testing-PRs.yml

name: Test PRs
on:
  pull_request:
    types:
      - labeled
      - opened
      - edited
      - reopened
      - synchronize
      - ready_for_review

# Explicitly grant the `secrets.GITHUB_TOKEN` no permissions.
permissions: {}
jobs:
  AMD-test-via-docker:
    name: AMD64 - Build and test via Docker 🐳 images 📦
    runs-on: ubuntu-latest
    steps:
      - name: Setup Action
        uses: actions/checkout@v4.2.2
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3.7.1
      - name: Build alpine based image
        uses: docker/build-push-action@v6.9.0
        with:
          file: Dockerfile-alpine
          context: .
          push: false # DO NOT PUSH AS UNTRUSTED
          tags: |
            ghcr.io/richardoc/kube-audit-rest:test-alpine
          platforms: linux/amd64
          cache-from: type=gha
          cache-to: type=gha,mode=max
      - name: Build distroless image
        uses: docker/build-push-action@v6.9.0
        with:
          file: Dockerfile-distroless
          context: .
          push: false # DO NOT PUSH AS UNTRUSTED
          tags: |
            ghcr.io/richardoc/kube-audit-rest:test-distroless
            ghcr.io/richardoc/kube-audit-rest:latest
          platforms: linux/amd64
          cache-from: type=gha
          cache-to: type=gha,mode=max
  ARM-test-via-docker:
    name: ARM64 - Build and test via Docker 🐳 images 📦
    runs-on: ubuntu-latest
    steps:
      - name: Setup Action
        uses: actions/checkout@v4.2.2
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3.2.0
        with:
          platforms: 'arm64'
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3.7.1
      - name: Build alpine based image
        uses: docker/build-push-action@v6.9.0
        with:
          file: Dockerfile-alpine
          context: .
          push: false # DO NOT PUSH AS UNTRUSTED
          tags: |
            ghcr.io/richardoc/kube-audit-rest:test-alpine
          platforms: linux/arm64
          cache-from: type=gha
          cache-to: type=gha,mode=max
      - name: Build distroless image
        uses: docker/build-push-action@v6.9.0
        with:
          file: Dockerfile-distroless
          context: .
          push: false # DO NOT PUSH AS UNTRUSTED
          tags: |
            ghcr.io/richardoc/kube-audit-rest:test-distroless
            ghcr.io/richardoc/kube-audit-rest:latest
          platforms: linux/amd64,linux/arm64
          cache-from: type=gha
          cache-to: type=gha,mode=max
  execute-unittests:
    name: Execute the unittests
    runs-on: ubuntu-latest
    steps:
      - name: Setup Action
        uses: actions/checkout@v4.2.2

      - name: Set up Go
        uses: actions/setup-go@v5.1.0
        with:
          go-version: 1.22

      - name: Build
        run: go build -v ./...

      - name: Test
        run: go test -v ./...
  run-trivy:
    name: Run trivy
    runs-on: ubuntu-latest
    steps:
      - name: Setup Action
        uses: actions/checkout@v4.2.2
      - name: Run Trivy vulnerability scanner in fs mode
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'sarif'
          output: 'repo-results.sarif'
          exit-code: '1'
          severity: 'CRITICAL,HIGH'
  run-semgrep:
    name: Run Semgrep
    runs-on: ubuntu-latest
    steps:
      - name: Setup Action
        uses: actions/checkout@v4.2.2
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3.7.1
      - name: Run semgrep
        # excluding yamls due to false positives with the elasticsearch example for now
        run: docker run --rm -v "${PWD}:/src" returntocorp/semgrep:1.48.0-nonroot@sha256:572b06425becea5b9b26bcd01f78553383ab052debfeb2c57720cebd6999d964 semgrep ci --config auto  --exclude=*.yaml