azure-container-networking/.github/workflows/govulncheck.yaml at 72ec8589af034d971d8fb15bee29493b08dde187 · Azure/azure-container-networking · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
name: govulncheck
on:
  workflow_dispatch:
  pull_request:
    types:
      - opened
      - reopened
      - synchronize
      - ready_for_review
  merge_group:
    types:
      - checks_requested

permissions:
  contents: read

jobs:
  govulncheck:
    name: Run govulncheck (${{ matrix.module }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        module:
          - .
          - azure-ip-masq-merger
          - azure-ipam
          - azure-iptables-monitor
          - bpf-prog/ipv6-hp-bpf
          - cilium-log-collector
          - dropgz
          - pkgerrlint
          - tools/azure-npm-to-cilium-validator
          - zapai
        include:
          - module: .
            bpf: true
          - module: bpf-prog/ipv6-hp-bpf
            bpf: true
          - module: azure-iptables-monitor
            bpf: true
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
        if: matrix.bpf
        with:
          go-version-file: go.mod

      - name: Build BPF lib
        if: matrix.bpf
        run: make bpf-lib

      - name: Go generate
        if: matrix.bpf
        run: go generate ./...
        working-directory: ${{ matrix.module }}

      - name: Set up Go
        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
        with:
          go-version-file: ${{ matrix.module }}/go.mod

      - name: Run govulncheck
        uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1.0.4
        with:
          go-version-file: ${{ matrix.module }}/go.mod
          work-dir: ${{ matrix.module }}
          go-package: ./...
          repo-checkout: false

  check-gomod-coverage:
    name: Check all go.mod files are in matrix
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Verify matrix covers all go.mod files
        run: |
          MATRIX_MODULES=(
            "."
            "azure-ip-masq-merger"
            "azure-ipam"
            "azure-iptables-monitor"
            "bpf-prog/ipv6-hp-bpf"
            "cilium-log-collector"
            "dropgz"
            "pkgerrlint"
            "tools/azure-npm-to-cilium-validator"
            "zapai"
          )

          mapfile -t FOUND_MODULES < <(
            find . -name "go.mod" -not -path "*/vendor/*" \
              | xargs -I{} dirname {} \
              | sed 's|^\./||' \
              | sort
          )

          MISSING=()
          for mod in "${FOUND_MODULES[@]}"; do
            found=false
            for matrix_mod in "${MATRIX_MODULES[@]}"; do
              if [[ "$mod" == "$matrix_mod" ]]; then
                found=true
                break
              fi
            done
            if [[ "$found" == "false" ]]; then
              MISSING+=("$mod")
            fi
          done

          if [[ ${#MISSING[@]} -gt 0 ]]; then
            echo "ERROR: The following go.mod files are not in the govulncheck matrix:"
            for m in "${MISSING[@]}"; do
              echo "  - $m"
            done
            echo ""
            echo "Add them to the 'matrix.module' list in .github/workflows/govulncheck.yaml"
            exit 1
          fi

          echo "All go.mod files are covered by the govulncheck matrix."