probo/.github/workflows/make.yaml

name: "make"
on:
  push:
    branches:
      - "main"
  pull_request:
    branches:
      - "main"

jobs:
  release-snapshot:
    name: "release-snapshot"
    runs-on: "ubuntu-24.04"
    permissions:
      contents: "read"
      packages: "write"
      id-token: "write"
      security-events: "write"
    steps:
      - uses: "actions/checkout@v4"
        with:
          fetch-depth: 0
          submodules: recursive
      - uses: "actions/setup-go@v5"
        with:
          go-version: "1.25.5"
      - uses: "actions/setup-node@v4"
        with:
          node-version-file: ".nvmrc"
      - run: "npm ci"
      - uses: "docker/setup-qemu-action@v3"
      - uses: "docker/setup-buildx-action@v3"
      - uses: "sigstore/cosign-installer@v3"
      - uses: "anchore/sbom-action/download-syft@da167eac915b4e86f08b264dbdbc867b61be6f0c" # v0.20.5
      - uses: "goreleaser/goreleaser-action@v6"
        with:
          distribution: "goreleaser"
          version: "~> v2"
          args: "release --clean --snapshot"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Scan Docker image with Trivy
        if: github.ref == 'refs/heads/main'
        uses: "aquasecurity/trivy-action@0.28.0"
        with:
          image-ref: "ghcr.io/getprobo/probo:latest-amd64"
          format: "sarif"
          output: "trivy-results.sarif"
          exit-code: 0
          ignore-unfixed: true
          vuln-type: "os,library"
          severity: "CRITICAL,HIGH"
      - name: Scan Docker image with Trivy
        if: github.ref != 'refs/heads/main'
        uses: "aquasecurity/trivy-action@0.28.0"
        with:
          image-ref: "ghcr.io/getprobo/probo:latest-amd64"
          format: "table"
          exit-code: 1
          ignore-unfixed: true
          vuln-type: "os,library"
          severity: "CRITICAL,HIGH"
      - name: Upload Trivy scan results to GitHub Security tab
        if: github.ref == 'refs/heads/main'
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: "trivy-results.sarif"
      - uses: anchore/sbom-action@da167eac915b4e86f08b264dbdbc867b61be6f0c #v0.20.5
        with:
          path: ./
          format: cyclonedx-json
          output-file: sbom.json
      - uses: anchore/scan-action@1638637db639e0ade3258b51db49a9a137574c3e #v6.5.1
        with:
          path: ./
          fail-build: true
          severity-cutoff: critical
          output-format: table

  test:
    name: "test"
    runs-on: "ubuntu-22.04"
    permissions:
      contents: "read"
    steps:
      - uses: "actions/checkout@v4"
        with:
          submodules: recursive
      - uses: "actions/setup-go@v5"
        with:
          go-version: "1.25.5"
      - uses: "actions/setup-node@v4"
        with:
          node-version-file: ".nvmrc"
      - run: "npm ci"
      - run: "make build"
      - run: "make test"
      - run: "make coverage-report"
      - uses: "actions/upload-artifact@v4"
        with:
          name: "coverage-reports"
          path: |
            coverage.out
            coverage.html
          retention-days: 30
      - run: "make lint"
      - uses: "aquasecurity/trivy-action@0.68.0"
        with:
          scan-type: "fs"
          scanners: "license"
          severity: "UNKNOWN,HIGH,CRITICAL"
          exit-code: 1
          trivyignores: ".trivyignore.yaml"
          trivy-config: "trivy.yaml"

  test-e2e:
    name: "test-e2e"
    runs-on: "ubuntu-22.04"
    permissions:
      contents: "read"
    steps:
      - uses: "actions/checkout@v4"
        with:
          submodules: recursive
      - uses: "actions/setup-go@v5"
        with:
          go-version: "1.25.5"
      - uses: "actions/setup-node@v4"
        with:
          node-version-file: ".nvmrc"
      - run: "sudo apt-get install -y mkcert"
      - run: "sudo mkcert -install"
      - uses: "docker/setup-qemu-action@v3"
      - uses: "docker/setup-buildx-action@v3"
      - uses: "docker/setup-compose-action@v1"
      - run: "npm ci"
      - run: "make stack-up"
      - run: "make stack-ps"
      - name: "Inject root CA into e2e config"
        run: |
          # Use Python to properly inject the root CA PEM content into YAML
          python3 << 'EOF'
          import yaml

          with open('compose/pebble/certs/rootCA.pem', 'r') as f:
              root_ca = f.read()

          with open('e2e/console/testdata/config.yaml', 'r') as f:
              config = yaml.safe_load(f)

          config['probod']['custom-domains']['acme']['root-ca'] = root_ca

          with open('e2e/console/testdata/config.yaml', 'w') as f:
              yaml.dump(config, f, default_flow_style=False, allow_unicode=True)
          EOF
      - run: "make test-e2e"