ci.yaml

name: CI

on:
  push:
    branches:
      - master
      - release-*
  pull_request: {}
  workflow_dispatch: {}

env:
  # Common versions
  GO_VERSION: '1.19'
  GOLANGCI_VERSION: 'v1.51'
  DOCKER_BUILDX_VERSION: 'v0.4.2'

  # Common users. We can't run a step 'if secrets.AWS_USR != ""' but we can run
  # a step 'if env.AWS_USR' != ""', so we copy these to succinctly test whether
  # credentials have been provided before trying to run steps that need them.
  DOCKER_USR: ${{ secrets.DOCKER_USR }}
  AWS_USR: ${{ secrets.AWS_USR }}

jobs:
  typos-check:
    name: Spell Check with Typos
    runs-on: ubuntu-20.04
    steps:
      - name: Checkout Actions Repository
        uses: actions/checkout@v3
      - name: Check spelling with custom config file
        uses: crate-ci/typos@v1.13.10
        with:
          config: ./typos.toml

  golangci-lint:
    runs-on: ubuntu-20.04
    steps:
      - name: Checkout Code
        uses: actions/checkout@v3
        with:
          submodules: true
      - name: Setup Go
        uses: actions/setup-go@v3
        with:
          go-version: ${{ env.GO_VERSION }}
      - name: Cache Go Dependencies
        uses: actions/cache@v2
        with:
          path: ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: ${{ runner.os }}-go-
      - name: Code generate
        run: |
          make generate
      - name: Lint golang code
        uses: golangci/golangci-lint-action@v3.5.0
        with:
          version: ${{ env.GOLANGCI_VERSION }}
          args: --verbose
          skip-pkg-cache: true
          mod: readonly
      - name: Run Trivy vulnerability scanner in repo mode
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          ignore-unfixed: true
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL'
      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results.sarif'

  markdownlint-misspell-shellcheck:
    runs-on: ubuntu-20.04
    # this image is build from Dockerfile
    # https://github.com/pouchcontainer/pouchlinter/blob/master/Dockerfile
    container: pouchcontainer/pouchlinter:v0.1.2
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: Run misspell
        run: find  ./* -name  "*"  | grep -v vendor | xargs misspell -error
      - name: Run shellcheck
        run: find ./ -name "*.sh" | grep -v vendor | xargs shellcheck
      - name: Lint markdown files
        run: find  ./ -name  "*.md" | grep -v vendor | grep -v commandline |  grep -v .github |  grep -v swagger |  grep -v api |  xargs mdl -r ~MD010,~MD013,~MD014,~MD022,~MD024,~MD029,~MD031,~MD032,~MD033,~MD036
#      - name: Check markdown links
#        run: |
#          set +e
#          for name in $(find . -name \*.md | grep -v vendor | grep -v CHANGELOG); do
#            if [ -f $name ]; then
#              markdown-link-check -q $name -c .github/workflows/markdown-link-check.config.json;
#              if [ $? -ne 0 ]; then
#                code=1
#              fi
#            fi
#          done
#          bash -c "exit $code";

  unit-tests:
    runs-on: ubuntu-20.04
    steps:
      - uses: actions/checkout@v3
        with:
          submodules: true
      - name: Fetch History
        run: git fetch --prune --unshallow
      - name: Setup Go
        uses: actions/setup-go@v3
        with:
          go-version: ${{ env.GO_VERSION }}
      - name: Cache Go Dependencies
        uses: actions/cache@v2
        with:
          path: ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: ${{ runner.os }}-go-
      - name: Run Unit Tests
        run: |
          make test
          git status
      - name: Publish Unit Test Coverage
        uses: codecov/codecov-action@v3
        with:
          flags: unittests
          file: cover.out
      - name: Check diff
        run: '[[ -z $(git status -s) ]] || (printf "Existing modified/untracked files.\nPlease run \"make generate manifests\" and push again.\n"; exit 1)'