kubescape/.github/workflows/a-pr-scanner.yaml

name: a-pr-scanner
permissions: read-all
on:
  workflow_call:
    inputs:
      RELEASE:
        description: 'release'
        required: true
        type: string
      CLIENT:
        description: 'Client name'
        required: true
        type: string
      UNIT_TESTS_PATH:
        required: false
        type: string
        default: "./..."
      GO111MODULE:
        required: true
        type: string
      CGO_ENABLED:
        type: number
        default: 1
jobs:
  unit-tests:
    if: ${{ github.actor != 'kubescape' }}
    name: Create cross-platform build
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    runs-on: ubuntu-latest
    steps:

      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
          submodules: recursive

      - uses: actions/setup-go@v4
        name: Installing go
        with:
          go-version: ${{ inputs.GO_VERSION }}
          cache: true

      - name: Test core pkg
        run: ${{ env.DOCKER_CMD }} go test -v ./...
        if: startsWith(github.ref, 'refs/tags')

      - name: Test httphandler pkg
        run: ${{ env.DOCKER_CMD }} sh -c 'cd httphandler && go test -v ./...'
        if: startsWith(github.ref, 'refs/tags')

      - uses: anchore/sbom-action/download-syft@v0.15.2
        name: Setup Syft

      - uses: goreleaser/goreleaser-action@v5
        name: Build
        with:
          distribution: goreleaser
          version: latest
          args: release --clean --snapshot
        env:
          RELEASE: ${{ inputs.RELEASE }}
          CLIENT: ${{ inputs.CLIENT }}
          CGO_ENABLED: ${{ inputs.CGO_ENABLED }}

      - name: Smoke Testing
        env:
          RELEASE: ${{ inputs.RELEASE }}
          KUBESCAPE_SKIP_UPDATE_CHECK: "true"
        run: ${{ env.DOCKER_CMD }} python3 smoke_testing/init.py ${PWD}/dist/kubescape-ubuntu-latest

      - name: golangci-lint
        continue-on-error: false
        uses: golangci/golangci-lint-action@08e2f20817b15149a52b5b3ebe7de50aff2ba8c5 # ratchet:golangci/golangci-lint-action@v3
        with:
          version: latest
          args: --timeout 10m --build-tags=static
          only-new-issues: true

  scanners:
    env:
      GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
      SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
    name: PR Scanner
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          submodules: recursive
      - uses: actions/setup-go@v4
        name: Installing go
        with:
          go-version: '1.21'
          cache: true
      - name: Scanning - Forbidden Licenses (go-licenses)
        id: licenses-scan
        continue-on-error: true
        run: |
          echo "## Installing go-licenses tool"
          go install github.com/google/go-licenses@latest
          echo "## Scanning for forbiden licenses ##"
          go-licenses check .
      - name: Scanning - Credentials (GitGuardian)
        if: ${{ env.GITGUARDIAN_API_KEY }}
        continue-on-error: true
        id: credentials-scan
        uses: GitGuardian/ggshield-action@4ab2994172fadab959240525e6b833d9ae3aca61 # ratchet:GitGuardian/ggshield-action@master
        with:
          args: -v --all-policies
        env:
          GITHUB_PUSH_BEFORE_SHA: ${{ github.event.before }}
          GITHUB_PUSH_BASE_SHA: ${{ github.event.base }}
          GITHUB_PULL_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          GITHUB_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
      - name: Scanning - Vulnerabilities (Snyk)
        if: ${{ env.SNYK_TOKEN }}
        id: vulnerabilities-scan
        continue-on-error: true
        uses: snyk/actions/golang@806182742461562b67788a64410098c9d9b96adb # ratchet:snyk/actions/golang@master
        with:
          command: test --all-projects
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

      - name: Test coverage
        id: unit-test
        run: go test -v ${{ inputs.UNIT_TESTS_PATH }} -covermode=count -coverprofile=coverage.out

      - name: Convert coverage count to lcov format
        uses: jandelgado/gcov2lcov-action@v1

      - name: Submit coverage tests to Coveralls
        continue-on-error: true
        uses: coverallsapp/github-action@v1
        with:
          github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
          path-to-lcov: coverage.lcov

      - name: Comment results to PR
        continue-on-error: true # Warning: This might break opening PRs from forks
        uses: peter-evans/create-or-update-comment@5adcb0bb0f9fb3f95ef05400558bdb3f329ee808 # ratchet:peter-evans/create-or-update-comment@v2.1.0
        with:
          issue-number: ${{ github.event.pull_request.number }}
          body: |
            Scan results:
            - License scan: ${{ steps.licenses-scan.outcome }}
            - Credentials scan: ${{ steps.credentials-scan.outcome }}
            - Vulnerabilities scan: ${{ steps.vulnerabilities-scan.outcome }}
          reactions: 'eyes'