Preserve SELinux labels for atomic file writes #879
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: PR Checks | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| - dev | |
| push: | |
| branches: | |
| - main | |
| - dev | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| jobs: | |
| build: | |
| name: Build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Go | |
| uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Verify dependencies | |
| run: go mod verify | |
| - name: Build for current platform | |
| run: make build | |
| - name: Build for all supported platforms | |
| run: make build-all | |
| test: | |
| name: Test | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Go | |
| uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Run tests | |
| run: go test -v -race -coverprofile=coverage.out -covermode=atomic ./... | |
| - name: Generate coverage report | |
| run: go tool cover -html=coverage.out -o coverage.html | |
| - name: Upload coverage to artifacts | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 | |
| with: | |
| name: coverage-report | |
| path: | | |
| coverage.out | |
| coverage.html | |
| - name: Check test coverage | |
| run: | | |
| coverage=$(go tool cover -func=coverage.out | grep total | awk '{print $3}' | sed 's/%//') | |
| echo "Total test coverage: ${coverage}%" | |
| # Set minimum coverage threshold (can be adjusted) | |
| threshold=30 | |
| if (( $(echo "$coverage < $threshold" | bc -l) )); then | |
| echo "::warning::Test coverage ${coverage}% is below threshold ${threshold}%" | |
| echo "Please consider adding more tests to improve coverage." | |
| else | |
| echo "✅ Test coverage ${coverage}% meets threshold ${threshold}%" | |
| fi | |
| lint: | |
| name: Lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Go | |
| uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Run golangci-lint | |
| uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 | |
| with: | |
| version: latest | |
| args: --timeout=5m | |
| only-new-issues: true | |
| security: | |
| name: Security Scan | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Go | |
| uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Run Gosec Security Scanner | |
| uses: securego/gosec@9e6a9843d7a4a6e3e9a8539b02612c8a4aa3f889 # v2.27.1 | |
| with: | |
| # we let the report trigger content trigger a failure using the GitHub Security features. | |
| args: "-no-fail -fmt sarif -out results.sarif -exclude-dir=hack -exclude-generated ./..." | |
| # Fix duplicate tags and null relationships in SARIF file (workaround for https://github.com/golang/go/issues/75890) | |
| - name: Clean SARIF output | |
| run: | | |
| set -e | |
| cat results.sarif | |
| jq ' | |
| (.runs[].tool.driver.rules[]?.properties.tags) |= (unique) | | |
| (.runs[].tool.driver.rules[]?.relationships) |= (if . then [.[] | select(. != null)] else . end) | |
| ' results.sarif > results-cleaned.sarif | |
| mv results-cleaned.sarif results.sarif | |
| - name: Upload SARIF file | |
| uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 | |
| if: always() | |
| with: | |
| sarif_file: results.sarif | |
| category: gosec | |
| code-quality: | |
| name: Code Quality Checks | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Go | |
| uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Check go fmt | |
| run: | | |
| UNFORMATTED=$(find . -name '*.go' -not -name '*.pb.go' -not -path './hack/*' | xargs gofmt -s -l) | |
| if [ -n "$UNFORMATTED" ]; then | |
| echo "❌ Go code is not formatted. Please run 'make fmt' or 'gofmt -s -w .'" | |
| echo "" | |
| echo "Unformatted files:" | |
| echo "$UNFORMATTED" | |
| exit 1 | |
| fi | |
| echo "✅ All files are properly formatted" | |
| - name: Check goimports | |
| run: | | |
| go install golang.org/x/tools/cmd/goimports@latest | |
| UNFORMATTED=$(find . -name '*.go' -not -name '*.pb.go' -not -path './hack/*' | xargs goimports -l) | |
| if [ -n "$UNFORMATTED" ]; then | |
| echo "❌ Go imports are not properly formatted. Please run 'goimports -w .'" | |
| echo "" | |
| echo "Files with incorrect imports:" | |
| echo "$UNFORMATTED" | |
| exit 1 | |
| fi | |
| echo "✅ All imports are properly formatted" | |
| - name: Check go vet | |
| run: go vet ./... | |
| - name: Check for common mistakes with staticcheck | |
| uses: dominikh/staticcheck-action@9716614d4101e79b4340dd97b10e54d68234e431 # v1.4.1 | |
| with: | |
| version: "latest" | |
| install-go: false | |
| dependency-review: | |
| name: Dependency Review | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| persist-credentials: false | |
| - name: Dependency Review | |
| uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0 | |
| with: | |
| fail-on-severity: moderate |