ochestrator.yaml

name: Full Infrastructure + App Deploy + ELK Deploy

on:
  workflow_dispatch:
    inputs:
      action:
        description: "apply/destroy"
        required: true
        default: "apply"
        type: choice
        options:
          - full-deploy
          - destroy
          - infra-only
          - scan-only
          - build-only
          - deploy-elk-only
          - scan+deploy-app-only
          - scan+deploy-app-only+deploy-elk-only
          - infra+scan+app
          - infra+scan+app+elk 
          - infra+elk
          - scan+build

jobs:
  terraform-apply:
    if: contains(fromJson('["infra-only", "infra+elk", "infra+scan+app+elk ", "infra+scan+app", "full-deploy"]'), github.event.inputs.action) #if: ${{ github.event.inputs.action == 'apply' }}
    name: "Terraform-apply"
    runs-on: ubuntu-latest
    outputs:
      bastion_ip: ${{ steps.tf_outputs.outputs.bastion_ip }}
      ec2_ip: ${{ steps.tf_outputs.outputs.ec2_ip }}
      elk_ip: ${{ steps.tf_outputs.outputs.elk_ip }}
    env:
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    defaults:
      run:
        working-directory: infra/aws/

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.0.1
          terraform_wrapper: false

      - name: Terraform Init
        run: terraform init

      - name: Terraform fmt
        run: terraform fmt -recursive

      - name: Terraform Plan
        run: terraform plan -no-color

      - name: Terraform Apply
        run: terraform apply -auto-approve

      - name: Capture Terraform Outputs
        id: tf_outputs
        run: |
          terraform output -json > outputs.json
          echo "Generated outputs.json at: $(pwd)/outputs.json"
              echo "--- outputs.json ---"
              cat outputs.json
              echo "--------------------"
          sudo apt-get install -y jq 
          echo "bastion_ip=$(jq -r '.bastion_public_ip.value' outputs.json)" >> $GITHUB_OUTPUT
          echo "ec2_ip=$(jq -r '.ec2_private_ip.value' outputs.json)" >> $GITHUB_OUTPUT
          echo "elk_ip=$(jq -r '.elk_private_ip.value' outputs.json)" >> $GITHUB_OUTPUT
          echo "lb_dns=$(jq -r '.lb_dns.value' outputs.json)" >> $GITHUB_OUTPUT

      - name: Upload Terraform Outputs to Github Aretefacts
        uses: actions/upload-artifact@v4
        with:
          name: terraform-outputs
          path: infra/aws/outputs.json

      - name: Upload Terraform outputs to S3
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_REGION: ${{ secrets.AWS_REGION }}
        run: |
          aws s3 cp outputs.json s3://sedem-terra333-bucket/devsecops-jomacs/tf-outputs-latest.json


  scan:
    runs-on: ubuntu-latest
    if: contains(fromJson('["scan-only", "scan+build", "infra+scan+app", "infra+scan+app+elk", "scan+deploy-app-only", "scan+deploy-app-only+deploy-elk-only", "full-deploy"]'), github.event.inputs.action) #${{ github.event.inputs.action == 'apply' }}
    steps:
      # 1. Checkout Code from GitHub
      - name: Checkout Code
        uses: actions/checkout@v4

      # 2. Set up Python environment and install dependencies
      - name: Set up Python 3.x
        uses: actions/setup-python@v5
        with:
          python-version: "3.10"

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r ./app/python/requirements.txt
          pip install bandit safety

      # 3. Run Bandit scan (Python code security scanner)
      - name: Run Bandit Scan
        run: |
          bandit -r ./app/python -f json -o app/python/bandit-report.json || exit 1

      # 4. Run Safety scan (Dependency vulnerability scanner)
      - name: Run Safety Scan
        run: |
          safety check -r app/python/requirements.txt --policy-file app/python/.safety.yaml --output json > app/python/safety-report.json || exit 1

      # 5. Upload the reports for later review
      - name: Upload Bandit Report
        if: always() # Always upload, even if workflow fails
        uses: actions/upload-artifact@v4
        with:
          name: bandit-report
          path: ./app/python/bandit-report.json

      - name: Upload Safety Report
        if: always() # Always upload, even if workflow fails
        uses: actions/upload-artifact@v4
        with:
          name: safety-report
          path: ./app/python/safety-report.json


  build:
    needs: scan # Ensure deploy only happens after the scan job
    if: contains(fromJson('["build-only", "scan+build", "full-deploy"]'), github.event.inputs.action) #if: ${{ github.event.inputs.action == 'apply' && success() }}
    runs-on: ubuntu-latest
    steps:
      #1. Checkout code from the repository
      - name: Checkout code
        uses: actions/checkout@v4

      #2. Set up Docker Buildx (required for multi-platform builds)
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      #3. Set up Docker
      - name: Set up Docker
        uses: docker/setup-qemu-action@v3

      #4. Build the Docker image
      - name: Build Docker image
        run: |
          docker build -t michaelkedey/jomacsdevsecops:latest -f app/containerization/Dockerfile app/python/

      #5. Install Trivy
      - name: Install Trivy
        run: |
          curl -sfL https://github.com/aquasecurity/trivy/releases/download/v0.40.0/trivy_0.40.0_Linux-64bit.deb -o trivy.deb
          sudo dpkg -i trivy.deb

      #6. Scan the Docker image for vulnerabilities using Trivy
      - name: Scan Docker image for vulnerabilities
        id: trivy_scan
        run: |
          mkdir -p trivy-reports
          trivy image --no-progress --severity HIGH,CRITICAL --format json --output trivy-reports/scan-report.json michaelkedey/jomacsdevsecops:latest

      #7. Upload the Trivy scan report as an artifact (so you can download it later)
      - name: Upload Trivy scan report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: trivy-scan-report
          path: trivy-reports/scan-report.json

      #8. If no vulnerabilities with high severity are found, push to Docker Hub
      - name: Push Docker image to Docker Hub
        if: ${{ success() }}
        env:
          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
        run: |
          echo $DOCKER_PASSWORD | docker login -u $DOCKER_USERNAME --password-stdin
          docker push michaelkedey/jomacsdevsecops:latest


  app-deploy:
    needs: [terraform-apply, scan] # Ensure deploy only happens after the scan job
    if: contains(fromJson('["infra+scan+app", "infra+scan+app+elk ", "full-deploy"]'), github.event.inputs.action) #if: ${{ github.event.inputs.action == 'apply' && success() }}  # Only run if the scan job succeeds
    runs-on: ubuntu-latest
    steps:
      # 1. Checkout Code from GitHub
      - name: Checkout Code
        uses: actions/checkout@v4

      # 2. Download tf outputs
      - name: Download Terraform outputs from S3
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_REGION: ${{ secrets.AWS_REGION }}
        run: |
          mkdir -p terraform-outputs
          aws s3 cp s3://sedem-terra333-bucket/devsecops-jomacs/tf-outputs-latest.json terraform-outputs/outputs.json

      # 3. parse tf outputs to extract variables
      - name: Parse Terraform Outputs and establish SSH tunnel
        env:
          PRIVATE_KEY: ${{ secrets.EC2_SSH_KEY }}
          USER: ${{ secrets.EC2_USER }}
          PORT: ${{ secrets.SSH_PORT }}
          TUNNEL: ${{ secrets.SSH_TUNNEL_PORT }}
        run: |
          set -e
          sudo apt-get update && sudo apt-get install -y jq
          cat terraform-outputs/outputs.json

          bastion_ip=$(jq -r '.bastion_public_ip.value' terraform-outputs/outputs.json)
          ec2_ip=$(jq -r '.ec2_private_ip.value' terraform-outputs/outputs.json)
          elk_ip=$(jq -r '.elk_private_ip.value' terraform-outputs/outputs.json)

          BASTION=${bastion_ip}
          HOST=${ec2_ip}
          #LOGSTASH_IP=${elk_ip}

          #echo "BASTION=${bastion_ip}" >> $GITHUB_ENV
          #echo "HOST=${ec2_ip}" >> $GITHUB_ENV
          echo "LOGSTASH_IP=${elk_ip}" >> $GITHUB_ENV

          echo "$PRIVATE_KEY" > private_key.pem && chmod 600 private_key.pem

          echo "Establishing SSH tunnel..."
          sleep 120
          ssh -i private_key.pem -o StrictHostKeyChecking=no -tt -L ${TUNNEL}:${HOST}:${PORT} -p ${PORT} ${USER}@${BASTION} -N -f

      - name: deploy-app
        uses: ./.github/actions/app
        with:
          logstash_ip: ${{ env.LOGSTASH_IP }}
          log_file: "app-deploy-only.log"
          EC2_USER: ${{ secrets.EC2_USER }}
          SSH_TUNNEL_PORT: ${{ secrets.SSH_TUNNEL_PORT }}
          LOGSTASH_PORT: ${{ secrets.LOGSTASH_PORT }}
          APP_PORT: ${{ secrets.APP_PORT }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_REGION: ${{ secrets.AWS_REGION }}
          DEVSECOPS_GPG_PASSPHRASE: ${{ secrets.DEVSECOPS_GPG_PASSPHRASE }}
          EC2_SSH_KEY: ${{ secrets.EC2_SSH_KEY }}
          MAXIMIND_LICENSE_KEY: ${{ secrets.MAXIMIND_LICENSE_KEY }}


  app-deploy-only:
    needs: scan
    if: contains(fromJson('["scan+deploy-app-only", "scan+deploy-app-only+deploy-elk-only"]'), github.event.inputs.action)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Download Terraform outputs from S3
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_REGION: ${{ secrets.AWS_REGION }}
        run: |
          mkdir -p terraform-outputs
          aws s3 cp s3://sedem-terra333-bucket/devsecops-jomacs/tf-outputs-latest.json terraform-outputs/outputs.json

      - name: Parse Terraform Outputs and establish SSH tunnel
        env:
          PRIVATE_KEY: ${{ secrets.EC2_SSH_KEY }}
          USER: ${{ secrets.EC2_USER }}
          PORT: ${{ secrets.SSH_PORT }}
          TUNNEL: ${{ secrets.SSH_TUNNEL_PORT }}
        run: |
          set -e
          sudo apt-get update && sudo apt-get install -y jq
          cat terraform-outputs/outputs.json

          bastion_ip=$(jq -r '.bastion_public_ip.value' terraform-outputs/outputs.json)
          ec2_ip=$(jq -r '.ec2_private_ip.value' terraform-outputs/outputs.json)
          elk_ip=$(jq -r '.elk_private_ip.value' terraform-outputs/outputs.json)

          BASTION=${bastion_ip}
          HOST=${ec2_ip}
          #LOGSTASH_IP=${elk_ip}

          #echo "BASTION=${bastion_ip}" >> $GITHUB_ENV
          #echo "HOST=${ec2_ip}" >> $GITHUB_ENV
          echo "LOGSTASH_IP=${elk_ip}" >> $GITHUB_ENV

          echo "$PRIVATE_KEY" > private_key.pem && chmod 600 private_key.pem

          echo "Establishing SSH tunnel..."
          ssh -i private_key.pem -o StrictHostKeyChecking=no -tt -L ${TUNNEL}:${HOST}:${PORT} -p ${PORT} ${USER}@${BASTION} -N -f

      - name: deploy-app-only
        uses: ./.github/actions/app
        with:
          logstash_ip: ${{ env.LOGSTASH_IP }}
          log_file: "app-deploy-only.log"
          EC2_USER: ${{ secrets.EC2_USER }}
          SSH_TUNNEL_PORT: ${{ secrets.SSH_TUNNEL_PORT }}
          LOGSTASH_PORT: ${{ secrets.LOGSTASH_PORT }}
          APP_PORT: ${{ secrets.APP_PORT }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_REGION: ${{ secrets.AWS_REGION }}
          DEVSECOPS_GPG_PASSPHRASE: ${{ secrets.DEVSECOPS_GPG_PASSPHRASE }}
          EC2_SSH_KEY: ${{ secrets.EC2_SSH_KEY }}
          MAXIMIND_LICENSE_KEY: ${{ secrets.MAXIMIND_LICENSE_KEY }}


  elk-deploy-only:
    if: contains(fromJson('["deploy-elk-only", "scan+deploy-app-only+deploy-elk-only"]'), github.event.inputs.action)
    runs-on: ubuntu-latest
    outputs:
      bastion_ip: ${{ steps.parse-outputs.outputs.bastion_ip }}
      elk_ip: ${{ steps.parse-outputs.outputs.elk_ip }}
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Download Terraform outputs from S3
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_REGION: ${{ secrets.AWS_REGION }}
        run: |
          mkdir -p terraform-outputs
          aws s3 cp s3://sedem-terra333-bucket/devsecops-jomacs/tf-outputs-latest.json terraform-outputs/outputs.json

      - name: Parse Terraform Outputs
        id: parse-outputs
        env:
          PRIVATE_KEY: ${{ secrets.EC2_SSH_KEY }}
          USER: ${{ secrets.EC2_USER }}
          PORT: ${{ secrets.SSH_PORT }}
          TUNNEL: ${{ secrets.ELK_TUNNEL_PORT }}
        run: |
          set -e
          sudo apt-get update && sudo apt-get install -y jq
          
          bastion_ip=$(jq -r '.bastion_public_ip.value' terraform-outputs/outputs.json)
          elk_ip=$(jq -r '.elk_private_ip.value' terraform-outputs/outputs.json)
          alb_dns=$(jq -r '.lb_dns.value' terraform-outputs/outputs.json)

          BASTION=${bastion_ip}
          ELK=${elk_ip}

          #echo "BASTION=${bastion_ip}" >> $GITHUB_ENV
          #echo "HOST=${elk_ip}" >> $GITHUB_ENV
          echo "ALB_DNS=$alb_dns" >> $GITHUB_ENV

          echo "$PRIVATE_KEY" > private_key.pem && chmod 600 private_key.pem

          # Establish the SSH tunnel from GitHub Actions to the target EC2 instance
          # This command forwards the local port ${TUNNEL} to the target EC2 instance's SSH  
          ssh -i private_key.pem -o StrictHostKeyChecking=no -tt -L ${TUNNEL}:${ELK}:${PORT} -p ${PORT} ${USER}@${BASTION} -N -f
        
      - name: deploy-elk-only
        uses: ./.github/actions/elk
        with:
          log_file: "elk-deploy-only.log"
          alb_dns: ${{ env.ALB_DNS }}
          EC2_USER: ${{ secrets.EC2_USER }}
          ELK_TUNNEL_PORT: ${{ secrets.ELK_TUNNEL_PORT }}
          LOGSTASH_PORT: ${{ secrets.LOGSTASH_PORT }}
          ELASTICSEARCH_PORT: ${{ secrets.ELASTICSEARCH_PORT }}
          EC2_SSH_KEY: ${{ secrets.EC2_SSH_KEY }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_REGION: ${{ secrets.AWS_REGION }}
          DEVSECOPS_GPG_PASSPHRASE: ${{ secrets.DEVSECOPS_GPG_PASSPHRASE }}
          MAXIMIND_LICENSE_KEY: ${{ secrets.MAXIMIND_LICENSE_KEY }}


  elk-deploy:
    needs: terraform-apply # Ensure deploy only happens after the scan job
    if: contains(fromJson('["infra+elk", "infra+scan+app+elk", "full-deploy"]'), github.event.inputs.action) #if: ${{ github.event.inputs.action == 'apply' && success() }}  # Only run if the app deploy job succeeds
    runs-on: ubuntu-latest
    outputs:
      bastion_ip: ${{ steps.parse-outputs.outputs.bastion_ip }}
      elk_ip: ${{ steps.parse-outputs.outputs.elk_ip }}
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Download Terraform outputs from S3
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_REGION: ${{ secrets.AWS_REGION }}
        run: |
          mkdir -p terraform-outputs
          aws s3 cp s3://sedem-terra333-bucket/devsecops-jomacs/tf-outputs-latest.json terraform-outputs/outputs.json

      - name: Parse Terraform Outputs
        id: parse-outputs
        env:
          PRIVATE_KEY: ${{ secrets.EC2_SSH_KEY }}
          USER: ${{ secrets.EC2_USER }}
          PORT: ${{ secrets.SSH_PORT }}
          TUNNEL: ${{ secrets.ELK_TUNNEL_PORT }}
        run: |
          set -e
          sudo apt-get update && sudo apt-get install -y jq
          
          bastion_ip=$(jq -r '.bastion_public_ip.value' terraform-outputs/outputs.json)
          elk_ip=$(jq -r '.elk_private_ip.value' terraform-outputs/outputs.json)
          alb_dns=$(jq -r '.lb_dns.value' terraform-outputs/outputs.json)

          BASTION=${bastion_ip}
          ELK=${elk_ip}

          #echo "BASTION=${bastion_ip}" >> $GITHUB_ENV
          #echo "HOST=${elk_ip}" >> $GITHUB_ENV
          echo "ALB_DNS=$alb_dns" >> $GITHUB_ENV

          echo "$PRIVATE_KEY" > private_key.pem && chmod 600 private_key.pem

          # Establish the SSH tunnel from GitHub Actions to the target EC2 instance
          # This command forwards the local port ${TUNNEL} to the target EC2 instance's SSH  
          sleep 120
          ssh -i private_key.pem -o StrictHostKeyChecking=no -tt -L ${TUNNEL}:${ELK}:${PORT} -p ${PORT} ${USER}@${BASTION} -N -f
        
      - name: deploy-elk
        uses: ./.github/actions/elk
        with:
          log_file: "elk-deploy-only.log"
          alb_dns: ${{ env.ALB_DNS }}
          EC2_USER: ${{ secrets.EC2_USER }}
          ELK_TUNNEL_PORT: ${{ secrets.ELK_TUNNEL_PORT }}
          LOGSTASH_PORT: ${{ secrets.LOGSTASH_PORT }}
          ELASTICSEARCH_PORT: ${{ secrets.ELASTICSEARCH_PORT }}
          EC2_SSH_KEY: ${{ secrets.EC2_SSH_KEY }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_REGION: ${{ secrets.AWS_REGION }}
          DEVSECOPS_GPG_PASSPHRASE: ${{ secrets.DEVSECOPS_GPG_PASSPHRASE }}
          MAXIMIND_LICENSE_KEY: ${{ secrets.MAXIMIND_LICENSE_KEY }}
          

  terraform-destroy:
    name: "Terraform Destroy"
    runs-on: ubuntu-latest
    env:
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    defaults:
      run:
        working-directory: infra/aws/
    # Only run if "destroy" is selected manually
    if: github.event.inputs.action == 'destroy'
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.0.1

      - name: Terraform Init
        run: terraform init

      - name: Terraform Destroy
        run: terraform destroy -auto-approve