kubescape/.github/workflows/build.yaml

name: build

on:
  push:
    branches: [ master ]
    paths-ignore:
      # Do not run the pipeline if only Markdown files changed
      - '**.md'
jobs:
  once:
    name: Create release
    runs-on: ubuntu-latest
    outputs:
      upload_url: ${{ steps.create_release.outputs.upload_url }}
    steps:
      - name: Create a release
        id: create_release
        uses: actions/create-release@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag_name: v2.0.${{ github.run_number }}
          release_name: Release v2.0.${{ github.run_number }}
          draft: false
          prerelease: false
  build:
    name: Create cross-platform release build, tag and upload binaries
    needs: once
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
      - uses: actions/checkout@v3
        with:
          submodules: recursive

      - name: Cache Go modules (Linux)
        if: matrix.os == 'ubuntu-latest' 
        uses: actions/cache@v3
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-

      - name: Cache Go modules (macOS)
        if: matrix.os == 'macos-latest' 
        uses: actions/cache@v3
        with:
          path: |
            ~/Library/Caches/go-build
            ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-

      - name: Cache Go modules (Windows)
        if: matrix.os == 'windows-latest'
        uses: actions/cache@v3
        with:
          path: |
            ~\AppData\Local\go-build
            ~\go\pkg\mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-

      - name: Set up Go
        uses: actions/setup-go@v3
        with:
          go-version: 1.18
      # - name: Test cmd pkg
      #   run: cd cmd && go test -v ./...

      - name: Install MSYS2 & libgit2 (Windows)
        shell: cmd
        run: .\build.bat all
        if: matrix.os == 'windows-latest'

      - name: Install libgit2 (Linux/macOS)
        run: make libgit2
        if: matrix.os != 'windows-latest'

      - name: Test core pkg
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: go test -tags=static -v ./...

      - name: Test httphandler pkg
        run: cd httphandler && go test -tags=static -v ./...

      - name: Build
        env:
          RELEASE: v2.0.${{ github.run_number }} 
          CLIENT: release
          CGO_ENABLED: 1
        run: python3 --version && python3 build.py
      
      - name: Smoke Testing
        env:
          RELEASE: v2.0.${{ github.run_number }} 
          KUBESCAPE_SKIP_UPDATE_CHECK: "true"
        run: python3 smoke_testing/init.py ${PWD}/build/${{ matrix.os }}/kubescape

      - name: Upload release binaries
        id: upload-release-asset
        uses: actions/upload-release-asset@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          upload_url: ${{ needs.once.outputs.upload_url }}
          asset_path: build/${{ matrix.os }}/kubescape
          asset_name: kubescape-${{ matrix.os }}
          asset_content_type: application/octet-stream

      - name: Upload release hash
        id: upload-release-hash
        uses: actions/upload-release-asset@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          upload_url: ${{ needs.once.outputs.upload_url }}
          asset_path: build/${{ matrix.os }}/kubescape.sha256
          asset_name: kubescape-${{ matrix.os }}-sha256
          asset_content_type: application/octet-stream
  build-docker:
    name: Build docker container, tag and upload to registry
    needs: build
    runs-on: ubuntu-latest
    if: ${{ github.repository == 'kubescape/kubescape' }} # TODO
    permissions:
      id-token: write
      packages: write
      contents: read

    steps:
      - uses: actions/checkout@v2
        with:
          submodules: recursive

      - name: Set image version
        id: image-version
        run: echo '::set-output name=IMAGE_VERSION::v2.0.${{ github.run_number }}'

      - name: Set image name
        id: image-name
        run: echo '::set-output name=IMAGE_NAME::quay.io/${{ github.repository_owner }}/kubescape'

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v2

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Login to Quay.io
        env:
          QUAY_PASSWORD: ${{ secrets.QUAYIO_REGISTRY_PASSWORD }}
          QUAY_USERNAME: ${{ secrets.QUAYIO_REGISTRY_USERNAME }}
        run: docker login -u="${QUAY_USERNAME}" -p="${QUAY_PASSWORD}" quay.io

      - name: Build the Docker image
        run: docker buildx build . --file build/Dockerfile --tag ${{ steps.image-name.outputs.IMAGE_NAME }}:${{ steps.image-version.outputs.IMAGE_VERSION }} --tag ${{ steps.image-name.outputs.IMAGE_NAME }}:latest --build-arg image_version=${{ steps.image-version.outputs.IMAGE_VERSION }} --build-arg client=image-release --push --platform linux/amd64,linux/arm64

      # - name: Login to GitHub Container Registry
      #   uses: docker/login-action@v1
      #   with:
      #     registry: ghcr.io
      #     username: ${{ github.actor }}
      #     password: ${{ secrets.GITHUB_TOKEN }}
    
      # TODO - Wait for casign to support fixed tags -> https://github.com/sigstore/cosign/issues/1424
      # - name: Install cosign
      #   uses: sigstore/cosign-installer@main
      #   with:
      #     cosign-release: 'v1.5.1' # optional
      # - name: sign kubescape container image
      #   env:
      #     COSIGN_EXPERIMENTAL: "true"
      #   run: |
      #       cosign sign --force ${{ steps.image-name.outputs.IMAGE_NAME }}:latest
      #       cosign sign --force ${{ steps.image-name.outputs.IMAGE_NAME }}:${{ steps.image-version.outputs.IMAGE_VERSION }}