pull_request.yaml

name: Validate on Pull Request

on:
  workflow_dispatch:
  pull_request:
    types: [ opened, reopened, edited ]

jobs:

  ## Linting is broken: https://github.com/helm/chart-testing/issues/169
  lint-chart:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4.1.1
        with:
          fetch-depth: 0

      - name: Install Helm
        uses: azure/setup-helm@v3

      - uses: actions/setup-python@v4

      - name: Install chart-testing
        uses: helm/chart-testing-action@v2.6.1

      - name: Run lint
        run: ct lint --all --config .github/ct.yaml

  lint-chart-docs:
    runs-on: ubuntu-latest
    needs: lint-chart
    steps:
      - name: Checkout
        uses: actions/checkout@v4.1.1

      - name: Run helm-docs
        run: .github/helm-docs.sh

  kubeconform-chart:
    runs-on: ubuntu-latest
    needs:
      - lint-chart-docs
    strategy:
      matrix:
        k8s:
          # from https://github.com/yannh/kubernetes-json-schema
          - v1.26.9
          - v1.27.8
          - v1.28.4
    steps:
      - name: Checkout
        uses: actions/checkout@v4.1.1
        with:
          fetch-depth: 0

      - name: Run kubeconform
        env:
          KUBERNETES_VERSION: ${{ matrix.k8s }}
        run: .github/kubeconform.sh

  lint-golang:
    name: Lint files
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v3
        with:
          go-version: '1.19.2'
      - name: golangci-lint
        uses: golangci/golangci-lint-action@v3
        with:
          version: latest
          skip-cache: true
          args: --timeout=3m
  test-golang:
    name: Run tests
    runs-on: 'ubuntu-22.04'
    needs: lint-golang
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v3
        with:
          go-version: '1.19.2'
      - run: go test -v -cover ./...

  security-checks:
    runs-on: ubuntu-22.04
    needs: test-golang
    permissions:
      contents: read
      packages: write
      id-token: write
    steps:
      - name: Build Local Container
        uses: eschercloudai/container-security-action@v0.0.4
        if: github.event_name != 'pull_request'
        id: build-and-scan
        with:
          image-repo: ghcr.io
          repo-username: ${{ github.repository_owner }}
          repo-password: ${{ secrets.GITHUB_TOKEN }}
          image-name: dogkat
          image-tag: ${{ github.ref_name }}
          check-severity: CRITICAL
          trivyignore-from-s3: true
          aws-endpoint: "https://nl1.eschercloud.com:6780"
          aws-access-key: ${{secrets.AWS_ACCESS_KEY}}
          aws-secret-key: ${{secrets.AWS_SECRET_KEY}}
          s3-bucket: "trivyignores"
          s3-path: "dogkat"
          fail-build: false
          add-latest-tag: false
          publish-image: false
          cosign-private-key: ${{secrets.COSIGN_KEY}}
          cosign-password: ${{secrets.COSIGN_PASSWORD}}
          cosign-tlog: false
          dockerfile-path: docker