Ad syft #42
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Service CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| env: | |
| GO_VERSION_FILE: go.mod | |
| jobs: | |
| go_module: | |
| name: Lint & Build Go Module | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v5.0.0 | |
| - name: Set up Go | |
| uses: actions/setup-go@v6.0.0 | |
| with: | |
| go-version-file: ${{ env.GO_VERSION_FILE }} | |
| cache: true | |
| - name: Download modules | |
| working-directory: . | |
| run: go mod download | |
| - name: Run golangci-lint | |
| uses: ./.github/actions/run-golangci-lint | |
| - name: Build Go module | |
| working-directory: . | |
| run: go build ./... | |
| - name: Run unit tests with coverage | |
| working-directory: . | |
| run: | | |
| set -euo pipefail | |
| packages=$(go list ./... | grep -v '/examples/') | |
| echo "Running go test on packages:" && echo "$packages" | |
| go test $packages -coverprofile=coverage.out -covermode=atomic | |
| - name: Upload coverage to Codecov | |
| uses: codecov/codecov-action@v5 | |
| with: | |
| files: coverage.out | |
| fail_ci_if_error: false | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| - name: Generate SBOM with Syft | |
| uses: anchore/sbom-action@v0 | |
| with: | |
| format: spdx-json | |
| output-file: sbom.spdx.json | |
| - name: Upload SBOM artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: sbom | |
| path: sbom.spdx.json | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@0.28.0 | |
| with: | |
| scan-type: "fs" | |
| scan-ref: "." | |
| format: "table" | |
| exit-code: "1" | |
| severity: "CRITICAL,HIGH" | |
| scanners: "vuln,secret" |