name: Build

on:
  push:
    branches: [main]
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
    contents: read

env:
  GORELEASER_VERSION: v2.15.2
  GORELEASER_CHECKSUM_x86_64: 0ebdbf0353aba566b969dde746cc4e4806f96c27aa2f3971b229a9df7611fedc

jobs:
  build:
    runs-on: ubuntu-latest

    permissions:
      contents: read
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results

    steps:
    - name: Checkout code
      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

    - name: Set up Go
      uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
      with:
        go-version-file: go.mod
    
    - name: Set up QEMU
      uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4

    - name: Setup goreleaser
      env:
        FILENAME: goreleaser.tar.gz
      run: |-
        curl -sSfL -o ${{ env.FILENAME }} https://github.com/goreleaser/goreleaser/releases/download/${{ env.GORELEASER_VERSION }}/goreleaser_Linux_x86_64.tar.gz
        echo "${{ env.GORELEASER_CHECKSUM_x86_64 }}  ${{ env.FILENAME }}" | sha256sum --check
        tar -xvzf "${{ env.FILENAME }}" goreleaser
        sudo install -m 755 goreleaser /usr/local/bin/goreleaser

        rm -f "${{ env.FILENAME }}" goreleaser

    - name: Run GoReleaser
      env:
        REPO: ${{ github.repository }}
        REGISTRY: ""
      run: |-
        goreleaser --clean --snapshot

        if [[ ! -f dist/metadata.json ]] || [[ ! -s dist/metadata.json ]]; then
          echo "Missing required file: dist/metadata.json"
          exit 1
        fi

        if [[ ! -f dist/artifacts.json ]] || [[ ! -s dist/artifacts.json ]]; then
          echo "Missing required file: dist/artifacts.json"
          exit 1
        fi

        echo "metadata=$(tr -d '\n\r' < dist/metadata.json)" >> "${GITHUB_OUTPUT}"
        echo "artifacts=$(tr -d '\n\r' < dist/artifacts.json)" >> "${GITHUB_OUTPUT}"

    - name: Run Trivy vulnerability scanner (k3kcli)
      uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
      with:
        ignore-unfixed: true
        severity: 'MEDIUM,HIGH,CRITICAL'
        scan-type: 'fs'
        scan-ref: 'dist/k3kcli_linux_amd64_v1/k3kcli'
        format: 'sarif'
        output: 'trivy-results-k3kcli.sarif'

    - name: Upload Trivy scan results to GitHub Security tab (k3kcli)
      uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
      with:
        sarif_file: trivy-results-k3kcli.sarif
        category: k3kcli

    - name: Run Trivy vulnerability scanner (k3k)
      uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
      with:
        ignore-unfixed: true
        severity: 'MEDIUM,HIGH,CRITICAL'
        scan-type: 'image'
        scan-ref: '${{ github.repository }}:v0.0.0-amd64'
        format: 'sarif'
        output: 'trivy-results-k3k.sarif'

    - name: Upload Trivy scan results to GitHub Security tab (k3k)
      uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
      with:
        sarif_file: trivy-results-k3k.sarif
        category: k3k

    - name: Run Trivy vulnerability scanner (k3k-kubelet)
      uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
      with:
        ignore-unfixed: true
        severity: 'MEDIUM,HIGH,CRITICAL'
        scan-type: 'image'
        scan-ref: '${{ github.repository }}-kubelet:v0.0.0-amd64'
        format: 'sarif'
        output: 'trivy-results-k3k-kubelet.sarif'

    - name: Upload Trivy scan results to GitHub Security tab (k3k-kubelet)
      uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
      with:
        sarif_file: trivy-results-k3k-kubelet.sarif
        category: k3k-kubelet