test.yaml

# Copyright 2023 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: test
on:
  workflow_call:
    inputs:
      go-version:
        description: 'Go version to use'
        required: false
        type: string
        default: ^1.20.1
      go-version-for-lint:
        description: 'Go version to use for linting'
        required: false
        type: string
        default: ^1.19
      scan-severity:
        description: 'Trivy scan severity'
        required: false
        type: string
        default: 'CRITICAL,HIGH'
      golangci_version:
        description: 'golangci version to use'
        required: false
        type: string
        default: 'v1.52.2'
permissions:
  contents: read
jobs:
  unit:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
    - name: Setup Go
      uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9  # v4.0.0
      with:
        go-version: ${{ inputs.go-version }}
        cache: false
    - run: go version
    - name: Cache Go Modules
      uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8  # v3.3.1
      with:
        path: |
          ~/go/pkg/mod
          ~/.cache/go-build
        key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
        restore-keys: |
          ${{ runner.os }}-go-
    - name: Checkout Code
      uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9  # v3.5.3
    - name: Tidy Modules
      run: |
        make tidy
    - name: Unit Test
      run: |
        make test
    - name: Parse Coverage
      uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d  # v3.1.4
      with:
        flags: unittests  # optional

  lint:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
    - name: Setup Go
      uses: actions/setup-go@v4  # v4.0.0
      with:
        go-version: ${{ inputs.go-version-for-lint }}
        cache: false
    - run: go version
    - name: Checkout Code
      uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9  # v3.5.3
    - name: Tidy Modules
      run: |
        make tidy
    - name: Config Go Lint
      id: golangci_config
      uses: andstor/file-existence-action@20b4d2e596410855db8f9ca21e96fbe18e12930b  # v2.0
      with:
        files: .golangci.yaml
    - name: Lint Go
      if: steps.golangci_config.outputs.files_exists == 'true'
      uses: golangci/golangci-lint-action@v3  # v3
      with:
        version: ${{ inputs.golangci_version }}
        skip-cache: true
    - name: Config YAML Lint
      id: yamllint_config
      uses: andstor/file-existence-action@20b4d2e596410855db8f9ca21e96fbe18e12930b  # v2.0
      with:
        files: .yamllint
    - name: Lint YAML
      if: steps.yamllint_config.outputs.files_exists == 'true'
      uses: karancode/yamllint-github-action@fdef6bc189425ecc84cc4543b2674566c0827053  # master
      with:
        yamllint_config_filepath: .yamllint

  e2e:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
    - name: Setup Go
      uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9  # v4.0.0
      with:
        go-version: ${{ inputs.go-version }}
    - run: go version
    - name: Cache Go Modules
      uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8  # v3.3.1
      with:
        path: |
          ~/go/pkg/mod
          ~/.cache/go-build
        key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
        restore-keys: |
          ${{ runner.os }}-go-
    - name: Checkout Code
      uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9  # v3.5.3
    - name: Tidy Modules
      run: |
        make tidy
    - name: Build Binary
      run: |-
        make build
    - name: Run Integration Tests
      run: |-
        tools/e2e

  scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
    - name: Checkout Code
      uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9  # v3.5.3
    - name: Scan Repo
      uses: aquasecurity/trivy-action@41f05d9ecffa2ed3f1580af306000f734b733e54  # master
      with:
        scan-type: 'fs'
        ignore-unfixed: true
        hide-progress: true
        format: 'sarif'
        output: 'trivy-results.sarif'
        severity: ${{ inputs.scan-severity }}
        exit-code: '1'
  # TODO: Enable once repo is public again
  #  - name: Upload Report
  #    uses: github/codeql-action/upload-sarif@168b99b3c22180941ae7dbdd5f5c9678ede476ba  # v2.11.6
  #    with:
  #      sarif_file: 'trivy-results.sarif'