-
Notifications
You must be signed in to change notification settings - Fork 0
131 lines (128 loc) · 4.35 KB
/
user-service-ci.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
name: user-service-ci
on:
push:
branches: [ "main" ]
pull_request:
branches: [ "main" ]
env:
REGISTRY: ghcr.io
GH_URL: https://github.com
jobs:
build-and-test:
runs-on: ubuntu-20.04
permissions:
packages: write
id-token: write
contents: read
actions: read
security-events: write
steps:
- name: Checkout repository
uses: actions/checkout@v3
with:
submodules: recursive
token: ${{ secrets.GH_TOKEN }}
- name: Set up Go
uses: actions/setup-go@v4
with:
go-version: '1.20'
cache-dependency-path: '**/user-service/go.sum'
- name: Build
run: |
cd user-service
go mod tidy
go build -v ./...
cd ..
- name: golangci-lint
run: |
go install github.com/golangci/golangci-lint/cmd/[email protected]
cd user-service
golangci-lint run
cd ..
- name: Test
run: |
cd user-service
go test -v ./... -race -coverprofile=coverage.out -coverpkg=./... -covermode=atomic
cd ..
- name: Upload coverage to Codecov
uses: codecov/codecov-action@v3
with:
files: ./user-service/coverage.out
flags: user-service
token: ${{secrets.CODECOV_TOKEN}}
- name: Run Trivy vulnerability scanner in repo mode
uses: aquasecurity/trivy-action@master
with:
scan-type: 'fs'
ignore-unfixed: true
format: 'sarif'
output: 'trivy-results.sarif'
severity: 'CRITICAL'
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: 'trivy-results.sarif'
publish-docker-image:
if: gitHub.event_name != 'pull_request'
needs: build-and-test
runs-on: ubuntu-20.04
permissions:
packages: write
id-token: write
contents: read
actions: read
security-events: write
steps:
- name: Checkout GitHub Action
uses: actions/checkout@v3
# setup Docker build action
- name: Set up Docker Buildx
id: buildx
uses: docker/setup-buildx-action@v2
- name: Docker metadata
id: metadata
uses: docker/metadata-action@v4
with:
images: ${{ env.REGISTRY }}/${{ github.repository }}/user-service
tags: |
type=semver,pattern={{version}}
type=semver,pattern={{major}}.{{minor}}
type=raw,value={{sha}},enable=${{ github.ref_type != 'tag' }}
flavor: |
latest=true
- name: Login to GitHub Container Registry
uses: docker/login-action@v2
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GH_TOKEN }}
- name: Build image and push to GitHub Container Registry
uses: docker/build-push-action@v4
with:
# relative path to the place where source code with Dockerfile is located
context: ./user-service
# Note: tags has to be all lower-case
tags: ${{ env.REGISTRY }}/${{ github.repository }}/user-service:${{ github.run_id }}
# ${{ steps.metadata.outputs.tags }}
labels: ${{ steps.metadata.outputs.labels }}
# build on feature branches, push only on main branch
push: true
- name: Install cosign
uses: sigstore/cosign-installer@main
- name: Sign the images
run: |
cosign sign -y ${{ env.REGISTRY }}/${{ github.repository }}/user-service:${{ github.run_id }}
env:
COSIGN_EXPERIMENTAL: 1
- name: Verify the pushed tags
run: cosign verify ${{ env.REGISTRY }}/${{ github.repository }}/user-service:${{ github.run_id }} --certificate-identity ${{ env.GH_URL }}/${{ github.repository }}/.github/workflows/user-service-ci.yml@refs/heads/main --certificate-oidc-issuer https://token.actions.githubusercontent.com
env:
COSIGN_EXPERIMENTAL: 1
- name: Run Trivy in GitHub SBOM mode and submit results to Dependency Graph
uses: aquasecurity/trivy-action@master
with:
scan-type: 'fs'
format: 'github'
output: 'dependency-results.sbom.json'
image-ref: '.'
github-pat: ${{ secrets.GH_TOKEN }}