Skip to content

Commit 9c4dae0

Browse files
mprimeauxmprimeaux
committed
feature: Initial commit
1 parent 80b4d9e commit 9c4dae0

95 files changed

Lines changed: 25454 additions & 9 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/ci.yaml‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
# Copyright (c) 2024 Six After, Inc
2+
#
3+
# This source code is licensed under the Apache 2.0 License found in the
4+
# LICENSE file in the root directory of this source tree.
5+
6+
# Ref: https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions
7+
name: ci
8+
9+
on:
10+
workflow_dispatch:
11+
12+
push:
13+
branches:
14+
- main
15+
16+
pull_request:
17+
branches:
18+
- main
19+
20+
paths-ignore:
21+
- 'CHANGELOG/**'
22+
- 'CODEOWNERS'
23+
- 'docs/**'
24+
- 'LICENSE'
25+
- '**/*.md'
26+
27+
# Declare default permissions as read only.
28+
permissions: read-all
29+
30+
jobs:
31+
ci:
32+
permissions:
33+
contents: read # Required for checking out the repo
34+
pull-requests: read # Needed for reading PR details
35+
checks: write # Needed for creating status checks
36+
runs-on: ubuntu-latest
37+
env:
38+
flags: ""
39+
steps:
40+
- name: Preamble
41+
run: |
42+
whoami
43+
echo github ref $GITHUB_REF
44+
echo workflow $GITHUB_WORKFLOW
45+
echo home $HOME
46+
echo event name $GITHUB_EVENT_NAME
47+
echo workspace $GITHUB_WORKSPACE
48+
49+
df -h
50+
51+
sudo DEBIAN_FRONTEND=noninteractive apt-get update
52+
sudo DEBIAN_FRONTEND=noninteractive apt-get install -y software-properties-common ca-certificates gnupg-agent curl build-essential make
53+
54+
# Ref: https://github.com/actions/checkout
55+
- name: Checkout Source
56+
uses: actions/checkout@v4
57+
with:
58+
fetch-depth: 0
59+
60+
# Ref: https://github.com/actions/setup-go
61+
- name: Install Go
62+
uses: actions/setup-go@v5
63+
with:
64+
go-version-file: go.mod
65+
66+
# Ref: https://github.com/golangci/golangci-lint-action
67+
- name: Lint
68+
uses: golangci/golangci-lint-action@v8
69+
with:
70+
args: --timeout=30m --config=.golangci.yaml --issues-exit-code=0
71+
72+
- name: Test
73+
run: |
74+
make test
75+
76+
- name: Cover
77+
run: |
78+
make cover
79+
80+
- name: Analyze
81+
run: |
82+
make analyze
83+
84+
# Ref: https://github.com/actions/cache
85+
- name: Cache SonarQube Packages
86+
uses: actions/cache@v4
87+
with:
88+
path: ~/.sonar/cache
89+
key: ${{ runner.os }}-sonar
90+
restore-keys: ${{ runner.os }}-sonar-
91+
92+
# Ref: https://github.com/SonarSource/sonarqube-scan-action
93+
- name: Scan with SonarQube
94+
uses: sonarsource/sonarqube-scan-action@v5
95+
with:
96+
projectBaseDir: ./
97+
env:
98+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
99+
GITHUB_USER: ${{ github.actor }}
100+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
101+
102+
- name: Benchmark Tests
103+
run: |
104+
make bench

‎.github/workflows/codeql-analysis.yaml‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
# Copyright (c) 2024 Six After, Inc
2+
#
3+
# This source code is licensed under the Apache 2.0 License found in the
4+
# LICENSE file in the root directory of this source tree.
5+
6+
# Ref: https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions
7+
name: "CodeQL Analysis"
8+
9+
permissions:
10+
contents: read
11+
12+
on:
13+
workflow_dispatch:
14+
15+
push:
16+
branches:
17+
- main
18+
19+
paths-ignore:
20+
- 'CHANGELOG/**'
21+
- 'CODEOWNERS'
22+
- 'docs/**'
23+
- 'LICENSE'
24+
- '**/*.md'
25+
26+
schedule:
27+
# * * * * * <command to execute>
28+
# | | | | |
29+
# | | | | day of the week (0–6) (Sunday to Saturday;
30+
# | | | month (1–12) 7 is also Sunday on some systems)
31+
# | | day of the month (1–31)
32+
# | hour (0–23)
33+
# minute (0–59)
34+
- cron: '0 0 * * 3'
35+
36+
jobs:
37+
analyze:
38+
runs-on: ubuntu-latest
39+
40+
strategy:
41+
matrix:
42+
include:
43+
- language: go
44+
45+
permissions:
46+
security-events: write
47+
48+
steps:
49+
- name: Preamble
50+
run: |
51+
whoami
52+
echo github ref $GITHUB_REF
53+
echo workflow $GITHUB_WORKFLOW
54+
echo home $HOME
55+
echo event name $GITHUB_EVENT_NAME
56+
echo workspace $GITHUB_WORKSPACE
57+
58+
df -h
59+
60+
sudo DEBIAN_FRONTEND=noninteractive apt-get update
61+
sudo DEBIAN_FRONTEND=noninteractive apt-get install -y software-properties-common ca-certificates gnupg-agent curl build-essential make
62+
63+
# Ref: https://github.com/actions/checkout
64+
- name: Checkout Source
65+
uses: actions/checkout@v4
66+
with:
67+
fetch-depth: 0
68+
69+
# Ref: https://github.com/actions/setup-go
70+
- name: Install Go
71+
uses: actions/setup-go@v5
72+
with:
73+
go-version-file: go.mod
74+
75+
# Ref: https://github.com/github/codeql-action
76+
- name: Initialize CodeQL
77+
uses: github/codeql-action/init@v3
78+
with:
79+
languages: ${{ matrix.language }}
80+
build-mode: ${{ matrix.build-mode }}
81+
82+
- name: Autobuild
83+
uses: github/codeql-action/autobuild@v3
84+
85+
- name: Perform CodeQL Analysis
86+
uses: github/codeql-action/analyze@v3

‎.github/workflows/release.yaml‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
# Copyright (c) 2024 Six After, Inc
2+
#
3+
# This source code is licensed under the Apache 2.0 License found in the
4+
# LICENSE file in the root directory of this source tree.
5+
6+
# Ref: https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions
7+
name: release
8+
9+
on:
10+
workflow_dispatch:
11+
12+
push:
13+
tags: ['v*']
14+
15+
# Declare default permissions as read only.
16+
permissions: read-all
17+
18+
jobs:
19+
release:
20+
# Ref: https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#permissions
21+
permissions:
22+
contents: write
23+
id-token: write
24+
packages: write
25+
pull-requests: read
26+
27+
runs-on: ubuntu-latest
28+
env:
29+
flags: ""
30+
steps:
31+
- name: "Preamble"
32+
run: |
33+
whoami
34+
echo github ref $GITHUB_REF
35+
echo workflow $GITHUB_WORKFLOW
36+
echo home $HOME
37+
echo event name $GITHUB_EVENT_NAME
38+
echo workspace $GITHUB_WORKSPACE
39+
40+
df -h
41+
42+
sudo DEBIAN_FRONTEND=noninteractive apt-get update
43+
sudo DEBIAN_FRONTEND=noninteractive apt-get install -y software-properties-common ca-certificates gnupg-agent curl build-essential make
44+
45+
# Ref: https://github.com/actions/checkout
46+
- name: "Checkout Source"
47+
uses: actions/checkout@v4
48+
with:
49+
fetch-depth: 0
50+
51+
# Ref: https://github.com/actions/setup-go
52+
- name: "Install Go"
53+
uses: actions/setup-go@v5
54+
with:
55+
go-version-file: go.mod
56+
57+
- name: "Compute Release Flags"
58+
if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
59+
run: echo "flags=--snapshot" >> $GITHUB_ENV
60+
61+
# Ref: https://github.com/sigstore/cosign-installer
62+
- name: Install Cosign
63+
uses: sigstore/cosign-installer@v3.9.1
64+
65+
# Ref: https://github.com/anchore/sbom-action
66+
- name: Generate SBOM via Syft
67+
uses: anchore/sbom-action@v0
68+
with:
69+
format: spdx-json
70+
artifact-name: sbom.spdx.json
71+
72+
# Ref: https://github.com/goreleaser/goreleaser-action
73+
- name: "Release"
74+
uses: goreleaser/goreleaser-action@v6
75+
with:
76+
version: latest
77+
args: release --clean ${{ env.flags }}
78+
env:
79+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
80+
COSIGN_PASSWORD: '${{ secrets.AES_CTR_DRBG_COSIGN_PASSWORD }}'
81+
COSIGN_PRIVATE_KEY: '${{ secrets.AES_CTR_DRBG_COSIGN_PRIVATE_KEY }}'
82+
COSIGN_PUBLIC_KEY: '${{ secrets.AES_CTR_DRBG_COSIGN_PUBLIC_KEY }}'

‎.github/workflows/scorecard.yml‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
# This workflow uses actions that are not certified by GitHub. They are provided
2+
# by a third-party and are governed by separate terms of service, privacy
3+
# policy, and support documentation.
4+
5+
name: OSSF Supply Chain Security Scorecard
6+
on:
7+
workflow_dispatch:
8+
9+
# For Branch-Protection check. Only the default branch is supported. See
10+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
11+
branch_protection_rule:
12+
# To guarantee Maintained check is occasionally updated. See
13+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
14+
schedule:
15+
- cron: '18 16 * * 4'
16+
push:
17+
branches: [ "main" ]
18+
19+
# Declare default permissions as read only.
20+
permissions: read-all
21+
22+
jobs:
23+
analysis:
24+
name: Scorecard analysis
25+
runs-on: ubuntu-latest
26+
# `publish_results: true` only works when run from the default branch. conditional can be removed if disabled.
27+
if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request'
28+
permissions:
29+
# Needed to upload the results to code-scanning dashboard.
30+
security-events: write
31+
# Needed to publish results and get a badge (see publish_results below).
32+
id-token: write
33+
# Uncomment the permissions below if installing in a private repository.
34+
# contents: read
35+
# actions: read
36+
37+
steps:
38+
# Ref: https://github.com/actions/checkout
39+
- name: "Checkout code"
40+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
41+
with:
42+
persist-credentials: false
43+
44+
# Ref: https://github.com/ossf/scorecard-action
45+
- name: "Run analysis"
46+
uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
47+
with:
48+
results_file: results.sarif
49+
results_format: sarif
50+
# (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
51+
# - you want to enable the Branch-Protection check on a *public* repository, or
52+
# - you are installing Scorecard on a *private* repository
53+
# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
54+
# repo_token: ${{ secrets.SCORECARD_TOKEN }}
55+
56+
# Public repositories:
57+
# - Publish results to OpenSSF REST API for easy access by consumers
58+
# - Allows the repository to include the Scorecard badge.
59+
# - See https://github.com/ossf/scorecard-action#publishing-results.
60+
# For private repositories:
61+
# - `publish_results` will always be set to `false`, regardless
62+
# of the value entered here.
63+
publish_results: true
64+
65+
# (Optional) Uncomment file_mode if you have a .gitattributes with files marked export-ignore
66+
# file_mode: git
67+
68+
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
69+
# format to the repository Actions tab.
70+
- name: "Upload artifact"
71+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
72+
with:
73+
name: SARIF file
74+
path: results.sarif
75+
retention-days: 5
76+
77+
# Upload the results to GitHub's code scanning dashboard (optional).
78+
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
79+
- name: "Upload to code-scanning"
80+
uses: github/codeql-action/upload-sarif@v3
81+
with:
82+
sarif_file: results.sarif

‎.gitignore‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -11,11 +11,10 @@
1111
# Test binary, built with `go test -c`
1212
*.test
1313

14-
# Code coverage profiles and other test artifacts
14+
# Output of the go coverage tool, specifically when used with LiteIDE
1515
*.out
16-
coverage.*
17-
*.coverprofile
18-
profile.cov
16+
coverage.json
17+
testdata/
1918

2019
# Dependency directories (remove the comment below to include it)
2120
# vendor/
@@ -27,6 +26,7 @@ go.work.sum
2726
# env file
2827
.env
2928

30-
# Editor/IDE
31-
# .idea/
32-
# .vscode/
29+
.idea/
30+
.DS_Store
31+
32+
dist/

0 commit comments

Comments
 (0)