name: Build

on:
  push:
    branches: [main]
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
    contents: read

jobs:
  build:
    runs-on: ubuntu-latest

    permissions:
      contents: read
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results

    steps:
    - name: Checkout code
      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

    - name: Set up Go
      uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
      with:
        go-version-file: go.mod
    
    - name: Set up QEMU
      uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4

    - name: Run GoReleaser
      uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
      with:
        distribution: goreleaser
        version: v2
        args: --clean --snapshot
      env:
        REPO: ${{ github.repository }}
        REGISTRY: ""

    - name: Run Trivy vulnerability scanner (k3kcli)
      uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # 0.34.2
      with:
        ignore-unfixed: true
        severity: 'MEDIUM,HIGH,CRITICAL'
        scan-type: 'fs'
        scan-ref: 'dist/k3kcli_linux_amd64_v1/k3kcli'
        format: 'sarif'
        output: 'trivy-results-k3kcli.sarif'

    - name: Upload Trivy scan results to GitHub Security tab (k3kcli)
      uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4
      with:
        sarif_file: trivy-results-k3kcli.sarif
        category: k3kcli

    - name: Run Trivy vulnerability scanner (k3k)
      uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # 0.34.2
      with:
        ignore-unfixed: true
        severity: 'MEDIUM,HIGH,CRITICAL'
        scan-type: 'image'
        scan-ref: '${{ github.repository }}:v0.0.0-amd64'
        format: 'sarif'
        output: 'trivy-results-k3k.sarif'

    - name: Upload Trivy scan results to GitHub Security tab (k3k)
      uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4
      with:
        sarif_file: trivy-results-k3k.sarif
        category: k3k

    - name: Run Trivy vulnerability scanner (k3k-kubelet)
      uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # 0.34.2
      with:
        ignore-unfixed: true
        severity: 'MEDIUM,HIGH,CRITICAL'
        scan-type: 'image'
        scan-ref: '${{ github.repository }}-kubelet:v0.0.0-amd64'
        format: 'sarif'
        output: 'trivy-results-k3k-kubelet.sarif'

    - name: Upload Trivy scan results to GitHub Security tab (k3k-kubelet)
      uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4
      with:
        sarif_file: trivy-results-k3k-kubelet.sarif
        category: k3k-kubelet