ci: pin goreleaser-action to v5.1.0 SHA (#244) #945
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| branches: [ main, 'release/**' ] | |
| push: | |
| branches: [ main, 'release/**' ] | |
| env: | |
| GO_VERSION: '1.26.6' | |
| GOFLAGS: '-trimpath' | |
| permissions: | |
| contents: read | |
| jobs: | |
| secret-detection: | |
| name: Secret Detection | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 # Fetch full history for comprehensive scanning | |
| - name: Set up Python | |
| run: | | |
| # Ensure Python and pip are available | |
| python3 --version | |
| pip3 --version | |
| - name: Install detect-secrets | |
| run: | | |
| # Install detect-secrets from PyPI with user flag to avoid permission issues | |
| pip3 install --user detect-secrets | |
| # Add user bin to PATH | |
| echo "$HOME/.local/bin" >> $GITHUB_PATH | |
| - name: Run detect-secrets scan | |
| run: | | |
| # Scan for new secrets not in baseline | |
| echo "Scanning for secrets..." | |
| if detect-secrets scan --baseline .secrets.baseline --all-files; then | |
| echo "No new secrets detected!" | |
| else | |
| echo "New secrets detected!" | |
| echo "::error::New secrets found that are not in the baseline" | |
| echo "" | |
| echo "To fix this:" | |
| echo "1. Review the detected secrets above" | |
| echo "2. If they are false positives, run: detect-secrets scan --update .secrets.baseline" | |
| echo "3. If they are real secrets, remove them from the code" | |
| echo "4. Commit the updated .secrets.baseline file" | |
| exit 1 | |
| fi | |
| lint: | |
| name: Lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Set up Go | |
| uses: actions/setup-go@v4 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| - name: Download dependencies | |
| run: go mod download | |
| - name: Clean previous lint cache | |
| run: | | |
| rm -rf ~/.cache/golangci-lint || true | |
| mkdir -p ~/.cache/golangci-lint | |
| - name: Run golangci-lint | |
| uses: golangci/golangci-lint-action@v8 | |
| with: | |
| version: latest | |
| args: --timeout=5m | |
| # otelcol/auth/sakauth is a separate Go module, so the root run above does | |
| # not descend into it. It resolves the same root .golangci.yml. | |
| - name: Run golangci-lint (sakauth module) | |
| uses: golangci/golangci-lint-action@v8 | |
| with: | |
| version: latest | |
| working-directory: otelcol/auth/sakauth | |
| args: --timeout=5m | |
| - name: Check license headers in third_party | |
| run: | | |
| missing=$(find third_party -name "*.go" | xargs grep -rL "Copyright\|SPDX" 2>/dev/null) | |
| if [ -n "$missing" ]; then | |
| echo "ERROR: missing license header in:" | |
| echo "$missing" | sed 's/^/ /' | |
| exit 1 | |
| fi | |
| - name: Run govulncheck | |
| run: make vuln | |
| unit_test: | |
| name: Unit Tests | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Set up Go | |
| uses: actions/setup-go@v4 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| - name: Download dependencies | |
| run: go mod download | |
| - name: Clean previous test artifacts | |
| run: | | |
| rm -rf ./coverage || true | |
| mkdir -p ./coverage | |
| - name: Run unit tests | |
| run: make test | |
| - name: Upload coverage to Codecov | |
| uses: codecov/codecov-action@v5 | |
| with: | |
| # "file" was renamed to "files" in v5. | |
| files: ./coverage/coverage.out | |
| flags: unittests | |
| name: codecov-umbrella | |
| # Coverage upload is informational; a Codecov outage must not fail CI. | |
| fail_ci_if_error: false | |
| build_check: | |
| name: Build Check | |
| runs-on: ubuntu-latest | |
| needs: [lint] | |
| strategy: | |
| matrix: | |
| goos: [linux] | |
| goarch: [amd64, arm64] | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Set up Go | |
| uses: actions/setup-go@v4 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| - name: Download dependencies | |
| run: go mod download | |
| - name: Install ARM64 cross compiler | |
| if: matrix.goarch == 'arm64' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu | |
| - name: Clean previous build artifacts | |
| run: | | |
| rm -f fleetint-${{ matrix.goos }}-${{ matrix.goarch }} || true | |
| - name: Build all packages | |
| env: | |
| GOOS: ${{ matrix.goos }} | |
| GOARCH: ${{ matrix.goarch }} | |
| CGO_ENABLED: 1 | |
| CC: ${{ matrix.goarch == 'arm64' && 'aarch64-linux-gnu-gcc' || 'gcc' }} | |
| CXX: ${{ matrix.goarch == 'arm64' && 'aarch64-linux-gnu-g++' || 'g++' }} | |
| run: go build ./... | |
| - name: Smoke build main binary | |
| env: | |
| GOOS: ${{ matrix.goos }} | |
| GOARCH: ${{ matrix.goarch }} | |
| CGO_ENABLED: 1 | |
| CC: ${{ matrix.goarch == 'arm64' && 'aarch64-linux-gnu-gcc' || 'gcc' }} | |
| CXX: ${{ matrix.goarch == 'arm64' && 'aarch64-linux-gnu-g++' || 'g++' }} | |
| run: go build -o fleetint-${{ matrix.goos }}-${{ matrix.goarch }} ./cmd/fleetint | |
| - name: Upload build artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: fleetint-${{ matrix.goos }}-${{ matrix.goarch }} | |
| path: fleetint-${{ matrix.goos }}-${{ matrix.goarch }} | |
| retention-days: 7 | |
| build_check_otelcol: | |
| name: Build Check (otelcol) | |
| runs-on: ubuntu-latest | |
| needs: [lint] | |
| strategy: | |
| matrix: | |
| goarch: [amd64, arm64] | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| # This job installs and executes third-party tooling (the OTel | |
| # Collector Builder and its transitive dependencies). Do not leave | |
| # GITHUB_TOKEN in the git config where that tooling can read it. | |
| persist-credentials: false | |
| - name: Set up Go | |
| uses: actions/setup-go@v4 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| - name: Install OTel Collector Builder | |
| run: go install go.opentelemetry.io/collector/cmd/builder@v0.156.0 | |
| - name: Build fleetint-otelcol | |
| working-directory: otelcol | |
| env: | |
| GOOS: linux | |
| GOARCH: ${{ matrix.goarch }} | |
| CGO_ENABLED: 0 | |
| run: builder --config=otelcol-builder.yaml | |
| # The sakauth unit and config tests run in the unit_test job, since | |
| # `make test` now descends into the nested module. This step covers only | |
| # the integration test, which needs the collector binary built above and | |
| # self-skips without FLEETINT_OTELCOL_INTEGRATION=1. | |
| # Only on amd64: the runner cannot execute arm64 test binaries. | |
| - name: Run OTel gateway integration test | |
| if: matrix.goarch == 'amd64' | |
| working-directory: otelcol/auth/sakauth | |
| env: | |
| FLEETINT_OTELCOL_INTEGRATION: "1" | |
| run: go test -race -run '^TestCollectorGatewayEndToEnd$' . | |
| codeql: | |
| name: CodeQL Analysis | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Go | |
| uses: actions/setup-go@v4 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| - name: Download dependencies | |
| run: go mod download | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v4 | |
| with: | |
| languages: go | |
| build-mode: manual | |
| env: | |
| CODEQL_EXTRACTOR_GO_BUILD_TRACING: on | |
| - name: Build with CodeQL | |
| run: go build ./... | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v4 | |
| with: | |
| category: "/language:go" |