253 lines
7.6 KiB
YAML
253 lines
7.6 KiB
YAML
name: "make"
|
|
on:
|
|
push:
|
|
branches:
|
|
- "main"
|
|
pull_request:
|
|
branches:
|
|
- "main"
|
|
|
|
jobs:
|
|
release-snapshot:
|
|
name: "release-snapshot"
|
|
runs-on: "ubuntu-24.04"
|
|
permissions:
|
|
contents: "read"
|
|
packages: "write"
|
|
id-token: "write"
|
|
security-events: "write"
|
|
steps:
|
|
- uses: "actions/checkout@v6"
|
|
with:
|
|
fetch-depth: 0
|
|
submodules: recursive
|
|
- uses: "actions/setup-go@v6"
|
|
with:
|
|
go-version: "1.25.6"
|
|
cache: true
|
|
- uses: "actions/setup-node@v6"
|
|
with:
|
|
node-version-file: ".nvmrc"
|
|
cache: "npm"
|
|
- run: "npm i -g npm@11.8.0"
|
|
- run: "npm ci"
|
|
- uses: "docker/setup-qemu-action@v3"
|
|
- uses: "docker/setup-buildx-action@v3"
|
|
- uses: "sigstore/cosign-installer@v3"
|
|
- name: Cache Trivy database
|
|
uses: "actions/cache@v5"
|
|
with:
|
|
path: ~/.cache/trivy
|
|
key: trivy-db-${{ runner.os }}-${{ github.run_id }}
|
|
restore-keys: |
|
|
trivy-db-${{ runner.os }}-
|
|
- uses: "anchore/sbom-action/download-syft@deef08a0db64bfad603422135db61477b16cef56" # v0.22.1
|
|
- uses: "goreleaser/goreleaser-action@v6"
|
|
with:
|
|
distribution: "goreleaser"
|
|
version: "~> v2"
|
|
args: "release --clean --snapshot"
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
- name: Scan Docker image with Trivy
|
|
if: github.ref == 'refs/heads/main'
|
|
uses: "aquasecurity/trivy-action@0.33.1"
|
|
with:
|
|
image-ref: "ghcr.io/getprobo/probo:latest-amd64"
|
|
format: "sarif"
|
|
output: "trivy-results.sarif"
|
|
exit-code: 0
|
|
ignore-unfixed: true
|
|
vuln-type: "os,library"
|
|
severity: "CRITICAL,HIGH"
|
|
cache-dir: ~/.cache/trivy
|
|
- name: Scan Docker image with Trivy
|
|
if: github.ref != 'refs/heads/main'
|
|
uses: "aquasecurity/trivy-action@0.33.1"
|
|
with:
|
|
image-ref: "ghcr.io/getprobo/probo:latest-amd64"
|
|
format: "table"
|
|
exit-code: 1
|
|
ignore-unfixed: true
|
|
vuln-type: "os,library"
|
|
severity: "CRITICAL,HIGH"
|
|
cache-dir: ~/.cache/trivy
|
|
- name: Upload Trivy scan results to GitHub Security tab
|
|
if: github.ref == 'refs/heads/main'
|
|
uses: github/codeql-action/upload-sarif@v4
|
|
with:
|
|
sarif_file: "trivy-results.sarif"
|
|
- uses: anchore/sbom-action@deef08a0db64bfad603422135db61477b16cef56 #v0.22.1
|
|
with:
|
|
path: ./
|
|
format: cyclonedx-json
|
|
output-file: sbom.json
|
|
- name: Cache grype binary
|
|
uses: actions/cache@v5
|
|
id: grype-cache
|
|
with:
|
|
path: ~/.local/bin/grype
|
|
key: grype-${{ runner.os }}-v0.97.1
|
|
- name: Install grype with retry
|
|
if: steps.grype-cache.outputs.cache-hit != 'true'
|
|
id: grype-install
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
GRYPE_VERSION="v0.97.1"
|
|
GRYPE_DIR="${HOME}/.local/bin"
|
|
mkdir -p "${GRYPE_DIR}"
|
|
|
|
# Download with retry logic
|
|
MAX_RETRIES=3
|
|
RETRY_DELAY=10
|
|
|
|
for i in $(seq 1 $MAX_RETRIES); do
|
|
echo "Attempt $i of $MAX_RETRIES: Installing grype ${GRYPE_VERSION}..."
|
|
if curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b "${GRYPE_DIR}" "${GRYPE_VERSION}"; then
|
|
echo "Grype installed successfully"
|
|
exit 0
|
|
fi
|
|
|
|
if [ $i -lt $MAX_RETRIES ]; then
|
|
echo "Installation failed, retrying in ${RETRY_DELAY} seconds..."
|
|
sleep $RETRY_DELAY
|
|
RETRY_DELAY=$((RETRY_DELAY * 2))
|
|
fi
|
|
done
|
|
|
|
echo "Failed to install grype after $MAX_RETRIES attempts"
|
|
exit 1
|
|
- name: Add grype to PATH
|
|
run: echo "${HOME}/.local/bin" >> "$GITHUB_PATH"
|
|
- uses: anchore/scan-action@8d2fce09422cd6037e577f4130e9b925e9a37175 #v7.3.1
|
|
with:
|
|
path: ./
|
|
fail-build: true
|
|
severity-cutoff: critical
|
|
output-format: table
|
|
|
|
lint:
|
|
name: "lint"
|
|
runs-on: "ubuntu-22.04"
|
|
permissions:
|
|
contents: "read"
|
|
steps:
|
|
- uses: "actions/checkout@v6"
|
|
with:
|
|
submodules: recursive
|
|
- uses: "actions/setup-go@v6"
|
|
with:
|
|
go-version: "1.25.6"
|
|
cache: true
|
|
- uses: "actions/setup-node@v6"
|
|
with:
|
|
node-version-file: ".nvmrc"
|
|
cache: "npm"
|
|
- run: "npm i -g npm@11.8.0"
|
|
- run: "npm ci"
|
|
- run: "make build"
|
|
- run: "make lint"
|
|
|
|
test:
|
|
name: "test"
|
|
runs-on: "ubuntu-22.04"
|
|
permissions:
|
|
contents: "read"
|
|
steps:
|
|
- uses: "actions/checkout@v6"
|
|
with:
|
|
submodules: recursive
|
|
- uses: "actions/setup-go@v6"
|
|
with:
|
|
go-version: "1.25.6"
|
|
cache: true
|
|
- uses: "actions/setup-node@v6"
|
|
with:
|
|
node-version-file: ".nvmrc"
|
|
cache: "npm"
|
|
- run: "npm i -g npm@11.8.0"
|
|
- run: "npm ci"
|
|
- run: "make build"
|
|
- run: "make test"
|
|
env:
|
|
GOTESTSUM_JUNITFILE: "junit.xml"
|
|
- name: "Upload test results"
|
|
uses: "actions/upload-artifact@v6"
|
|
if: "always()"
|
|
with:
|
|
name: "junit-results"
|
|
path: "junit.xml"
|
|
retention-days: 30
|
|
- run: "make coverage-report"
|
|
- uses: "actions/upload-artifact@v6"
|
|
with:
|
|
name: "coverage-reports"
|
|
path: |
|
|
coverage.out
|
|
coverage.html
|
|
retention-days: 30
|
|
# Trivy ignore does not work for license scanning in Github action
|
|
# - uses: "aquasecurity/trivy-action@0.33.1"
|
|
# with:
|
|
# scan-type: "fs"
|
|
# scanners: "license"
|
|
# severity: "UNKNOWN,HIGH,CRITICAL"
|
|
# exit-code: 1
|
|
# trivyignores: ".trivyignore.yaml"
|
|
# trivy-config: "trivy.yaml"
|
|
|
|
test-e2e:
|
|
name: "test-e2e"
|
|
runs-on: "ubuntu-22.04"
|
|
permissions:
|
|
contents: "read"
|
|
steps:
|
|
- uses: "actions/checkout@v6"
|
|
with:
|
|
submodules: recursive
|
|
- uses: "actions/setup-go@v6"
|
|
with:
|
|
go-version: "1.25.6"
|
|
cache: true
|
|
- uses: "actions/setup-node@v6"
|
|
with:
|
|
node-version-file: ".nvmrc"
|
|
cache: "npm"
|
|
- run: "npm i -g npm@11.8.0"
|
|
- run: "sudo apt-get install -y mkcert"
|
|
- run: "sudo mkcert -install 2>&1 | grep -v 'no Firefox and/or Chrome/Chromium security databases found' || true"
|
|
- uses: "docker/setup-qemu-action@v3"
|
|
- uses: "docker/setup-buildx-action@v3"
|
|
- uses: "docker/setup-compose-action@v1"
|
|
- run: "npm ci"
|
|
- run: "make stack-up"
|
|
- run: "make stack-ps"
|
|
- name: "Inject root CA into e2e config"
|
|
run: |
|
|
# Use Python to properly inject the root CA PEM content into YAML
|
|
python3 << 'EOF'
|
|
import yaml
|
|
|
|
with open('compose/pebble/certs/rootCA.pem', 'r') as f:
|
|
root_ca = f.read()
|
|
|
|
with open('e2e/console/testdata/config.yaml', 'r') as f:
|
|
config = yaml.safe_load(f)
|
|
|
|
config['probod']['custom-domains']['acme']['root-ca'] = root_ca
|
|
|
|
with open('e2e/console/testdata/config.yaml', 'w') as f:
|
|
yaml.dump(config, f, default_flow_style=False, allow_unicode=True)
|
|
EOF
|
|
- run: "make test-e2e"
|
|
env:
|
|
GOTESTSUM_JUNITFILE: "junit-e2e.xml"
|
|
- name: "Upload test results"
|
|
uses: "actions/upload-artifact@v6"
|
|
if: "always()"
|
|
with:
|
|
name: "junit-e2e-results"
|
|
path: "junit-e2e.xml"
|
|
retention-days: 30
|