static-analysis.yaml

name: Static Analysis and Report
on:
  push:
    branches:
      - main
  pull_request:
    types: [opened, synchronize, reopened]
  workflow_dispatch: {}

jobs:
  analyze:
    name: Static analysis
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repo
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version-file: "./go.mod"

      - name: Run unit tests
        run: go test -race -count=1 -vet=off -coverprofile=./cov.out ./...

      - name: Run gosec Security Scanner
        continue-on-error: true
        uses: securego/gosec@master
        with:
          args: -exclude-dir=testdata -exclude-dir=test -exclude-dir=blocktx/store/sql -exclude-generated -fmt=sonarqube -out gosec-report.json ./...

      - name: SonarCloud Scan
        uses: SonarSource/sonarcloud-github-action@master
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  staticcheck:
    name: Static check
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repo
        uses: actions/checkout@v4

      - name: Setup Go
        uses: actions/setup-go@v4
        with:
          go-version-file: "./go.mod"

      - name: staticcheck
        uses: dominikh/staticcheck-action@v1.3.0
        with:
          version: "2023.1.6"
          install-go: false

  lint:
    name: Golangci-lint
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repo
        uses: actions/checkout@v4

      - name: Setup Go
        uses: actions/setup-go@v4
        with:
          go-version-file: "./go.mod"
          cache: false

      - name: golangci-lint
        uses: golangci/golangci-lint-action@v3
        with:
          version: v1.60.1