Skip to content

Commit e452f79

Browse files
vdekrijgervdekrijger
committed
chore: Add sane github workflows from the official farmework as well
1 parent 297129c commit e452f79

4 files changed

Lines changed: 164 additions & 19 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# See GitHub's documentation for more information on this file:
2+
# https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates
3+
version: 2
4+
updates:
5+
# Maintain dependencies for Go modules
6+
- package-ecosystem: "gomod"
7+
directory: "/"
8+
schedule:
9+
# Check for updates to Go modules every weekday
10+
interval: "daily"
11+
groups:
12+
# Group all terraform-plugin-(go|sdk|framework|testing) dependencies together
13+
"terraform-plugin":
14+
patterns:
15+
- "github.com/hashicorp/terraform-plugin-*"
16+
- package-ecosystem: "gomod"
17+
directory: "/tools"
18+
schedule:
19+
interval: "daily"
20+
- package-ecosystem: "github-actions"
21+
directory: "/"
22+
groups:
23+
"github-actions":
24+
patterns:
25+
- "*" # Group all GitHub Actions dependencies together
26+
schedule:
27+
interval: "weekly"
28+
day: "monday"
29+
time: "09:00"
30+
timezone: "Etc/UTC"

‎.github/workflows/release.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
# Terraform Provider release workflow.
2+
name: Release
3+
4+
# This GitHub action creates a release when a tag that matches the pattern
5+
# "v*" (e.g. v0.1.0) is created.
6+
on:
7+
push:
8+
tags:
9+
- 'v*'
10+
11+
# Releases need permissions to read and write the repository contents.
12+
# GitHub considers creating releases and uploading assets as writing contents.
13+
permissions:
14+
contents: write
15+
16+
jobs:
17+
# Run tests before releasing
18+
test:
19+
name: Test
20+
runs-on: ubuntu-latest
21+
timeout-minutes: 10
22+
steps:
23+
- uses: actions/checkout@v4
24+
- uses: actions/setup-go@v5
25+
with:
26+
go-version-file: "go.mod"
27+
cache: true
28+
- run: go mod download
29+
- run: go build -v .
30+
- name: Run unit tests
31+
run: go test -v -cover ./...
32+
33+
goreleaser:
34+
runs-on: ubuntu-latest
35+
steps:
36+
- uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
37+
with:
38+
# Allow goreleaser to access older tag information.
39+
fetch-depth: 0
40+
- uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
41+
with:
42+
go-version-file: 'go.mod'
43+
cache: true
44+
- name: Import GPG key
45+
uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v6.3.0
46+
id: import_gpg
47+
with:
48+
gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
49+
passphrase: ${{ secrets.PASSPHRASE }}
50+
- name: Run GoReleaser
51+
uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
52+
with:
53+
args: release --clean
54+
env:
55+
# GitHub sets the GITHUB_TOKEN secret automatically.
56+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
57+
GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}

‎.github/workflows/security.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# Security scanning workflow
2+
name: Security
3+
4+
on:
5+
push:
6+
branches:
7+
- main
8+
pull_request:
9+
branches:
10+
- main
11+
schedule:
12+
# Run weekly on Monday at 00:00 UTC
13+
- cron: "0 0 * * 1"
14+
15+
permissions:
16+
contents: read
17+
security-events: write
18+
19+
jobs:
20+
# Dependency vulnerability scanning
21+
govulncheck:
22+
name: Go Vulnerability Check
23+
runs-on: ubuntu-latest
24+
steps:
25+
- uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
26+
- uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
27+
with:
28+
go-version-file: 'go.mod'
29+
cache: true
30+
- name: Install govulncheck
31+
run: go install golang.org/x/vuln/cmd/govulncheck@latest
32+
- name: Run govulncheck
33+
run: govulncheck ./...
34+
35+
# Static analysis with gosec
36+
gosec:
37+
name: Security Scan (gosec)
38+
runs-on: ubuntu-latest
39+
steps:
40+
- uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
41+
- uses: securego/gosec@6be2b51fd78feca86af91f5186b7964d76cb1256 # v2.22.10
42+
with:
43+
# we let the report trigger content trigger a failure using the GitHub Security features.
44+
args: '-no-fail -fmt sarif -out results.sarif ./...'
45+
- name: Upload SARIF file
46+
uses: github/codeql-action/upload-sarif@ce729e4d353d580e6cacd6a8cf2921b72e5e310a # v2.23.6
47+
with:
48+
# Path to SARIF file relative to the root of the repository
49+
sarif_file: results.sarif
50+
51+
# Dependency review for PRs
52+
dependency-review:
53+
name: Dependency Review
54+
runs-on: ubuntu-latest
55+
if: github.event_name == 'pull_request'
56+
steps:
57+
- uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
58+
- uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2
59+
with:
60+
fail-on-severity: high

‎.github/workflows/test.yml‎

Lines changed: 17 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,17 @@
11
# Terraform Provider testing workflow.
22
name: Tests
33

4-
# This GitHub action runs your tests for each pull request and push.
5-
# Optionally, you can turn it on using a schedule for regular testing.
64
on:
75
pull_request:
86
paths-ignore:
9-
- 'README.md'
7+
- "README.md"
8+
- "docs/**"
109
push:
10+
branches:
11+
- main
1112
paths-ignore:
12-
- 'README.md'
13+
- "README.md"
14+
- "docs/**"
1315

1416
# Testing only needs permissions to read the repository contents.
1517
permissions:
@@ -22,23 +24,23 @@ jobs:
2224
runs-on: ubuntu-latest
2325
timeout-minutes: 5
2426
steps:
25-
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
26-
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
27+
- uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
28+
- uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
2729
with:
2830
go-version-file: 'go.mod'
2931
cache: true
3032
- run: go mod download
3133
- run: go build -v .
3234
- name: Run linters
33-
uses: golangci/golangci-lint-action@0a35821d5c230e903fcfe077583637dea1b27b47 # v9.0.0
35+
uses: golangci/golangci-lint-action@e7fa5ac41e1cf5b7d48e45e42232ce7ada589601 # v9.1.0
3436
with:
3537
version: latest
3638

3739
generate:
3840
runs-on: ubuntu-latest
3941
steps:
40-
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
41-
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
42+
- uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
43+
- uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
4244
with:
4345
go-version-file: 'go.mod'
4446
cache: true
@@ -47,7 +49,7 @@ jobs:
4749
with:
4850
terraform_wrapper: false
4951
- run: make generate
50-
- name: git diff
52+
- name: Check for uncommitted changes
5153
run: |
5254
git diff --compact-summary --exit-code || \
5355
(echo; echo "Unexpected difference in directories after code generation. Run 'make generate' command and commit."; exit 1)
@@ -61,16 +63,12 @@ jobs:
6163
strategy:
6264
fail-fast: false
6365
matrix:
64-
# list whatever Terraform versions here you would like to support
6566
terraform:
66-
- '1.0.*'
67-
- '1.1.*'
68-
- '1.2.*'
69-
- '1.3.*'
70-
- '1.4.*'
67+
- '1.13.*'
68+
- '1.14.*'
7169
steps:
72-
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
73-
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
70+
- uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
71+
- uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
7472
with:
7573
go-version-file: 'go.mod'
7674
cache: true
@@ -81,5 +79,5 @@ jobs:
8179
- run: go mod download
8280
- env:
8381
TF_ACC: "1"
84-
run: go test -v -cover ./internal/provider/
82+
run: go test -v -cover ./...
8583
timeout-minutes: 10

0 commit comments

Comments
 (0)