build.yml

name: build

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

env:
  CGO_ENABLED: '0'

concurrency:
  group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
  cancel-in-progress: true

jobs:
  test:
    runs-on: ubuntu-latest

    timeout-minutes: 10

    steps:
      - name: Checkout repository
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
        with:
          fetch-depth: 2

      - name: Set up Go
        uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
        with:
          go-version-file: .go-version

      - name: Test
        run: go test -v ./...

  lint:
    runs-on: ubuntu-latest

    timeout-minutes: 10

    steps:
      - name: Checkout repository
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
        with:
          fetch-depth: 2

      - name: Set up Go
        uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
        with:
          go-version-file: .go-version
          cache: false

      - name: Run golangci-lint
        uses: golangci/golangci-lint-action@639cd343e1d3b897ff35927a75193d57cfcba299 # v3.6.0
        with:
          # renovate: datasource=go depName=github.com/golangci/golangci-lint
          version: v1.53.3

  codeql-analyze:
    runs-on: ubuntu-latest
    permissions:
      security-events: write

    timeout-minutes: 10

    steps:
      - name: Checkout repository
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
        with:
          fetch-depth: 2

      - name: Set up Go
        uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
        with:
          go-version-file: .go-version

      - name: Initialize CodeQL
        uses: github/codeql-action/init@f6e388ebf0efc915c6c5b165b019ee61a6746a38 # v2.20.1
        with:
          languages: go

      - name: Autobuild
        uses: github/codeql-action/autobuild@f6e388ebf0efc915c6c5b165b019ee61a6746a38 # v2.20.1

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@f6e388ebf0efc915c6c5b165b019ee61a6746a38 # v2.20.1

  build:
    runs-on: ubuntu-latest

    timeout-minutes: 30

    steps:
      - name: Checkout repository
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
        with:
          fetch-depth: 2

      - name: Build container image
        run: podman build --tag 'ghcr.io/maxbrunet/prometheus-elasticache-sd:latest' .

  semantic-release:
    needs: [codeql-analyze, build, lint, test]
    runs-on: ubuntu-latest
    container:
      # https://github.com/containers/podman/tree/main/contrib/podmanimage
      image: quay.io/containers/podman:v4.5.1
      options: >-
        --device /dev/fuse:rw
        --privileged
        --security-opt label=disable
        --security-opt seccomp=unconfined
    permissions:
      contents: write
      issues: write
      packages: write
      pull-requests: write

    timeout-minutes: 30

    steps:
      - name: Install dependencies
        run: dnf install --assumeyes --repo fedora git

      # full checkout for semantic-release
      - name: Checkout repository
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
        with:
          fetch-depth: 0
          # Use Deploy key with write access to push changelog to main branch (protected branch)
          ssh-key: ${{ secrets.SEMANTIC_RELEASE_SSH_KEY }}

      # The checkout action is supposed to take of it, but it is not enough :/
      - name: Add repository directory to the git global config as a safe directory
        run: git config --global --add safe.directory "${GITHUB_WORKSPACE}"

      - name: Set up Node.js
        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
        with:
          node-version: lts/*

      - name: Login to GitHub Container Registry
        run: podman login --username "${USERNAME}" --password "${PASSWORD}" "${REGISTRY}"
        if: github.event_name != 'pull_request'
        env:
          USERNAME: ${{ github.actor }}
          PASSWORD: ${{ secrets.GITHUB_TOKEN }}
          REGISTRY: ghcr.io

      - name: Semantic Release
        uses: cycjimmy/semantic-release-action@8e58d20d0f6c8773181f43eb74d6a05e3099571d # v3.4.2
        with:
          # renovate: datasource=npm depName=semantic-release
          semantic_version: 21.0.5
          dry_run: ${{ github.event_name == 'pull_request' }}
          extra_plugins: |
            conventional-changelog-conventionalcommits@6.1.0
            @semantic-release/changelog@6.0.3
            @semantic-release/exec@6.0.3
            @semantic-release/git@10.0.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Post Login to GitHub Container Registry
        run: |
          if podman login --get-login "${REGISTRY}" >/dev/null; then
            podman logout "${REGISTRY}"
          fi
        if: always()
        env:
          REGISTRY: ghcr.io