pull_request.yaml

name: Validate on Pull Request

on:
  workflow_dispatch:
  pull_request:
    types: [ opened, reopened, synchronize ]

jobs:
  lint:
    name: Lint files
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v4
        with:
          go-version: '1.23.2'
      - name: golangci-lint
        uses: golangci/golangci-lint-action@v3
        with:
          version: latest
          skip-cache: true
          args: --timeout=30m

  test:
    name: Run tests
    runs-on: ubuntu-22.04
    needs: lint
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v4
        with:
          go-version: '1.23.2'
      - run: go test -v -cover ./...

  security-checks:
    runs-on: ubuntu-24.04
    needs: test
    permissions:
      contents: read
      packages: write
      id-token: write
    steps:
      - name: Get Branch Name
        shell: bash
        run: |
          echo "branch_name=${{ github.event.pull_request.head.ref }}" >> "$GITHUB_ENV"
      - name: Build Local Baski Image
        uses: drewbernetes/container-security-action@v0.0.4
        id: build-and-scan-baski
        with:
          image-repo: "drewviles"
          repo-username: ${{ secrets.DOCKER_USER }}
          repo-password: ${{ secrets.DOCKER_PASSWORD }}
          image-name: baski
          image-tag: ${{ env.branch_name }}
          check-severity: "HIGH,CRITICAL"
          trivyignore-from-s3: true
          s3-endpoint: "https://api.s3.hudson-viles.uk/"
          s3-access-key: ${{secrets.S3_ACCESS_KEY}}
          s3-secret-key: ${{secrets.S3_SECRET_KEY}}
          s3-bucket: "trivyignores"
          s3-path: "baski"
          add-latest-tag: false
          publish-image: false
          cosign-private-key: ${{secrets.COSIGN_KEY}}
          cosign-password: ${{secrets.COSIGN_PASSWORD}}
          cosign-tlog: false
          dockerfile-path: docker