ci.yaml

---
name: ci

on:
  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:
  push:
    branches:
      - main
    # Publish `v1.2.3` tags as releases.
    tags:
      - v*
  # Run tests for all PRs
  pull_request:

env:
  VAULT_ADDR: https://vault.eng.aserto.com/
  PRE_RELEASE: ${{ github.ref == 'refs/heads/main' && 'main' || '' }}
  GO_VERSION: "1.23"
  GO_RELEASER_VERSION: "v2.3.2"
  GO_LANGCI_LINT_VERSION: "v1.61.0"
  GO_TESTSUM_VERSION: "1.11.0"

jobs:
  test:
    runs-on: ubuntu-latest

    strategy:
      matrix:
        package:
          - "./sdk"
          - "./cli"
          - "./plugins/auth0"
          - "./plugins/azuread"
          - "./plugins/azureadb2c"
          - "./plugins/cognito"
          - "./plugins/fusionauth"
          - "./plugins/google"
          - "./plugins/ldap"
          - "./plugins/okta"
          - "./plugins/openapi"

    steps:
      -
        name: Read Configuration
        uses: hashicorp/vault-action@v3
        id: vault
        with:
          url: ${{ env.VAULT_ADDR }}
          token: ${{ secrets.VAULT_TOKEN }}
          secrets: |
            kv/data/github  "SSH_PRIVATE_KEY"     | SSH_PRIVATE_KEY;
      -
        uses: actions/checkout@v4
      -
        name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
      -
        name: Lint package ${{ matrix.package }}
        uses: golangci/golangci-lint-action@v6
        with:
          version: ${{ env.GO_LANGCI_LINT_VERSION }}
          install-mode: binary
          working-directory: ${{ matrix.package}}
          args: --config="${{ github.workspace }}/.golangci.yaml"
      -
        name: Test Setup
        uses: gertd/action-gotestsum@v3.0.0
        with:
          gotestsum_version: ${{ env.GO_TESTSUM_VERSION }}
      - name: Test package ${{ matrix.package }}
        run: |
          gotestsum --format short-verbose -- -count=1 -v ${{ matrix.package }}/...

  release:
    needs: test
    runs-on: ubuntu-latest
    # Only release when ref is a tag
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    steps:
      -
        name: Read Configuration
        uses: hashicorp/vault-action@v3
        id: vault
        with:
          url: ${{ env.VAULT_ADDR }}
          token: ${{ secrets.VAULT_TOKEN }}
          secrets: |
            kv/data/github  "SSH_PRIVATE_KEY"                         | SSH_PRIVATE_KEY;
            kv/data/github  "USERNAME"                                | DOCKER_USERNAME;
            kv/data/github  "DOCKER_PUSH_TOKEN"                       | DOCKER_PASSWORD;
            kv/data/github  "READ_WRITE_TOKEN"                        | READ_WRITE_TOKEN;
            kv/data/github  "ASERTO_TAP"                              | ASERTO_TAP;
      -
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      -
        name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
      -
        name: Setup QEMU
        uses: docker/setup-qemu-action@v3
      -
        name: Login to GitHub Packages Docker Registry
        uses: docker/login-action@v3
        with:
          registry: https://ghcr.io
          username: ${{ env.DOCKER_USERNAME }}
          password: ${{ env.DOCKER_PASSWORD }}
      -
        name: Docker SSH Setup
        run: |
          mkdir -p $HOME/.ssh
          umask 0077 && echo -e "${SSH_PRIVATE_KEY}" > $HOME/.ssh/id_rsa
          ssh-keyscan github.com >> $HOME/.ssh/known_hosts
          git config --global url."git@github.com:".insteadOf https://github.com/
          git config --global user.email "github-bot@aserto.com"
          git config --global user.name "Aserto Bot"
          eval `ssh-agent`
          ssh-add $HOME/.ssh/id_rsa
      -
        name: Release
        uses: goreleaser/goreleaser-action@v5
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          HOMEBREW_TAP: ${{ secrets.GITHUB_TOKEN }}
          GOOGLE_APPLICATION_CREDENTIALS: /tmp/gs.json
        with:
          distribution: goreleaser
          version: ${{ env.GO_RELEASER_VERSION }}
          args: release --clean