ci.yml

name: compage-ci

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]

jobs:
  build-and-test:
    runs-on: ubuntu-20.04
    permissions:
      packages: write
      id-token: write
      contents: write
      security-events: write
      actions: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: recursive
          token: ${{ secrets.GH_TOKEN }}
      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: '1.22'
          cache-dependency-path: '**/go.sum'
      - name: Build
        run: |
          go build -v ./...
      - name: golangci-lint
        run: |
          go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.57.2
          golangci-lint run
      - name: Install Protoc
        uses: arduino/setup-protoc@v3
        with:
          version: "23.x"
      - name: Test
        run: |
          sudo apt install dos2unix -y
          mkdir -p $HOME/.openapi-generator
          chmod -R 777 $HOME/.openapi-generator
          wget https://repo1.maven.org/maven2/org/openapitools/openapi-generator-cli/6.6.0/openapi-generator-cli-6.6.0.jar -O $HOME/.openapi-generator/openapi-generator-cli.jar
          go install google.golang.org/protobuf/cmd/protoc-gen-go@latest
          go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
          export GOPATH=$HOME/go
          export GOBIN=$GOPATH/bin
          export PATH=$PATH:$GOPATH:$GOBIN:$HOME/ogc
          go run main.go pullTemplates --all
          go test -v ./... -race -coverprofile=coverage.out -coverpkg=./... -covermode=atomic
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v4
        with:
          files: ./coverage.out
          flags: core
          token: ${{secrets.CODECOV_TOKEN}}
      - name: Run Trivy vulnerability scanner in repo mode
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          ignore-unfixed: true
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL'
      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results.sarif'
  publish-docker-image:
    if: gitHub.event_name != 'pull_request'
    needs: build-and-test
    env:
      REGISTRY: ghcr.io
      GH_URL: https://github.com
    runs-on: ubuntu-20.04
    permissions:
      packages: write
      id-token: write
      contents: read
      actions: read
      security-events: write
    steps:
      - name: Checkout GitHub Action
        uses: actions/checkout@v4
        # setup Docker build action
      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v3
      - name: Docker metadata
        id: metadata
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ github.repository }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=raw,value={{sha}},enable=${{ github.ref_type != 'tag' }}
          flavor: |
            latest=true
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GH_TOKEN }}
      - name: Build image and push to GitHub Container Registry
        uses: docker/build-push-action@v5
        with:
          # relative path to the place where source code with Dockerfile is located
          context: .
          # Note: tags have to be all lower-case
          tags: ${{ env.REGISTRY }}/${{ github.repository }}:${{ github.run_id }}
          # ${{ steps.metadata.outputs.tags }}
          labels: ${{ steps.metadata.outputs.labels }}
          # build on feature branches, push only on the main branch
          push: true
#      - uses: goodwithtech/dockle-action@main
#        with:
#          image: ${{ env.REGISTRY }}/${{ github.repository }}:${{ github.run_id }}
#          format: 'list'
#          exit-code: '1'
#          exit-level: 'warn'
#          ignore: 'CIS-DI-0001,DKL-DI-0006'
      - name: Install cosign
        uses: sigstore/cosign-installer@main
      - name: Sign the images
        run: |
          cosign sign -y ${{ env.REGISTRY }}/${{ github.repository }}:${{ github.run_id }}
        env:
          COSIGN_EXPERIMENTAL: 1
      - name: Verify the pushed tags
        run: cosign verify ${{ env.REGISTRY }}/${{ github.repository }}:${{ github.run_id }} --certificate-identity ${{ env.GH_URL }}/${{ github.repository }}/.github/workflows/ci.yml@refs/heads/main --certificate-oidc-issuer https://token.actions.githubusercontent.com
        env:
          COSIGN_EXPERIMENTAL: 1
      - name: Run Trivy in GitHub SBOM mode and submit results to Dependency Graph
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          format: 'github'
          output: 'dependency-results.sbom.json'
          image-ref: '.'
          github-pat: ${{ secrets.GH_TOKEN }}