pull-request.yaml

name: Pull request



on:
  push:
    branches:
    - renovate/**
  pull_request:
    branches:
    - master



env:
  AWS_S3_REGION: ${{ secrets.AWS_S3_REGION }}
  SBOM_FILENAME: package-sbom
  NOTION_DATABASE_ID: ${{ secrets.NOTION_REPOS_DATABASE_ID }}



permissions:
  id-token: write
  contents: read
  packages: read



jobs:
  validate:
    name: Validate
    runs-on: ubuntu-22.04

    steps:
    - uses: actions/checkout@v4

    - name: Setup Go
      uses: actions/setup-go@v5
      with:
        go-version-file: 'go.mod'

    - name: Cache Go modules
      uses: actions/cache@v4
      with:
        path: |
          ~/.cache/go-build
          ~/go/pkg/mod
        key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
        restore-keys: |
          ${{ runner.os }}-go-

    - name: Run build
      run: make build

    - name: Run vet
      run: make vet

    - name: Run tests
      run: make test


  static-analysis:
    name: Static Analysis
    runs-on: ubuntu-22.04

    steps:
    - uses: actions/checkout@v4

    - name: Create SBOM
      uses: anchore/sbom-action@v0
      with:
        upload-artifact-retention: 1
        format: spdx-json
        output-file: ${{ env.SBOM_FILENAME }}.spdx.json

    - name: Scan SBOM
      id: scan_sbom
      uses: anchore/scan-action@v3
      with:
        sbom: ${{ env.SBOM_FILENAME }}.spdx.json
        output-format: sarif
        fail-build: false

    - name: Determine number of noticiable vulnerabilities
      id: count_vulnerabilities
      run: |
        echo "value=$(grep -cE "(medium|high|critical) vulnerability" ${{ steps.scan_sbom.outputs.sarif }})" >> $GITHUB_OUTPUT

    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ secrets.AWS_S3_SBOMS_ROLE_ARN }}
        aws-region: ${{ env.AWS_S3_REGION }}

    - name: Copy SBOM to S3
      run: |
        aws s3 cp ${{ env.SBOM_FILENAME }}.spdx.json s3://repos-sboms/${{ github.event.repository.name }}/${{ env.SBOM_FILENAME }}.spdx.json
        aws s3 cp ${{ steps.scan_sbom.outputs.sarif }} s3://repos-sboms/${{ github.event.repository.name }}/${{ env.SBOM_FILENAME }}-scan.sarif

    - name: Update Notion Page
      uses: ydataai/update-notion-page@v1
      env:
        STATUS_ICON: ${{ steps.count_vulnerabilities.outputs.value == '0' && '"✅"' || '"⚠️"' }}
        STATUS_URL: ${{ steps.count_vulnerabilities.outputs.value == '0' && 'null' || format('{{"url":"https://s3.console.aws.amazon.com/s3/buckets/repos-sboms?region={0}&prefix={1}/{2}-scan.sarif"}}', env.AWS_S3_REGION, github.event.repository.name, env.SBOM_FILENAME) }}
      with:
        notion_secret: ${{ secrets.NOTION_SECRET }}
        notion_database_id: ${{ env.NOTION_DATABASE_ID }}
        notion_database_query_filter: '{  "property": "Repo",  "title": { "equals": "${{ github.event.repository.name }}" }  }'
        notion_page_update_properties: '{  "Scan": { "rich_text": [ { "text": { "content": ${{ env.STATUS_ICON }}, "link": ${{ env.STATUS_URL }} } } ] }, "SBOMS": { "url": "https://s3.console.aws.amazon.com/s3/buckets/repos-sboms?region=${{ env.AWS_S3_REGION }}&prefix=${{ github.event.repository.name }}/" }  }'