noir/.github/workflows/ci.yml at 58386e73db5cc2f88067b76c91861b04a7493c66 · owasp-noir/noir · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
---
name: CI
on:
  pull_request:
    branches: [main]
    paths:
      - .github/workflows/ci.yml
      - shard.yml
      - shard.lock
      - Dockerfile
      - "**/*.cr"
      # The GitHub Action runtime (composite wrapper + container entrypoint)
      # ships from this repo too, so changes to it must exercise the
      # test-action job below.
      - action.yml
      - github-action/**
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      logLevel:
        description: manual run
        required: false
        default: ""
jobs:
  build-crystal:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        crystal-version: [1.21.0]
    steps:
      - uses: actions/checkout@v7
      - uses: crystal-lang/install-crystal@v1
        with:
          crystal: ${{ matrix.crystal-version }}
      - name: Install dependencies
        run: shards install
      - name: Build
        run: shards build
  build-docker:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        arch: [linux/amd64, linux/arm64]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
      - name: Install cosign
        if: github.event_name != 'pull_request'
        uses: sigstore/cosign-installer@v4.1.2
        with:
          cosign-release: v2.1.1
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4
      - name: Setup Docker buildx
        uses: docker/setup-buildx-action@v4
      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ghcr.io/${{ github.repository }}
      - name: Build Docker image
        id: build-and-push
        uses: docker/build-push-action@v7
        with:
          context: .
          push: false
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          platforms: ${{ matrix.arch }}
          cache-from: type=gha,scope=${{ matrix.arch }}
          cache-to: type=gha,mode=max,scope=${{ matrix.arch }}
  test-action:
    # End-to-end coverage for the GitHub Action runtime. The composite
    # action `docker pull`s a pre-built published image and build-docker
    # above never runs the container, so entrypoint.sh would otherwise ship
    # untested. Build the image from the current tree and drive the
    # entrypoint exactly as action.yml does, asserting the output contract.
    name: GitHub Action entrypoint (e2e)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
      - name: Unit-test image tag resolver
        run: bash github-action/test-resolve-image-tag.sh
      - name: Setup Docker buildx
        uses: docker/setup-buildx-action@v4
      - name: Build action image from current tree
        uses: docker/build-push-action@v7
        with:
          context: .
          file: Dockerfile
          load: true
          platforms: linux/amd64
          tags: noir-action:ci
          cache-from: type=gha,scope=action-ci
          cache-to: type=gha,mode=max,scope=action-ci
      - name: Run entrypoint end-to-end
        run: bash github-action/test-entrypoint.sh noir-action:ci
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: crystal-lang/install-crystal@v1
        with:
          crystal: 1.21.0
      - name: Install dependencies
        run: shards install
      - name: Run Ameba linter
        # Run the Ameba pinned in shard.lock rather than
        # crystal-ameba/github-action@master, whose image tracks an
        # unreleased Ameba dev build. A dev build added Style/HeredocIndent
        # (and tightened Lint/UselessAssign), failing CI on unrelated,
        # already-merged code. shard.lock keeps the rule set stable and
        # reproducible with local `ameba` runs.
        run: crystal run lib/ameba/bin/ameba.cr
  tests:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        crystal-version: [1.21.0]
    steps:
      - uses: actions/checkout@v7
      - uses: crystal-lang/install-crystal@v1
        with:
          crystal: ${{ matrix.crystal-version }}
      - name: Install dependencies
        run: shards install
      - name: Run unit tests
        run: crystal spec spec/unit_test
      - name: Run functional tests
        run: crystal spec spec/functional_test
  build-snapcraft:
    if: github.event_name == 'push' && github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        platform: [amd64]
    steps:
      - name: Check out Git repository
        uses: actions/checkout@v7
      - name: Build snapcraft package
        uses: canonical/action-build@v1
        id: build