pull-request.yaml

name: Pull request



on:
  pull_request:
    branches:
    - master
    types:
    - ready_for_review



env:
  AWS_S3_REGION: ${{ secrets.AWS_S3_REGION }}
  SBOM_FILENAME: package-sbom



permissions:
  id-token: write
  contents: read
  packages: read



jobs:
  validate:
    name: Validate
    runs-on: ubuntu-22.04

    steps:
    - uses: actions/checkout@v4

    - name: Setup Go
      uses: actions/setup-go@v5
      with:
        go-version-file: 'go.mod'

    - name: Cache Go modules
      uses: actions/cache@v4
      with:
        path: |
          ~/.cache/go-build
          ~/go/pkg/mod
        key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
        restore-keys: |
          ${{ runner.os }}-go-

    - name: Run build
      run: make build

    - name: Run vet
      run: make vet

    - name: Run tests
      run: make test


  static-analysis:
    name: Static Analysis
    runs-on: ubuntu-22.04

    steps:
    - uses: actions/checkout@v4

    - name: Create SBOM
      uses: anchore/sbom-action@v0
      with:
        upload-artifact-retention: 1
        format: spdx-json
        output-file: ${{ env.SBOM_FILENAME }}.spdx.json

    - name: Create SBOM
      uses: anchore/sbom-action@v0
      with:
        upload-artifact-retention: 1
        format: cyclonedx-json
        output-file: ${{ env.SBOM_FILENAME }}.cyclonedx.json

    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ secrets.AWS_S3_SBOMS_ROLE_ARN }}
        aws-region: ${{ env.AWS_S3_REGION }}

    - name: Copy SBOM to S3
      run: |
        aws s3 cp ${{ env.SBOM_FILENAME }}.cyclonedx.json s3://repos-sboms/${{ github.event.repository.name }}/${{ env.SBOM_FILENAME }}.cyclonedx.json