go-ci.yaml

name: GoLang CI
on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
      - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5
        with:
          go-version-file: './go.mod'
      - name: golangci-lint
        uses: golangci/golangci-lint-action@aaa42aa0628b4ae2578232a66b541047968fac86 # v6
        with:
          args: "--timeout=10m --build-tags='normal periodic minikube'"
  go:
    name: Check sources
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - name: Check out code
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
      - name: Install Go
        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5
        with:
          go-version-file: './go.mod'
      - name: Check go mod status
        run: |
          go mod tidy
          if [[ ! -z $(git status -s) ]]
          then
            echo "Go mod state is not clean:"
            git --no-pager diff
            exit 1
          fi
      - name: Check format
        run: |
          make fmt
          if [[ ! -z $(git status -s) ]]
          then
            echo "not all golang files properly gofmt'ed:"
            git --no-pager diff
            exit 1
          fi
      - name: Check generated
        run: |
          make generate
          if [[ ! -z $(git status -s) ]]
          then
            echo "generated sources are not up to date:"
            git --no-pager diff
            exit 1
          fi
  unit:
    name: Golang Unit tests
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
      - name: Install Go
        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5
        with:
          go-version-file: './go.mod'
      - name: Build
        run: make build
      - name: Test
        run: make test
      - name: Codecov
        uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          verbose: true
  security_scan:
    name: Security scan
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
      - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5
        with:
          go-version-file: './go.mod'
      # https://github.com/securego/gosec/blob/12be14859bc7d4b956b71bef0b443694aa519d8a/README.md#integrating-with-code-scanning
      - name: Run Gosec Security Scanner
        uses: securego/gosec@master
        with:
          # we let the report trigger content trigger a failure using the GitHub Security features.
          args: '-tags normal,periodic -no-fail -fmt sarif -out results.sarif ./...'
      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@e2b3eafc8d227b0241d48be5f425d47c2d750a13 # v3
        with:
          # Path to SARIF file relative to the root of the repository
          sarif_file: results.sarif