oathkeeper/.github/workflows/ci.yml at master · ory/oathkeeper · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
name: CI
on:
  push:
    branches:
      - master
    tags:
      - "*"
  pull_request:

# Cancel in-progress runs in current workflow.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CGO_ENABLED: "0"

jobs:
  validate:
    name: Run tests and lints
    runs-on: ubuntu-latest
    steps:
      - uses: ory/ci/checkout@master
      - uses: actions/setup-go@v6
        with:
          check-latest: true
          go-version-file: go.mod
      - run: go list -json > go.list
      - name: Run nancy
        uses: sonatype-nexus-community/nancy-github-action@v1.0.3
      - name: Run golangci-lint
        if: ${{ github.ref_type != 'tag' }}
        uses: golangci/golangci-lint-action@v9
        env:
          GOGC: 100
        with:
          args: --timeout 10m0s
          version: latest
          only-new-issues: "true"
      - name: Run go tests
        run: |
          go test -coverprofile coverage.out ./... -- -failfast -timeout=20m
      - name: Submit to Codecov
        run: |
          bash <(curl -s https://codecov.io/bash)

  test:
    runs-on: ubuntu-latest
    name: Run tests
    strategy:
      matrix:
        name: ["reload", "e2e", "forwarded-header", "bearer-token"]
    steps:
      - uses: ory/ci/checkout@master
      - uses: actions/setup-go@v6
        with:
          check-latest: true
          go-version-file: go.mod
      - run: |
          ./test/${{ matrix.name }}/run.sh

  docs-cli:
    runs-on: ubuntu-latest
    name: Build CLI docs
    needs:
      - test
    steps:
      - uses: ory/ci/checkout@master
      - uses: ory/ci/docs/cli-next@master
        with:
          token: ${{ secrets.ORY_BOT_PAT }}
          output-dir: docs/oathkeeper/cli
      - uses: actions/setup-go@v6
        with:
          check-latest: true
          go-version-file: go.mod

  release:
    name: Generate release
    runs-on: ubuntu-latest
    if: ${{ github.ref_type == 'tag' }}
    needs:
      - test
      - validate
    steps:
      - uses: ory/ci/releaser@master
        with:
          token: ${{ secrets.ORY_BOT_PAT }}
          goreleaser_key: ${{ secrets.GORELEASER_KEY }}
          cosign_pwd: ${{ secrets.COSIGN_PWD }}
          docker_username: ${{ secrets.DOCKERHUB_USERNAME }}
          docker_password: ${{ secrets.DOCKERHUB_PASSWORD }}

  newsletter-draft:
    name: Draft newsletter
    runs-on: ubuntu-latest
    if: ${{ github.ref_type == 'tag' }}
    needs:
      - release
    steps:
      - uses: ory/ci/newsletter@master
        with:
          mailchimp_list_id: f605a41b53
          mailchmip_segment_id: 6479485
          mailchimp_api_key: ${{ secrets.MAILCHIMP_API_KEY }}
          draft: "true"
          ssh_key: ${{ secrets.ORY_BOT_SSH_KEY }}

  slack-approval-notification:
    name: Pending approval Slack notification
    runs-on: ubuntu-latest
    if: ${{ github.ref_type == 'tag' }}
    needs:
      - newsletter-draft
    steps:
      - uses: ory/ci/newsletter/slack-notify@master
        with:
          slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}

  newsletter-send:
    name: Send newsletter
    runs-on: ubuntu-latest
    needs:
      - newsletter-draft
    if: ${{ github.ref_type == 'tag' }}
    environment: production
    steps:
      - uses: ory/ci/newsletter@master
        with:
          mailchimp_list_id: f605a41b53
          mailchmip_segment_id: 6479485
          mailchimp_api_key: ${{ secrets.MAILCHIMP_API_KEY }}
          draft: "false"
          ssh_key: ${{ secrets.ORY_BOT_SSH_KEY }}