ci.yml

## (5b) Pin to commits, not tags

name: CI Build and Check

on:
  push:
    branches:
      - master
  pull_request:

env:
  IMAGE: rancher/kube-api-auth

permissions:
  contents: read
  security-events: write # upload Trivy Sarif results

jobs:
  linter:
    runs-on: ubuntu-latest
    steps:
    - name: Get Sources
      uses: actions/checkout@v3

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version-file: 'go.mod'
        cache: false

    - name: Validate the sources
      run: |
        ./scripts/validate
        # Except for linting. That is done through the proper GH action

    - name: Lint sources
      uses: golangci/golangci-lint-action@v4

    - name: Test
      run: ./scripts/test

  build-amd64:
    runs-on: ubuntu-latest
    needs:
      - linter
    steps:
    - name: Get Sources
      uses: actions/checkout@v3

    - name: Determine Tag
      id: get-TAG
      run: |
        export TAG=g$(git describe --always)
        echo "TAG=$TAG"
        echo "TAG=$TAG" >> "$GITHUB_ENV"

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version-file: 'go.mod'
        cache: false

    - name: Build
      run: |
        ./scripts/build
        echo Stage binary for packaging step
        cp -rv ./bin/* ./package/

    - name: Package up into container image
      uses: docker/build-push-action@v5
      with:
        context: package
        push: false
        tags: ${{ env.IMAGE }}:${{ env.TAG }}-amd64
        file: package/Dockerfile

    - name: Scan for security vulnerabilities using Trivy
      uses: aquasecurity/trivy-action@0.18.0
      with:
        image-ref: ${{ env.IMAGE }}:${{ env.TAG }}-amd64
        ignore-unfixed: true
        vuln-type: 'os,library'
        severity: 'CRITICAL,HIGH'
        format: 'sarif'
        output: 'trivy-results.sarif'

    - name: Upload Trivy scan results to GitHub Security tab
      uses: github/codeql-action/upload-sarif@v3
      if: always()
      with:
        sarif_file: 'trivy-results.sarif'

  build-arm64:
    runs-on: ubuntu-latest
    needs:
      - linter
    steps:
    - name: Get Sources
      uses: actions/checkout@v3

    - name: Determine Tag
      id: get-TAG
      run: |
        export TAG=g$(git describe --always)
        echo "TAG=$TAG"
        echo "TAG=$TAG" >> "$GITHUB_ENV"

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version-file: 'go.mod'
        cache: false

    - name: Build
      env:
        GOOS: linux
        GOARCH: arm64
        ARCH: arm64
      run: |
        ./scripts/build
        echo Stage binary for packaging step
        cp -rv ./bin/* ./package/

    - name: Package up into container image
      uses: docker/build-push-action@v5
      with:
        context: package
        push: false
        tags: ${{ env.IMAGE }}:${{ env.TAG }}-arm64
        file: package/Dockerfile