osv-scanner/.github/workflows/prerelease-check.yml at d03774202cbaf17a260c2f4a073585baee524b45 · google/osv-scanner · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
name: Pre-release check

on:
  workflow_dispatch:
    inputs:
      version:
        description: "The version tag to release, (e.g. v1.2.3)"
        required: true
        type: string
      commit:
        description: "The commit hash to release"
        required: true
        type: string

# Restrict jobs in this workflow to have no permissions by default; permissions
# should be granted per job as needed using a dedicated `permissions` block
permissions: {}

jobs:
  osv-scan:
    permissions:
      contents: read # to fetch code (actions/checkout)
      security-events: write # for uploading SARIF files
      actions: read
    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@main
    with:
      # Only scan the top level go.mod file without recursively scanning directories since
      # this is pipeline is about releasing the go module and binary
      scan-args: |-
        ./

  links:
    permissions:
      contents: read # to fetch code (actions/checkout)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      - uses: tcort/github-action-markdown-link-check@e7c7a18363c842693fadde5d41a3bd3573a7a225 # v1.1.2
        with:
          use-quiet-mode: "yes"
          base-branch: "main"
  format:
    permissions:
      contents: read # to fetch code (actions/checkout)
    name: prettier
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false
      - name: Run lint action
        uses: ./.github/workflows/format-action
  tidy:
    permissions:
      contents: read # to fetch code (actions/checkout)
    name: go mod tidy
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false
      - name: Set up Go
        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
        with:
          go-version: stable
          check-latest: true
      - run: go mod tidy -diff
  lint:
    permissions:
      contents: read # to fetch code (actions/checkout)
    name: golangci-lint
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false
          ref: ${{ inputs.commit }}
      - name: Set up Go
        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
        with:
          go-version: stable
          check-latest: true
      - name: Run lint action
        uses: ./.github/workflows/lint-action
  prepare_test_image_testdata:
    permissions:
      contents: read # to fetch code (actions/checkout)
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false
      - run: scripts/build_test_images.sh
      - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: image-testdata-${{ github.run_number }}-${{ github.run_attempt }}
          path: cmd/osv-scanner/scan/image/testdata/*.tar
          retention-days: 1
  tests:
    permissions:
      contents: read # to fetch code (actions/checkout)
    name: Run unit tests
    needs:
      - prepare_test_image_testdata
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - name: Check out code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false
          ref: ${{ inputs.commit }}
      - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
        with:
          name: image-testdata-${{ github.run_number }}-${{ github.run_attempt }}
          path: cmd/osv-scanner/scan/image/testdata/
      - name: Set up Go
        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
        with:
          go-version: stable
          check-latest: true
      - name: Run test action
        uses: ./.github/workflows/test-action
        with:
          codecov_token: ${{ secrets.CODECOV_TOKEN }}
  generators:
    permissions:
      contents: read # to fetch code (actions/checkout)
    name: (re)generate code
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false
          ref: ${{ inputs.commit }}
      - name: Set up Go
        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
        with:
          go-version: stable
          check-latest: true
      - name: Run generators
        run: go generate ./...
      - run: |
          git diff --name-only \
            | xargs -I '{}' bash -c \
              'echo "::error file={}::This needs to be regenerated by running \`go generate ./...\`" && false'
  release-helper:
    permissions:
      contents: read # to fetch code (actions/checkout)
    runs-on: ubuntu-latest
    needs:
      - format
      - lint
      - tests
      - osv-scan
    steps:
      - name: Print Scripts
        env:
          OUTPUT: |
            git fetch upstream &&
            git tag ${{ inputs.version }} ${{ inputs.commit }} &&
            git push upstream ${{ inputs.version }}
        shell: bash
        run: |
          echo $OUTPUT