prometheus-command-timer/.github/workflows/ci.yml at main · meysam81/prometheus-command-timer · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
name: ci

on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main
    tags:
      - v*

permissions:
  contents: write
  id-token: write
  packages: write
  security-events: write

jobs:
  build-edge:
    if: |
      github.event_name == 'push' &&
      github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - name: Build docker
        uses: meysam81/build-docker@main
        with:
          image-name: ghcr.io/meysam81/${{ github.event.repository.name }}
          image-extra-tags: |
            ghcr.io/meysam81/${{ github.event.repository.name }}:${{ github.run_id }}
            ghcr.io/meysam81/${{ github.event.repository.name }}:nightly
            ghcr.io/meysam81/${{ github.event.repository.name }}:latest
          kubescape: true
          kubescape-upload-sarif: true

  build-pr:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - name: Build docker
        uses: meysam81/build-docker@main
        with:
          image-name: ghcr.io/meysam81/${{ github.event.repository.name }}
          kubescape: true
          scout-comment-pr: true
          scout-compare: true
          scout-cves: true

  semantic-release:
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
      issues: write
      pull-requests: write
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          ssh-key: ${{ secrets.GH_DEPLOY_KEY }}
      - name: Setup bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest
      - name: Install bun deps
        run: bun install
      - name: Install syft
        uses: anchore/sbom-action/download-syft@v0
      - name: Setup Cosign CLI
        uses: sigstore/cosign-installer@v3
      - name: Install goreleaser
        run: |
          echo 'deb [trusted=yes] https://repo.goreleaser.com/apt/ /' | sudo tee /etc/apt/sources.list.d/goreleaser.list
          sudo apt update
          sudo apt install -y goreleaser
          goreleaser --version
      - id: semantic-release
        name: Release
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: bunx semantic-release@v24
      - if: steps.semantic-release.outputs.version != ''
        name: Extract semver major version
        id: semver
        run: |
          major=$(echo "${{ steps.semantic-release.outputs.version }}" | cut -d. -f1)
          echo "major=${major}" >> "$GITHUB_OUTPUT"
      - if: steps.semantic-release.outputs.version != ''
        name: Build docker
        uses: meysam81/build-docker@main
        with:
          cosign: true
          build-args: |
            VERSION=${{ steps.semantic-release.outputs.version }}
          image-name: ghcr.io/meysam81/${{ github.event.repository.name }}
          image-extra-tags: |
            ghcr.io/meysam81/${{ github.event.repository.name }}:${{ steps.semantic-release.outputs.version }}
            ghcr.io/meysam81/${{ github.event.repository.name }}:${{ steps.semver.outputs.major }}
            ghcr.io/meysam81/${{ github.event.repository.name }}:stable
          metadata-tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
          ref: ${{ steps.semantic-release.outputs.version }}
          kubescape: true