cicd(workflows): create top-level ci pipeline workflow which combines…

.github/workflows/app-test-charts.yaml

@@ -51,23 +51,12 @@ on:
         default: 'latest'
         required: false
         type: string
-  pull_request:
-    paths:
-      - 'pom.xml'
-      - 'bpdm-**'
-      - 'charts/**'
-      - '.github/workflows/app-test-charts.yaml'
-      - 'docker/**'
   push:
     branches:
       - main
       - release/**
 jobs:
-  build-apps:
-    uses: ./.github/workflows/docker-build-and-cache-all.yaml
-
   execute-tests:
-    needs:  build-apps
     runs-on: ubuntu-latest
     steps:
       - name: Checkout

.github/workflows/app-test-maven.yaml

@@ -19,7 +19,6 @@
 
 name: Perform Maven Tests
 on:
-  pull_request:
   workflow_call:
   workflow_dispatch:
 

.github/workflows/app-test-trivy.yaml

@@ -21,10 +21,6 @@ name: 'Perform Trivy Scan on All Apps'
 on:
   workflow_dispatch:
   workflow_call:
-  pull_request:
-    branches:
-      - main
-      - 'release/**'
 jobs:
   scan-image:
     runs-on: ubuntu-latest
@@ -35,16 +31,15 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd #v4.0.0
-
-      - name: Build App Image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f #v7.1.0
+      - name: Download App Image
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.1
         with:
-          context: .
-          file: docker/${{ matrix.app }}/Dockerfile
-          tags: bpdm-${{ matrix.app }}:test
-          load: true
+          name: bpdm-${{ matrix.app }}-docker
+          path: /tmp
+
+      - name: Load App Image
+        run: |
+          docker load --input /tmp/bpdm-${{ matrix.app }}.tar
 
       - name: Run Trivy vulnerability scanner
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 #v0.36.0

.github/workflows/chart-test-lint.yaml

@@ -20,7 +20,6 @@
 name: Lint Charts
 
 on:
-  pull_request:
   workflow_call:
     inputs:
       helm_version:

.github/workflows/check-versions.yaml

@@ -21,8 +21,9 @@ name: Check Versions
 on:
   workflow_dispatch:
   workflow_call:
-  pull_request:
   push:
+    branches:
+      - main
 jobs:
   check-versions:
     runs-on: ubuntu-latest

.github/workflows/ci.yaml

@@ -0,0 +1,48 @@
+################################################################################
+# Copyright (c) 2021 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License, Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0.
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+################################################################################
+
+name: Perform continuous integration checks
+on:
+  workflow_call:
+  pull_request:
+    branches:
+      - main
+jobs:
+  check-versions:
+    uses: ./.github/workflows/check-versions.yaml
+
+  maven-verify:
+    uses: ./.github/workflows/app-test-maven.yaml
+
+  trufflehog:
+    uses: ./.github/workflows/trufflehog.yml
+
+  containerize:
+    uses: ./.github/workflows/docker-build-and-cache-all.yaml
+
+  trivy:
+    needs: containerize
+    uses: ./.github/workflows/app-test-trivy.yaml
+
+  chart-lint:
+    uses: ./.github/workflows/chart-test-lint.yaml
+
+  chart-tests:
+    needs: containerize
+    uses: ./.github/workflows/app-test-charts.yaml

.github/workflows/trufflehog.yml

@@ -22,12 +22,10 @@ name: "TruffleHog"
 on:
   push:
     branches: ["main"]
-  pull_request:
-    # The branches below must be a subset of the branches above
-    branches: ["main"]
   schedule:
     - cron: "0 0 * * *" # Once a day
   workflow_dispatch:
+  workflow_call:
 
 permissions:
   actions: read