|
|
@@ -10,7 +10,6 @@ on:
|
|
|
|
|
|
env:
|
|
|
# Common versions
|
|
|
- GO_VERSION: '1.19'
|
|
|
GOLANGCI_VERSION: 'v1.49.0'
|
|
|
KUBERNETES_VERSION: '1.24.x'
|
|
|
DOCKER_BUILDX_VERSION: 'v0.4.2'
|
|
|
@@ -50,7 +49,7 @@ jobs:
|
|
|
- name: Setup Go
|
|
|
uses: actions/setup-go@v3
|
|
|
with:
|
|
|
- go-version: ${{ env.GO_VERSION }}
|
|
|
+ go-version-file: "go.mod"
|
|
|
|
|
|
- name: Find the Go Cache
|
|
|
id: go
|
|
|
@@ -96,7 +95,7 @@ jobs:
|
|
|
- name: Setup Go
|
|
|
uses: actions/setup-go@v3
|
|
|
with:
|
|
|
- go-version: ${{ env.GO_VERSION }}
|
|
|
+ go-version-file: "go.mod"
|
|
|
|
|
|
- name: Find the Go Cache
|
|
|
id: go
|
|
|
@@ -108,15 +107,15 @@ jobs:
|
|
|
uses: actions/cache@v3
|
|
|
with:
|
|
|
path: ${{ steps.go.outputs.build-cache }}
|
|
|
- key: ${{ runner.os }}-${{ env.GO_VERSION }}-build-check-diff-${{ github.sha }}-${{ hashFiles('**/go.sum') }}
|
|
|
- restore-keys: ${{ runner.os }}-${{ env.GO_VERSION }}-build-check-diff-${{ github.sha }}-
|
|
|
+ key: ${{ runner.os }}-build-check-diff-${{ github.sha }}-${{ hashFiles('**/go.sum') }}
|
|
|
+ restore-keys: ${{ runner.os }}-build-check-diff-${{ github.sha }}-
|
|
|
|
|
|
- name: Cache Go Dependencies
|
|
|
uses: actions/cache@v3
|
|
|
with:
|
|
|
path: ${{ steps.go.outputs.mod-cache }}
|
|
|
- key: ${{ runner.os }}-${{ env.GO_VERSION }}-pkg-${{ github.sha }}-${{ hashFiles('**/go.sum') }}
|
|
|
- restore-keys: ${{ runner.os }}-${{ env.GO_VERSION }}-pkg-${{ github.sha }}-
|
|
|
+ key: ${{ runner.os }}-pkg-${{ github.sha }}-${{ hashFiles('**/go.sum') }}
|
|
|
+ restore-keys: ${{ runner.os }}-pkg-${{ github.sha }}-
|
|
|
|
|
|
# Check DIff also runs Reviewable which needs golangci-lint installed
|
|
|
- name: Check Diff
|
|
|
@@ -140,7 +139,7 @@ jobs:
|
|
|
- name: Setup Go
|
|
|
uses: actions/setup-go@v3
|
|
|
with:
|
|
|
- go-version: ${{ env.GO_VERSION }}
|
|
|
+ go-version-file: "go.mod"
|
|
|
|
|
|
- name: Find the Go Cache
|
|
|
id: go
|
|
|
@@ -211,7 +210,7 @@ jobs:
|
|
|
- name: Setup Go
|
|
|
uses: actions/setup-go@v3
|
|
|
with:
|
|
|
- go-version: ${{ env.GO_VERSION }}
|
|
|
+ go-version-file: "go.mod"
|
|
|
|
|
|
- name: Find the Go Cache
|
|
|
id: go
|
|
|
@@ -247,6 +246,20 @@ jobs:
|
|
|
BUILD_ARGS: "--push --platform linux/amd64,linux/arm64"
|
|
|
run: make docker.build
|
|
|
|
|
|
+ - name: Get docker image tag
|
|
|
+ id: image_version
|
|
|
+ run: echo "::set-output name=image::$(make docker.image)"
|
|
|
+
|
|
|
+ - name: Run Trivy vulnerability scanner
|
|
|
+ uses: aquasecurity/trivy-action@master
|
|
|
+ with:
|
|
|
+ image-ref: '${{ steps.image_version.outputs.image }}'
|
|
|
+ format: 'table'
|
|
|
+ exit-code: '1'
|
|
|
+ ignore-unfixed: true
|
|
|
+ vuln-type: 'os,library'
|
|
|
+ severity: 'CRITICAL,HIGH'
|
|
|
+
|
|
|
- name: Promote Artifacts to main release channel
|
|
|
if: github.ref == 'refs/heads/main' && env.GHCR_USERNAME != ''
|
|
|
run: make docker.promote
|
Moritz Johner