+          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/ai-api@${{ steps.push-api.outputs.digest }}
+          format: cyclonedx
+          output: sbom-api.cyclonedx.json
+
+      - name: Generate SBOM for Worker (SPDX)
+        uses: aquasecurity/trivy-action@0.24.0
+        with:
+          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/ai-worker@${{ steps.push-worker.outputs.digest }}
+          format: spdx-json
+          output: sbom-worker.spdx.json
+
+      - name: Attest SBOM for API
+        run: |
+          cosign attest --yes \
+            --predicate sbom-api.spdx.json \
+            --type spdxjson \
+            ${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/ai-api@${{ steps.push-api.outputs.digest }}
+
+      - name: Attest SBOM for Worker
+        run: |
+          cosign attest --yes \
+            --predicate sbom-worker.spdx.json \
+            --type spdxjson \
+            ${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/ai-worker@${{ steps.push-worker.outputs.digest }}
+
+      - name: Upload SBOMs as artefacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: sbom-${{ steps.meta.outputs.version }}
+          path: "sbom-*.json"
+
+      - name: Verify API signature
+        run: |
+          cosign verify \
+            --certificate-identity-regexp "https://github.com/${{ github.repository }}/.github/workflows/project-41-release.yml.*" \
+            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+            ${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/ai-api@${{ steps.push-api.outputs.digest }}
+
+      - name: Verify Worker signature
+        run: |
+          cosign verify \
+            --certificate-identity-regexp "https://github.com/${{ github.repository }}/.github/workflows/project-41-release.yml.*" \
+            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+            ${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/ai-worker@${{ steps.push-worker.outputs.digest }}

.github/workflows/project-41-security.yml

@@ -0,0 +1,109 @@
+name: "[P41] Security Scanning"
+
+on:
+  push:
+    branches: [devops-project, master]
+    paths:
+      - "DevOps-Project-41/app/**"
+      - "DevOps-Project-41/k8s/**"
+      - ".github/workflows/project-41-security.yml"
+  schedule:
+    - cron: "0 6 * * 1"  # Weekly on Monday at 06:00 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+env:
+  APP_DIR: DevOps-Project-41/app
+
+jobs:
+  trivy-filesystem:
+    name: Trivy Filesystem Scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Run Trivy filesystem scan
+        uses: aquasecurity/trivy-action@0.24.0
+        with:
+          scan-type: fs
+          scan-ref: DevOps-Project-41
+          format: sarif
+          output: trivy-fs.sarif
+          severity: HIGH,CRITICAL
+          exit-code: "0"
+
+      - name: Upload SARIF to GitHub Security
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: trivy-fs.sarif
+          category: trivy-filesystem
+
+  trivy-config:
+    name: Trivy Kubernetes Manifest Scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Run Trivy config scan on k8s manifests
+        uses: aquasecurity/trivy-action@0.24.0
+        with:
+          scan-type: config
+          scan-ref: DevOps-Project-41/k8s
+          format: sarif
+          output: trivy-config.sarif
+          severity: HIGH,CRITICAL
+          exit-code: "0"
+
+      - name: Upload SARIF to GitHub Security
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: trivy-config.sarif
+          category: trivy-config
+
+  trivy-image:
+    name: Trivy Image Scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build API image for scanning
+        uses: docker/build-push-action@v6
+        with:
+          context: ${{ env.APP_DIR }}
+          file: ${{ env.APP_DIR }}/Dockerfile
+          target: api
+          push: false
+          load: true
+          tags: ai-api:scan
+          cache-from: type=gha
+
+      - name: Scan API image with Trivy
+        uses: aquasecurity/trivy-action@0.24.0
+        with:
+          image-ref: ai-api:scan
+          format: sarif
+          output: trivy-image-api.sarif
+          severity: HIGH,CRITICAL
+          exit-code: "0"
+
+      - name: Upload API image SARIF
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: trivy-image-api.sarif
+          category: trivy-image-api
+
+      - name: Upload scan reports as artefacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: trivy-reports
+          path: "*.sarif"