CodeQuality.yml

name: Build & Test & SonarQube

on:
  push:
  pull_request:
    types: [opened, synchronize, reopened]
    
jobs:
  build:
    name: Build
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout code
        uses: actions/checkout@v6.0.2
        with:
          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis

      - name: Set up JDK 17
        uses: actions/setup-java@v5.2.0
        with:
          distribution: 'temurin'
          java-version: '17'
          overwrite-settings: false

      - name: Setup dotnet
        uses: actions/setup-dotnet@v5.1.0
        with:
          dotnet-version: '10.0.x'

      - name: add Starion GitHub nuget feed
        env:
          GH_PR_TOKEN: ${{ secrets.GH_PR_TOKEN }}
        run: dotnet nuget add source https://nuget.pkg.github.com/STARIONGROUP/index.json -n GHRHEA -u gh -p $GH_PR_TOKEN --store-password-in-clear-text

      - name: Restore dependencies
        run: dotnet restore COMET-WebServices.sln
        
      - name: Sonarqube Begin
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_SCANNER_OPTS: "-Xmx4096m"
        run: |
          dotnet tool install --global dotnet-sonarscanner
          dotnet tool install --global dotnet-coverage
          dotnet sonarscanner begin /k:"STARIONGROUP_CDP4-COMET-WebServices-Community-Edition" /o:"stariongroup" /d:sonar.token="$SONAR_TOKEN" /d:sonar.host.url="https://sonarcloud.io" /d:sonar.coverageReportPaths="./CoverageResultsReport/SonarQube.xml"
          
      - name: Build
        run: dotnet build COMET-WebServices.sln -c Debug --no-restore /p:ContinuousIntegrationBuild=true

      - name: Run Unit Tests and Compute Coverage
        run: dotnet test COMET-WebServices.sln --no-restore --no-build --verbosity normal /p:CollectCoverage=true /p:CoverletOutput="../CoverageResults/" /p:MergeWith="../CoverageResults/coverage.json" /p:CoverletOutputFormat=\"cobertura,opencover,json\"

      - name: Set up Docker
        uses: docker/setup-buildx-action@v3

      - name: cdp4-test-database-community-edition Image
        run: docker pull stariongroup/cdp4-test-database-community-edition:4.2.0

      - name: Create TLS certificates for PostgreSQL
        run: |
          mkdir -p "$RUNNER_TEMP/db-tls" && cd "$RUNNER_TEMP/db-tls"
          # throw-away CA and server certificate, valid for this run only
          openssl req -x509 -newkey rsa:2048 -nodes -days 1 -subj "/CN=COMET CI Test CA" -keyout ca.key -out ca.crt
          openssl req -newkey rsa:2048 -nodes -subj "/CN=localhost" -keyout server.key -out server.csr
          openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -days 1 -out server.crt \
            -extfile <(printf "subjectAltName=DNS:localhost")
          # a second CA, used to check that a certificate from the wrong CA is rejected
          openssl req -x509 -newkey rsa:2048 -nodes -days 1 -subj "/CN=Wrong CA" -keyout wrong-ca.key -out wrong-ca.crt
          # network connections must use TLS; the init script of the image uses the local socket
          printf "local all all trust\nhostssl all all all scram-sha-256\n" > pg_hba.conf
          # PostgreSQL only accepts a private key owned by its own user (uid 70 in the alpine based image)
          sudo chown 70:70 server.key server.crt pg_hba.conf
          sudo chmod 600 server.key

      - name: Start PostgreSQL Container (TLS only)
        run: |
          docker run -d \
            -e POSTGRES_PASSWORD=postgres \
            -p 127.0.0.1:5432:5432 \
            --tmpfs /var/lib/postgresql/data:rw \
            -v "$RUNNER_TEMP/db-tls:/etc/postgresql-tls:ro" \
            --name comet-db \
            stariongroup/cdp4-test-database-community-edition:4.2.0 \
            postgres \
              -c ssl=on \
              -c ssl_cert_file=/etc/postgresql-tls/server.crt \
              -c ssl_key_file=/etc/postgresql-tls/server.key \
              -c ssl_min_protocol_version=TLSv1.2 \
              -c hba_file=/etc/postgresql-tls/pg_hba.conf

      - name: Wait for PostgreSQL to be ready
        run: |
          until docker exec comet-db pg_isready -U postgres; do
            echo "Waiting for PostgreSQL to be ready..."
            sleep 5
          done

      - name: install dotnet-coverage
        run: dotnet tool install --global dotnet-coverage

      - name: install dotnet-reportgenerator-globaltool
        run: dotnet tool install --global dotnet-reportgenerator-globaltool

      - name: Start coverage collector
        run: |
          dotnet-coverage collect \
            --session-id integrationtestsession \
            --server-mode \
            --background \
            --output CoverageResults/integration.cobertura.xml \
            --output-format cobertura \
            --log-file CoverageResults/coverage.log \
            --log-level Verbose

      - name: Start API
        env:
          Backtier__SslMode: VerifyFull
          Backtier__RootCertificate: ${{ runner.temp }}/db-tls/ca.crt
        run: |
          set x
          dotnet run --project CometServer/CometServer.csproj -c Debug --no-build --no-restore > api.log 2>&1 &

      - name: Wait for API to become ready
        run: |
          echo "Waiting for API on http://localhost:5000/healthz"
          for i in {1..60}; do
            if curl -s -o /dev/null -w "%{http_code}" http://localhost:5000/healthz | grep -q "200"; then
              echo "API is UP"
              exit 0
            fi
            echo "[$i/60] API not ready yet, retrying in 2 seconds..."
            sleep 2
          done
          echo "ERROR: API did not become ready in time"
          exit 1

      - name: Checkout Integration Test Suite
        uses: actions/checkout@v6.0.2
        with:
          repository: STARIONGROUP/ecss-10-25-annexc-integration-tests
          path: integration-tests

      - name: Zip Integration Test Results
        run: |
          cd integration-tests/Data
          zip -r Data.zip .
          
      - name: Post Zipped Results to REST API
        run: |
          curl --form file=@"integration-tests/Data/Data.zip" http://localhost:5000/Data/Exchange

      - name: Verify that the API uses a verified TLS connection to PostgreSQL
        run: |
          # the database is created by the seed above, the API connects to it and reports ready afterwards
          for i in {1..60}; do
            grep -q "ready to accept requests" api.log && break
            echo "[$i/60] API not ready yet, retrying in 2 seconds..."
            sleep 2
          done
          grep "ready to accept requests" api.log
          grep "is encrypted using TLS" api.log
          if grep -E "NOT encrypted|not fully verified" api.log; then
            echo "::error::the connection to PostgreSQL is not encrypted or not verified"
            exit 1
          fi

      - name: Restore Dependencies for Integration Tests
        run: dotnet restore integration-tests/IntegrationTestSuite/WebservicesIntegrationTests.sln

      - name: Run Integration Tests
        run: |
          set +e
          dotnet test integration-tests/IntegrationTestSuite/MessagePackIntegrationTests/MessagePackIntegrationTests.csproj \
            --settings integration-tests/IntegrationTestSuite/.runsettings \
            --logger "trx;LogFileName=msgpack_results.trx" --verbosity detailed
          MESSAGEPACK_EXIT=$?
          dotnet test integration-tests/IntegrationTestSuite/WebservicesIntegrationTests/WebservicesIntegrationTests.csproj \
            --settings integration-tests/IntegrationTestSuite/.runsettings \
            --logger "trx;LogFileName=test_results.trx" --verbosity detailed
          WEBSERVICES_EXIT=$?
          echo "MessagePackIntegrationTests exit code: $MESSAGEPACK_EXIT"
          echo "WebservicesIntegrationTests exit code: $WEBSERVICES_EXIT"
          [ $MESSAGEPACK_EXIT -eq 0 ] && [ $WEBSERVICES_EXIT -eq 0 ]

      - name: Verify that TLS misconfigurations stop the API
        run: |
          # each check starts a second API instance that must stop at once with exit code 1 and the expected message
          set +e
          check() {
            expected="$1"
            shift
            env "$@" Kestrel__Endpoints__Http__Url=http://localhost:5099 \
              timeout 120 dotnet run --project CometServer/CometServer.csproj -c Debug --no-build --no-restore > tls-check.log 2>&1
            code=$?
            if [ $code -ne 1 ] || ! grep -q "$expected" tls-check.log; then
              echo "::error::expected exit code 1 and '$expected', got exit code $code"
              cat tls-check.log
              exit 1
            fi
            echo "OK: $expected"
          }
          check "is not trusted by Backtier:RootCertificate" \
            Backtier__SslMode=VerifyFull Backtier__RootCertificate="$RUNNER_TEMP/db-tls/wrong-ca.crt"
          check "is not valid for the host name '127.0.0.1'" \
            Backtier__SslMode=VerifyFull Backtier__RootCertificate="$RUNNER_TEMP/db-tls/ca.crt" Backtier__HostName=127.0.0.1
          check "only accepts encrypted connections" \
            Backtier__SslMode=Disable

      - name: Shutdown Integration Test session
        run: dotnet-coverage shutdown integrationtestsession

      - name: merge integration tests with unit tests
        run: dotnet-coverage merge --output-format cobertura --output CoverageResults/merged-coverage.cobertura.xml CoverageResults/*.cobertura.xml

      - name: generate SonarQube compatible coverage report
        run: reportgenerator -reports:CoverageResults/merged-coverage.cobertura.xml -targetdir:CoverageResultsReport -reporttypes:SonarQube -assemblyfilters:"-CDP4Common;-CDP4DalCommon;-CDP4JsonSerializer;-CDP4MessagePackSerializer;-FluentValidation;-HangFire*;-Serilog*"

      - name: Stop PostgreSQL Container
        run: docker stop comet-db && docker rm comet-db

      - name: Sonarqube end
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        run: dotnet sonarscanner end /d:sonar.token="$SONAR_TOKEN"