mirror of
https://github.com/rancher/k3k.git
synced 2026-08-18 03:46:31 +00:00
2499f67053
Co-authored-by: renovate-rancher[bot] <119870437+renovate-rancher[bot]@users.noreply.github.com>
117 lines
3.8 KiB
YAML
117 lines
3.8 KiB
YAML
name: Build
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
types: [opened, synchronize, reopened]
|
|
paths-ignore:
|
|
- 'docs/**'
|
|
- '**/*.md'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
GORELEASER_VERSION: v2.17.0
|
|
GORELEASER_CHECKSUM_x86_64: dde10e2d5a13cef969c0eec00c74f359c0ac306d702b1bd291ad9337b4e54c1d
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
|
|
permissions:
|
|
contents: read
|
|
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
|
|
with:
|
|
go-version-file: go.mod
|
|
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
|
|
|
|
- name: Setup goreleaser
|
|
env:
|
|
FILENAME: goreleaser.tar.gz
|
|
run: |-
|
|
curl -sSfL -o ${{ env.FILENAME }} https://github.com/goreleaser/goreleaser/releases/download/${{ env.GORELEASER_VERSION }}/goreleaser_Linux_x86_64.tar.gz
|
|
echo "${{ env.GORELEASER_CHECKSUM_x86_64 }} ${{ env.FILENAME }}" | sha256sum --check
|
|
tar -xvzf "${{ env.FILENAME }}" goreleaser
|
|
sudo install -m 755 goreleaser /usr/local/bin/goreleaser
|
|
|
|
rm -f "${{ env.FILENAME }}" goreleaser
|
|
|
|
- name: Run GoReleaser
|
|
env:
|
|
REPO: ${{ github.repository }}
|
|
REGISTRY: ""
|
|
run: |-
|
|
goreleaser --clean --snapshot
|
|
|
|
if [[ ! -f dist/metadata.json ]] || [[ ! -s dist/metadata.json ]]; then
|
|
echo "Missing required file: dist/metadata.json"
|
|
exit 1
|
|
fi
|
|
|
|
if [[ ! -f dist/artifacts.json ]] || [[ ! -s dist/artifacts.json ]]; then
|
|
echo "Missing required file: dist/artifacts.json"
|
|
exit 1
|
|
fi
|
|
|
|
echo "metadata=$(tr -d '\n\r' < dist/metadata.json)" >> "${GITHUB_OUTPUT}"
|
|
echo "artifacts=$(tr -d '\n\r' < dist/artifacts.json)" >> "${GITHUB_OUTPUT}"
|
|
|
|
- name: Run Trivy vulnerability scanner (k3kcli)
|
|
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
|
|
with:
|
|
ignore-unfixed: true
|
|
severity: 'MEDIUM,HIGH,CRITICAL'
|
|
scan-type: 'fs'
|
|
scan-ref: 'dist/k3kcli_linux_amd64_v1/k3kcli'
|
|
format: 'sarif'
|
|
output: 'trivy-results-k3kcli.sarif'
|
|
|
|
- name: Upload Trivy scan results to GitHub Security tab (k3kcli)
|
|
uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4
|
|
with:
|
|
sarif_file: trivy-results-k3kcli.sarif
|
|
category: k3kcli
|
|
|
|
- name: Run Trivy vulnerability scanner (k3k)
|
|
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
|
|
with:
|
|
ignore-unfixed: true
|
|
severity: 'MEDIUM,HIGH,CRITICAL'
|
|
scan-type: 'image'
|
|
scan-ref: '${{ github.repository }}:v0.0.0-amd64'
|
|
format: 'sarif'
|
|
output: 'trivy-results-k3k.sarif'
|
|
|
|
- name: Upload Trivy scan results to GitHub Security tab (k3k)
|
|
uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4
|
|
with:
|
|
sarif_file: trivy-results-k3k.sarif
|
|
category: k3k
|
|
|
|
- name: Run Trivy vulnerability scanner (k3k-kubelet)
|
|
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
|
|
with:
|
|
ignore-unfixed: true
|
|
severity: 'MEDIUM,HIGH,CRITICAL'
|
|
scan-type: 'image'
|
|
scan-ref: '${{ github.repository }}-kubelet:v0.0.0-amd64'
|
|
format: 'sarif'
|
|
output: 'trivy-results-k3k-kubelet.sarif'
|
|
|
|
- name: Upload Trivy scan results to GitHub Security tab (k3k-kubelet)
|
|
uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4
|
|
with:
|
|
sarif_file: trivy-results-k3k-kubelet.sarif
|
|
category: k3k-kubelet
|