MINIPASSS/.github/workflows/ci.yml at main · Demiserular/MINIPASSS · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
name: CI

on:
    push:
        branches: [main]
    pull_request:
        branches: [main]

permissions:
    contents: read
    security-events: write

jobs:
    build:
        runs-on: ubuntu-latest

        steps:
            - uses: actions/checkout@v4

            - name: Set up Go
              uses: actions/setup-go@v5
              with:
                  go-version: "1.24"

            - name: Download dependencies
              run: go mod download

            - name: Verify dependencies
              run: go mod verify

            - name: Build
              run: go build -v ./...

            - name: Run go vet
              run: go vet ./...

            - name: Run tests
              run: go test -v -race -coverprofile=coverage.out ./...

            - name: Upload coverage
              uses: actions/upload-artifact@v4
              with:
                  name: coverage
                  path: coverage.out

    lint:
        runs-on: ubuntu-latest

        steps:
            - uses: actions/checkout@v4

            - name: Set up Go
              uses: actions/setup-go@v5
              with:
                  go-version: "1.24"

            - name: Run golangci-lint
              uses: golangci/golangci-lint-action@v4
              with:
                  version: latest
                  args: --timeout=5m

    security:
        runs-on: ubuntu-latest

        steps:
            - uses: actions/checkout@v4

            - name: Set up Go
              uses: actions/setup-go@v5
              with:
                  go-version: "1.24"

            - name: Run Gosec Security Scanner
              uses: securego/gosec@master
              with:
                  args: -fmt sarif -out gosec-results.sarif ./...

            - name: Check for Gosec SARIF results
              id: check-gosec
              run: |
                  if [ -f gosec-results.sarif ]; then echo "exists=true" >> $GITHUB_OUTPUT; else echo "exists=false" >> $GITHUB_OUTPUT; fi

            - name: Upload Gosec results to GitHub Security
              uses: github/codeql-action/upload-sarif@v4
              if: ${{ always() && (steps.check-gosec.outputs.exists == 'true') }}
              with:
                  sarif_file: gosec-results.sarif

    vulnerability-scan:
        runs-on: ubuntu-latest

        steps:
            - uses: actions/checkout@v4

            - name: Set up Go
              uses: actions/setup-go@v5
              with:
                  go-version: "1.24"

            - name: Run govulncheck
              run: |
                  go install golang.org/x/vuln/cmd/govulncheck@latest
                  govulncheck ./...

    dependency-review:
        runs-on: ubuntu-latest
        if: github.event_name == 'pull_request'

        steps:
            - uses: actions/checkout@v4

            - name: Dependency Review
              uses: actions/dependency-review-action@v4
              with:
                  fail-on-severity: high

    docker:
        runs-on: ubuntu-latest
        needs: [build, lint, security, vulnerability-scan]

        steps:
            - uses: actions/checkout@v4

            - name: Set up Docker Buildx
              uses: docker/setup-buildx-action@v3

            - name: Build Docker image
              uses: docker/build-push-action@v5
              with:
                  context: .
                  push: false
                  load: true
                  tags: minipaas:${{ github.sha }}
                  cache-from: type=gha
                  cache-to: type=gha,mode=max

            - name: Run Trivy vulnerability scanner
              uses: aquasecurity/trivy-action@master
              with:
                  image-ref: minipaas:${{ github.sha }}
                  format: "sarif"
                  output: "trivy-results.sarif"
                  severity: "CRITICAL,HIGH"

            - name: Check for Trivy SARIF results
              id: check-trivy
              run: |
                  if [ -f trivy-results.sarif ]; then echo "exists=true" >> $GITHUB_OUTPUT; else echo "exists=false" >> $GITHUB_OUTPUT; fi

            - name: Upload Trivy scan results
              uses: github/codeql-action/upload-sarif@v4
              if: ${{ always() && (steps.check-trivy.outputs.exists == 'true') }}
              with:
                  sarif_file: trivy-results.sarif