10-linters-tests.yaml

# This workflow run linters and tests.
# It is supposed to be run on each push to main branch, as well as for each push in pull request.

name: Linters

on:
  pull_request:
    branches: [ '*' ]

env:
  GO_VERSION: "1.21"
  IMAGE: linode/linode-cosi-driver

permissions:
  contents: read

jobs:
  commitlint:
    name: Lint commit messages
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: wagoid/commitlint-github-action@v5

  golangci-lint:
    name: Run golangci-lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v4
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: false
      - uses: golangci/golangci-lint-action@v3
        with:
          version: latest
          skip-cache: true

  shell-linter:
    name: Run Shellcheck, Checkmake
    runs-on: ubuntu-latest
    steps:
      - name: Checkout the code
        uses: actions/checkout@v4
      - name: Run ShellCheck
        uses: ludeeus/action-shellcheck@master
      - uses: actions/setup-go@v4
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: false
      - name: Install Checkmake
        run: go install github.com/mrtazz/checkmake/cmd/checkmake@latest
      - name: Run Checkmake
        run: checkmake Makefile
      - name: Run Checkmake on tests
        run: checkmake test/Makefile

  tests:
    name: Run unit tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v4
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: false
      - run: |
          make test

  docker:
    name: Build dev image and run scans
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Build image
        uses: docker/build-push-action@v5
        with:
          push: false
          load: true
          tags: ${{ env.IMAGE }}:${{ github.sha }}
          target: runtime
      - name: Scan image using Grype
        uses: anchore/scan-action@v3
        with:
          image: ${{ env.IMAGE }}:${{ github.sha }}
          output-format: table
      - name: Scan image using Trivy
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ env.IMAGE }}:${{ github.sha }}
          format: table
          exit-code: '1'
          severity: 'CRITICAL,HIGH,MEDIUM'