kubescape/.github/workflows/a-pr-scanner.yaml

name: a-pr-scanner
on:
  workflow_call:
    inputs:
      RELEASE:
        description: 'release'
        required: true
        type: string
      CLIENT:
        description: 'Client name'
        required: true
        type: string
jobs:
  scanners:
    env:
      GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
      SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
    name: PR Scanner
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # ratchet:actions/checkout@v3
        with:
          fetch-depth: 0
          submodules: recursive
      - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # Install go because go-licenses use it ratchet:actions/setup-go@v3
        name: Installing go
        with:
          go-version: '1.19'
          cache: true
      - name: Scanning - Forbidden Licenses (go-licenses)
        id: licenses-scan
        continue-on-error: true
        run: |
          echo "## Installing go-licenses tool"
          go install github.com/google/go-licenses@latest
          echo "## Scanning for forbiden licenses ##"
          go-licenses check .
      - name: Scanning - Credentials (GitGuardian)
        if: ${{ env.GITGUARDIAN_API_KEY }}
        continue-on-error: true
        id: credentials-scan
        uses: GitGuardian/ggshield-action@4ab2994172fadab959240525e6b833d9ae3aca61 # ratchet:GitGuardian/ggshield-action@master
        with:
          args: -v --all-policies
        env:
          GITHUB_PUSH_BEFORE_SHA: ${{ github.event.before }}
          GITHUB_PUSH_BASE_SHA: ${{ github.event.base }}
          GITHUB_PULL_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          GITHUB_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
      - name: Scanning - Vulnerabilities (Snyk)
        if: ${{ env.SNYK_TOKEN }}
        id: vulnerabilities-scan
        continue-on-error: true
        uses: snyk/actions/golang@806182742461562b67788a64410098c9d9b96adb # ratchet:snyk/actions/golang@master
        with:
          command: test --all-projects
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
      - name: Comment results to PR
        continue-on-error: true # Warning: This might break opening PRs from forks
        uses: peter-evans/create-or-update-comment@5adcb0bb0f9fb3f95ef05400558bdb3f329ee808 # ratchet:peter-evans/create-or-update-comment@v2.1.0
        with:
          issue-number: ${{ github.event.pull_request.number }}
          body: |
            Scan results:
            - License scan: ${{ steps.licenses-scan.outcome }}
            - Credentials scan: ${{ steps.credentials-scan.outcome }}
            - Vulnerabilities scan: ${{ steps.vulnerabilities-scan.outcome }}
          reactions: 'eyes'
  basic-tests:
    needs: scanners
    name: Create cross-platform build
    runs-on: ${{ matrix.os }}
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      RELEASE: ${{ inputs.RELEASE }}
      CLIENT: ${{ inputs.CLIENT }}
    strategy:
      matrix:
        os: [ubuntu-20.04, macos-latest, windows-latest]
    steps:
      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # ratchet:actions/checkout@v3
        with:
          submodules: recursive
      - name: Cache Go modules (Linux)
        if: matrix.os == 'ubuntu-latest'
        uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 # ratchet:actions/cache@v3
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-
      - name: Cache Go modules (macOS)
        if: matrix.os == 'macos-latest'
        uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 # ratchet:actions/cache@v3
        with:
          path: |
            ~/Library/Caches/go-build
            ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-
      - name: Cache Go modules (Windows)
        if: matrix.os == 'windows-latest'
        uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 # ratchet:actions/cache@v3
        with:
          path: |
            ~\AppData\Local\go-build
            ~\go\pkg\mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-
      - name: Set up Go
        uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # ratchet:actions/setup-go@v3
        with:
          go-version: 1.19
      - name: Install MSYS2 & libgit2 (Windows)
        shell: cmd
        run: .\build.bat all
        if: matrix.os == 'windows-latest'
      - name: Install pkg-config (macOS)
        run: brew install pkg-config
        if: matrix.os == 'macos-latest'
      - name: Install libgit2 (Linux/macOS)
        run: make libgit2
        if: matrix.os != 'windows-latest'
      - name: Test core pkg
        run: go test "-tags=static,gitenabled" -v ./...
      - name: Test httphandler pkg
        run: cd httphandler && go test "-tags=static,gitenabled" -v ./...
      - name: Build
        env:
          RELEASE: ${{ inputs.RELEASE }}
          CLIENT: ${{ inputs.CLIENT }}
          CGO_ENABLED: 1
        run: python3 --version && python3 build.py
      - name: Smoke Testing (Windows / MacOS)
        env:
          RELEASE: ${{ inputs.RELEASE }}
          KUBESCAPE_SKIP_UPDATE_CHECK: "true"
        run: python3 smoke_testing/init.py ${PWD}/build/kubescape-${{ matrix.os }}
        if: matrix.os != 'ubuntu-20.04'
      - name: Smoke Testing (Linux)
        env:
          RELEASE: ${{ inputs.RELEASE }}
          KUBESCAPE_SKIP_UPDATE_CHECK: "true"
        run: python3 smoke_testing/init.py ${PWD}/build/kubescape-ubuntu-latest
        if: matrix.os == 'ubuntu-20.04'
      - name: golangci-lint
        if: matrix.os == 'ubuntu-20.04'
        continue-on-error: true
        uses: golangci/golangci-lint-action@08e2f20817b15149a52b5b3ebe7de50aff2ba8c5 # ratchet:golangci/golangci-lint-action@v3
        with:
          version: latest
          args: --timeout 10m --build-tags=static
          only-new-issues: true