pull_request.yaml

name: Validate on Pull Request

on:
  workflow_dispatch:
  pull_request:
    types: [ opened, reopened, edited ]

jobs:
  lint:
    name: Lint files
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v3
        with:
          go-version: '1.19.2'
      - name: golangci-lint
        uses: golangci/golangci-lint-action@v3
        with:
          version: latest
          skip-cache: true
          args: --timeout=3m
  test:
    name: Run tests
    runs-on: 'ubuntu-22.04'
    needs: lint
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v3
        with:
          go-version: '1.19.2'
      - run: go test -v -cover ./...

  security-checks:
    runs-on: ubuntu-22.04
    needs: test
    permissions:
      contents: read
      packages: write
      id-token: write
    steps:
      - name: Build Local Container
        uses: eschercloudai/container-security-action@v0.0.1
        if: github.event_name != 'pull_request'
        id: build-and-scan
        with:
          image-repo: ghcr.io
          repo-username: ${{ github.repository_owner }}
          repo-password: ${{ secrets.GITHUB_TOKEN }}
          image-name: dogkat
          image-tag: ${{ github.ref_name }}
          check-severity: CRITICAL
          trivyignore-from-s3: true
          aws-endpoint: "https://nl1.eschercloud.com:6780"
          aws-access-key: ${{secrets.AWS_ACCESS_KEY}}
          aws-secret-key: ${{secrets.AWS_SECRET_KEY}}
          s3-bucket: "trivyignores"
          s3-path: "dogkat"
          add-latest-tag: false
          publish-image: false
          cosign-private-key: ${{secrets.COSIGN_KEY}}
          cosign-password: ${{secrets.COSIGN_PASSWORD}}
          cosign-tlog: false
          dockerfile-path: docker