lint.yaml

---
name: "Lint"
on:  # yamllint disable-line rule:truthy
  push:
    branches:
      - "!dependabot/*"
      - "main"
  pull_request:
    branches: ["*"]
  merge_group:
    types:
      - "checks_requested"
jobs:
  go-lint:
    name: "Lint Go"
    runs-on: "ubuntu-latest"
    steps:
      - uses: "actions/checkout@v4"
      - uses: "authzed/actions/setup-go@main"
      - name: "Lint Go"
        run: "go run magefile.go lint:go"
      - name: "Go Mod Tidy"
        uses: "chainguard-dev/actions/nodiff@main"
        with:
          path: ""
          fixup-command: "go run magefile.go deps:tidy"
  protobuf:
    name: "Generate Protobufs"
    runs-on: "ubuntu-latest"
    steps:
      - uses: "actions/checkout@v4"
      - uses: "authzed/actions/setup-go@main"
      - uses: "chainguard-dev/actions/nodiff@main"
        with:
          path: ""
          fixup-command: "go run magefile.go gen:proto"
  extra-lint:
    name: "Lint YAML"
    runs-on: "ubuntu-latest"
    steps:
      - uses: "actions/checkout@v4"
      - uses: "authzed/actions/setup-go@main"
      - name: "Lint Go"
        run: "go run magefile.go lint:extra"
  codeql:
    name: "Analyze with CodeQL"
    runs-on: "ubuntu-latest"
    permissions:
      actions: "read"
      contents: "read"
      security-events: "write"
    strategy:
      fail-fast: false
      matrix:
        language: ["go"]
    steps:
      - uses: "actions/checkout@v4"
      - uses: "authzed/actions/codeql@main"
  trivy:
    name: "Analyze with Trivy"
    runs-on: "ubuntu-latest"
    steps:
      - uses: "actions/checkout@v4"
      - name: "Run Trivy vulnerability scanner"
        uses: "aquasecurity/trivy-action@master"
        with:
          scan-type: "fs"
          ignore-unfixed: true
          format: "sarif"
          output: "trivy-results.sarif"
          severity: "CRITICAL"
      - name: "Upload Trivy scan results to GitHub Security tab"
        uses: "github/codeql-action/upload-sarif@v3"
        with:
          sarif_file: "trivy-results.sarif"