mirror of
https://github.com/kubereboot/kured.git
synced 2026-08-28 05:47:23 +00:00
104 lines
3.5 KiB
YAML
104 lines
3.5 KiB
YAML
name: Daily jobs
|
|
|
|
on:
|
|
schedule:
|
|
- cron: "30 1 * * 6"
|
|
|
|
jobs:
|
|
periodics-gotest:
|
|
name: Run go tests
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
|
|
with:
|
|
egress-policy: audit
|
|
|
|
|
|
- name: checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
|
|
with:
|
|
version: 2026.6.1
|
|
|
|
- name: run tests
|
|
run: make test
|
|
|
|
- name: Annotate tests
|
|
if: always()
|
|
uses: guyarb/golang-test-annoations@96fc379b171c49932041d6c789e73331a7bdeec1 # v0.9.0
|
|
with:
|
|
test-results: test.json
|
|
|
|
periodics-mark-stale:
|
|
name: Mark stale issues and PRs
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
# Stale, by default, waits for 60 days before marking PR/issues as stale and closes them after 21 days.
|
|
# Do not expire the first issues that would allow the community to grow.
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
|
|
with:
|
|
repo-token: ${{ secrets.GITHUB_TOKEN }}
|
|
stale-issue-message: 'This issue was automatically considered stale due to lack of activity. Please update it and/or join our slack channels to promote it, before it automatically closes (in 7 days).'
|
|
stale-pr-message: 'This PR was automatically considered stale due to lack of activity. Please refresh it and/or join our slack channels to highlight it, before it automatically closes (in 7 days).'
|
|
stale-issue-label: 'no-issue-activity'
|
|
stale-pr-label: 'no-pr-activity'
|
|
exempt-issue-labels: 'good first issue,keep'
|
|
exempt-pr-labels: 'keep'
|
|
days-before-close: 21
|
|
|
|
check-docs-links:
|
|
name: Check docs for incorrect links
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- name: Link Checker
|
|
uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0
|
|
env:
|
|
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
|
|
with:
|
|
args: --verbose --no-progress '*.md' '*.yaml' '*/*/*.go' --exclude-link-local
|
|
fail: true
|
|
|
|
vuln-scan:
|
|
name: Build image and scan it against known vulnerabilities
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
|
|
with:
|
|
version: 2026.6.1
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
|
|
|
|
- name: Build artifacts
|
|
run: make dev-image
|
|
- name: Run Trivy vulnerability scanner
|
|
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
|
|
with:
|
|
image-ref: kured:dev
|
|
format: 'table'
|
|
exit-code: '1'
|
|
ignore-unfixed: true
|
|
vuln-type: 'os,library'
|
|
severity: 'CRITICAL,HIGH'
|