lint.yaml

---
name: "Lint"
on: # yamllint disable-line rule:truthy
  push:
    branches:
      - "!dependabot/*"
      - "main"
  pull_request:
    branches: ["*"]
  merge_group:
    types:
      - "checks_requested"
jobs:
  go-lint:
    name: "Lint Go"
    runs-on: "ubuntu-latest"
    steps:
      - uses: "actions/checkout@v3"
      - uses: "actions/setup-go@v3"
        with:
          go-version: "~1.19.1"
      - uses: "authzed/actions/gofumpt@main"
      - uses: "authzed/actions/go-mod-tidy@main"
      - uses: "authzed/actions/go-generate@main"
      - uses: "authzed/actions/golangci-lint@main"

  extra-lint:
    name: "Lint YAML & Markdown"
    runs-on: "ubuntu-latest"
    steps:
      - uses: "actions/checkout@v3"
      - uses: "authzed/actions/yaml-lint@main"
      - uses: "authzed/actions/markdown-lint@main"

  codeql:
    name: "Analyze with CodeQL"
    runs-on: "ubuntu-latest"
    permissions:
      actions: "read"
      contents: "read"
      security-events: "write"
    strategy:
      fail-fast: false
      matrix:
        language: ["go"]
    steps:
      - uses: "actions/checkout@v3"
      - uses: "authzed/actions/codeql@main"

  trivy-fs:
    name: "Analyze FS with Trivy"
    runs-on: "ubuntu-latest"
    steps:
      - uses: "actions/checkout@v3"
      - uses: "aquasecurity/trivy-action@master"
        with:
          scan-type: "fs"
          ignore-unfixed: true
          format: 'table'
          exit-code: '1'
          severity: "CRITICAL,HIGH,MEDIUM"

  trivy-image:
    name: "Analyze Release Image with Trivy"
    runs-on: "ubuntu-latest"
    steps:
      - uses: "actions/checkout@v3"
      - uses: "authzed/actions/setup-go@main"
        with:
          go-version: "${{ env.GO_VERSION }}"
      # Workaround until goreleaser release supports --single-target
      # makes the build faster by not building everything
      - name: "modify goreleaser config to skip building all targets"
        run: |
          echo "partial:
            by: target" >> .goreleaser.docker.yml
      - uses: "goreleaser/goreleaser-action@v4"
        id: "goreleaser"
        with:
          distribution: "goreleaser-pro"
          version: "latest"
          args: "release -f .goreleaser.docker.yml --clean --split --snapshot"
        env:
          GORELEASER_KEY: "${{ secrets.GORELEASER_KEY }}"
      - name: "Obtain container image to scan"
        run: 'echo "IMAGE_VERSION=$(jq .version dist/linux_amd64/metadata.json --raw-output)" >> $GITHUB_ENV'
      - name: "run trivy on release image"
        run: 'docker run -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy image --format table --exit-code 1 --ignore-unfixed --vuln-type os,library --no-progress --severity CRITICAL,HIGH,MEDIUM authzed/zed:v${{ env.IMAGE_VERSION }}-amd64'
      - name: "run trivy on debug image"
        run: 'docker run -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy image --format table --exit-code 1 --ignore-unfixed --vuln-type os,library --no-progress --severity CRITICAL,HIGH,MEDIUM authzed/zed:v${{ env.IMAGE_VERSION }}-amd64-debug'