golang.yaml

# Copyright 2024 Zaphiro Technologies
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: Golang Lint & Test

concurrency:
  group: ${{github.repository}}-${{ github.ref_name }}-go
  cancel-in-progress: true

# Permissions needed
# permissions:
#   # Give the default GITHUB_TOKEN write permission to commit and push the
#   # updated CHANGELOG back to the repository.
#   # https://github.blog/changelog/2023-02-02-github-actions-updating-the-default-github_token-permissions-to-read-only/
#   contents: write

on:
  workflow_call:
    inputs:
      alert-threshold-benchmark:
        required: false
        default: 150%
        type: string
        description: Percent that will trigger benchmark alert
      skip-benchmark:
        required: false
        default: false
        type: boolean
        description: True to skip benchmark exec
      code-scan:
          required: false
          default: true
          type: boolean
          description: False to skip code-scan exec
      vulterability-scan:
        required: false
        default: true
        type: boolean
        description: False to skip vulterability-scan exec
      vulterability-scan-skip-dirs:
        required: false
        default: 'vendor,.github'
        type: string
        description: Comma separated list of directories where vulterability check is skipped
      
jobs:
  changes:
    runs-on: ubuntu-latest
    outputs:
      files_changed: ${{ steps.filter.outputs.go == 'true' || steps.filter.outputs.scripts == 'true' }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 2 # To retrieve the preceding commit.
      - uses: dorny/paths-filter@v3
        id: filter
        with:
          list-files: shell
          filters: |
            scripts:
              - '.golangci.yaml'
              - 'Makefile'
              - '.github/workflows/golang.*'
            go:
              - '**/*.go'
              - 'go.mod'
              - 'go.sum'
  lint:
    needs: changes
    runs-on: ubuntu-latest
    permissions:
      contents: write
    if: ${{ needs.changes.outputs.files_changed == 'true' && github.event.pull_request }}
    env:
      GOPRIVATE: github.com/zaphiro-technologies/*
      GH_ACCESS_TOKEN: ${{ secrets.REPO_PRIVATE_READ_PAT }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{github.event.pull_request.head.ref}} # Can't commit on detached PR merge commit, so this checkouts the branch
          token: ${{ secrets.REPO_PAT }}
      - run: git config --global url.https://$GH_ACCESS_TOKEN@github.com/.insteadOf https://github.com/
      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
      - name: Golines
        run: |
          go install github.com/segmentio/golines@latest
          golines . -w
      - name: golangci-lint
        uses: golangci/golangci-lint-action@v6
        with:
          args: --fix
          version: latest
      - name: Commit golines & golangci-lint changes
        run: |
          git config --global user.name 'Bot'
          git config --global user.email 'bot@zaphiro.ch'
          git commit -am "Automated lint fixes [dependabot skip]" || echo "No changes to commit"
          git push
  test:
    needs: changes
    runs-on: ubuntu-latest
    env:
      GOPRIVATE: github.com/zaphiro-technologies/*
      GH_ACCESS_TOKEN: ${{ secrets.REPO_PRIVATE_READ_PAT }}
    if: ${{ needs.changes.outputs.files_changed == 'true' }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
      - run: git config --global url.https://$GH_ACCESS_TOKEN@github.com/.insteadOf https://github.com/
      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
      - name: Install gcov2lcov
        run: |
          go install github.com/jandelgado/gcov2lcov@latest
      # We Login in GHCR to retrieve owned private images used in docker-compose
      # This requires to set in the package settings read permission for the
      # repository where the golang ci is running
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Test
        run: |
          make ci-test
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        if: ${{ inputs.code-scan }}
        # we log in the registry to code check also images
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: SonarCloud Code Scan
        if: ${{ inputs.code-scan }}
        uses: SonarSource/sonarcloud-github-action@master
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
      - name: Download code coverage report from base branch
        uses: dawidd6/action-download-artifact@v6
        if: github.actor != 'dependabot[bot]'
        with:
          name: cov-result
          github_token: ${{ secrets.REPO_PRIVATE_READ_PAT }}
          branch: ${{github.base_ref}}
          if_no_artifact_found: warn
      - name: Generate Code Coverage report
        id: code-coverage
        uses: barecheck/code-coverage-action@v1
        if: github.actor != 'dependabot[bot]'
        with:
          barecheck-github-app-token: ${{ secrets.BARECHECK_GITHUB_APP_TOKEN }}
          lcov-file: "./coverage/lcov.info"
          base-lcov-file: ${{ hashFiles('./lcov.info') != ''  && './lcov.info' || null }}
          minimum-ratio: 70
          send-summary-comment: true
          show-annotations: ""
      - name: Upload code coverage for ref branch
        if: ${{ ! github.event.pull_request }}
        uses: actions/upload-artifact@v4
        with:
          name: cov-result
          path: ./coverage/lcov.info
          retention-days: 400
      
  benchmark:
    needs: changes
    runs-on: ubuntu-latest
    if: ${{ needs.changes.outputs.files_changed == 'true' && ! inputs.skip-benchmark}}
    env:
      GOPRIVATE: github.com/zaphiro-technologies/*
      GH_ACCESS_TOKEN: ${{ secrets.REPO_PRIVATE_READ_PAT }}
    steps:
      - uses: actions/checkout@v4
      - run: git config --global url.https://$GH_ACCESS_TOKEN@github.com/.insteadOf https://github.com/
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
      # We Login in GHCR to retrieve owned private images used in docker-compose
      # This requires to set in the package settings read permission for the
      # repository where the golang ci is running
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Run benchmark
        shell: bash
        run: make ci-bench | tee output.txt
      # Download previous benchmark result from cache (if exists)
      - name: Download benchmark report from base branch
        uses: dawidd6/action-download-artifact@v6
        with:
          name: benchmark-result
          github_token: ${{ secrets.REPO_PRIVATE_READ_PAT }}
          branch: ${{ github.base_ref || github.ref_name }}
          if_no_artifact_found: warn
      # Run `github-action-benchmark` action
      - name: Store benchmark result
        uses: benchmark-action/github-action-benchmark@v1
        with:
          # What benchmark tool the output.txt came from
          tool: "go"
          # Where the output from the benchmark tool is stored
          output-file-path: output.txt
          # Where the previous data file is stored
          external-data-json-path: benchmark-data.json
          # Workflow will fail when an alert happens
          fail-on-alert: true
          # Enable alert commit comment
          comment-on-alert: true
          github-token: ${{ secrets.GITHUB_TOKEN }}
          alert-threshold: ${{ inputs.alert-threshold-benchmark }}
          summary-always: true
      - name: Upload code coverage for ref branch
        if: ${{ ! github.event.pull_request }}
        uses: actions/upload-artifact@v4
        with:
          name: benchmark-result
          path: benchmark-data.json
          retention-days: 400
  vulnerability:
    needs: changes
    if: ${{ inputs.vulterability-scan}}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        ## To avoid the trivy-db becoming outdated, we save the cache for one day
      - name: Get data
        id: date
        run: echo "date=$(date +%Y-%m-%d)" >> $GITHUB_OUTPUT
      - name: Restore trivy cache
        uses: actions/cache@v4
        with:
          path: cache/db
          key: trivy-cache-${{ steps.date.outputs.date }}
          restore-keys:
            trivy-cache-
      - name: Run Trivy vulnerability scanner (for summary)
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: fs
          scan-ref: .
          skip-dirs: ${{ inputs.vulterability-scan-skip-dirs }}
          scanners: "vuln,secret,misconfig"
          hide-progress: true
          output: trivy.txt
          cache-dir: "./cache"
      - name: Publish Trivy Output to Summary
        run: |
          if [[ -s trivy.txt ]]; then
            {
              echo "### Trivy Security Output"
              echo ""
              echo '```text'
              cat trivy.txt
              echo '```'
            } >> $GITHUB_STEP_SUMMARY
          fi
      # this comes as last or scan results won't be uploaded
      - name: Run Trivy vulnerability scanner (security treshold)
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: fs
          scan-ref: .
          skip-dirs: ${{ inputs.vulterability-scan-skip-dirs }}
          scanners: "vuln,secret,misconfig"
          exit-code: '1'
          severity: MEDIUM,HIGH,CRITICAL
          cache-dir: "./cache"
      ## Trivy-db uses `0600` permissions.
      ## But `action/cache` use `runner` user by default
      ## So we need to change the permissions before caching the database.
      - name: change permissions for trivy.db
        run: sudo chmod 0644 ./cache/db/trivy.db