ci.yaml

name: ci
on:
  push:
    branches:
      - "*"
      - main
  pull_request:

permissions:
  contents: write
  security-events: write
  # Optional: allow read access to pull request. Use with `only-new-issues` option.
  pull-requests: read

jobs:
  golangci:
    name: lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
      - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5
        with:
          go-version: "1.23"
          cache: false
      - name: Run tests
        run: |
          go mod tidy
          go test ./... -coverprofile=coverage.out -coverpkg=./... -covermode=atomic
      - name: golangci-lint
        uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 # v6
        with:
          version: v1.60
          args: -v --config=.ci.yml
          skip-pkg-cache: true
          skip-build-cache: true

      - name: Static check
        uses: dominikh/staticcheck-action@fe1dd0c3658873b46f8c9bb3291096a617310ca6 # v1.3.1
        with:
          version: "2024.1.1"
          install-go: false
          cache-key: "1.23"
      - name: Run Trivy vulnerability scanner in repo mode
        uses: aquasecurity/trivy-action@915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2 # 0.28.0
        with:
          scan-type: "fs"
          ignore-unfixed: true
          format: sarif
          output: "trivy-results.sarif"
          severity: "CRITICAL,HIGH"
        env:
          # Use AWS' ECR mirror for the trivy-db image, as GitHub's Container
          # Registry is returning a TOOMANYREQUESTS error.
          # Ref: https://github.com/aquasecurity/trivy-action/issues/389
          TRIVY_DB_REPOSITORY: "public.ecr.aws/aquasecurity/trivy-db:2"
      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3
        with:
          sarif_file: "trivy-results.sarif"