ci.yml

name: CI
on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main
    tags:
      - v*

  # Allows to run this via the Actions tab
  workflow_dispatch:

permissions: {}

env:
  # renovate: datasource=github-releases depName=goreleaser/goreleaser
  GORELEASER_VERSION: v2.18.3

concurrency:
  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    permissions:
      # Required: allow read access to the content for analysis.
      contents: read
      # Optional: allow read access to pull request. Use with `only-new-issues` option.
      pull-requests: read
      # Optional: Allow write access to checks to allow the action to annotate code in the PR.
      checks: write
    name: Linter
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: false
      - name: Check approved Go release line
        run: go env GOVERSION | grep -Eq '^go1\.26\.[0-9]+$'
      - name: golangci-lint
        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
        with:
          # Require: The version of golangci-lint to use.
          # When `install-mode` is `binary` (default) the value can be v1.2 or v1.2.3 or `latest` to use the latest version.
          # When `install-mode` is `goinstall` the value can be v1.2.3, `latest`, or the hash of a commit.
          version: v2.14.0

  check-license:
    name: License scan
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
    env:
      # renovate: datasource=go depName=github.com/google/go-licenses/v2
      GO_LICENSES_VERSION: v2.0.1
      REPORT_FILE: gl-license-scanning-report.json

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: false
      - name: Verify MIT-0 license unsupported by go-licenses
        run: |
          go mod download github.com/segmentio/asm
          printf '%s  %s\n' \
            cca993712df289a5958bdef69031a5dac0f951ac15afeb313f9eeea55ed59443 \
            "$(go list -m -f '{{.Dir}}/LICENSE' github.com/segmentio/asm)" |
            sha256sum --check
      - name: License scanning
        run: |
          scripts/install-go-tool.sh "github.com/google/go-licenses/v2@${GO_LICENSES_VERSION}"
          go-licenses check . --disallowed_types=forbidden,restricted --ignore=github.com/segmentio/asm/
      - name: Generate license report
        run: |
          go-licenses report . --ignore=github.com/segmentio/asm/ > licenses.csv
          printf 'github.com/segmentio/asm,https://github.com/segmentio/asm/blob/%s/LICENSE,MIT-0\n' \
            "$(go list -m -f '{{.Version}}' github.com/segmentio/asm)" >> licenses.csv
      - name: Save license scan report
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: license_scanning
          path: licenses.csv

  check-go-releaser:
    name: Go releaser check
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: false
      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
        with:
          # either 'goreleaser' (default) or 'goreleaser-pro'
          distribution: goreleaser
          # 'latest', 'nightly', or a semver
          version: ${{ env.GORELEASER_VERSION }}
          args: check

  test:
    name: Tests
    needs:
      - lint
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: false
      - name: Run tests
        run: |
          scripts/install-go-tool-test.sh
          go test -v ./...

  security:
    name: GoReleaser artifacts - govulncheck, Trivy secrets/vulns, Grype
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
    env:
      # renovate: datasource=go depName=golang.org/x/vuln
      GOVULNCHECK_VERSION: v1.8.0

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: false
      - name: Test govulncheck warning and error handling
        run: scripts/govulncheck-inform-test.sh
      - name: Install govulncheck
        run: scripts/install-go-tool.sh "golang.org/x/vuln/cmd/govulncheck@${GOVULNCHECK_VERSION}"
      - name: Report reachable Go vulnerabilities in the source
        run: scripts/govulncheck-inform.sh ./...
      - name: Test that the symbol-table guard rejects a stripped binary
        run: scripts/assert-go-symbols-test.sh
      - name: Build GoReleaser snapshot artifacts
        uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
        with:
          distribution: goreleaser
          version: ${{ env.GORELEASER_VERSION }}
          args: release --snapshot --clean --skip=publish
      - name: Verify and prepare all release artifacts
        run: scripts/prepare-artifact-scan-rootfs.sh
      - name: Report reachable Go vulnerabilities in each release binary
        run: scripts/govulncheck-release-binaries.sh
      - name: Import release artifacts for scanning
        run: docker import artifact-scan/rootfs.tar stackstate-backup-cli:security-scan
      - name: Scan release artifacts with Trivy, Grype, and VEX
        uses: StackVista/image-pipeline/.github/actions/scan-image@ec325c73909d0d00420121bbde6754b964e80ac3 # main
        with:
          image: stackstate-backup-cli:security-scan
          mode: inform
          severity: CRITICAL,HIGH,MEDIUM,LOW
          with-grype: "true"
          upload-sarif: "false"
      - name: Upload security evidence
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: release-artifact-security
          path: |
            artifact-scan/metadata/
            dist/*_checksums.txt
            reports/
          if-no-files-found: warn

  publish:
    name: Publish the release
    if: ${{ github.ref_type == 'tag' }}
    needs:
      - test
      - security
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: write
    env:
      TAG: ${{ github.ref_name }}
      S3_BUCKET: "s3://cli-dl.stackstate.com/stackstate-backup-cli/"
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache: false
      - name: Go releaser publish
        uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
        with:
          # either 'goreleaser' (default) or 'goreleaser-pro'
          distribution: goreleaser
          # 'latest', 'nightly', or a semver
          version: ${{ env.GORELEASER_VERSION }}
          args: release
      - name: Write latest version to file
        run: mkdir -p dist && echo "${TAG}" > dist/LATEST_VERSION

      - name: Authenticate with AWS
        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ secrets.AWS_DEFAULT_REGION }}

      - name: Publish latest version to S3
        run: |
          echo "aws s3 cp dist/LATEST_VERSION ${S3_BUCKET}"
          aws s3 cp dist/LATEST_VERSION "${S3_BUCKET}"