-
Notifications
You must be signed in to change notification settings - Fork 68
70 lines (63 loc) · 2.09 KB
/
report.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
---
name: Reporting
on:
push:
branches:
- devel
- release-*
permissions: {}
jobs:
unit-coverage:
name: Go Unit Test Coverage
if: github.repository_owner == 'submariner-io'
runs-on: ubuntu-latest
steps:
- name: Check out the repository
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with:
fetch-depth: 0
- name: Run Go unit tests
run: make unit
- name: Run SonarScan, upload Go test results and coverage
uses: sonarsource/sonarcloud-github-action@383f7e52eae3ab0510c3cb0e7d9d150bbaeab838
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
variant-analysis:
name: Variant Analysis
runs-on: ubuntu-latest
permissions:
security-events: write
steps:
- name: Check out the repository
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
- name: Initialize CodeQL
uses: github/codeql-action/init@f09c1c0a94de965c15400f5634aa42fac8fb8f88
with:
languages: go
- name: Run CodeQL variant analysis
uses: github/codeql-action/analyze@f09c1c0a94de965c15400f5634aa42fac8fb8f88
- name: Show CodeQL scan SARIF report
if: always()
run: cat ../results/go.sarif
vulnerability-scan:
name: Vulnerability Scanning
if: github.repository_owner == 'submariner-io'
runs-on: ubuntu-latest
permissions:
security-events: write
steps:
- name: Check out the repository
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
- name: Run Anchore vulnerability scanner
uses: anchore/scan-action@869c549e657a088dc0441b08ce4fc0ecdac2bb65
id: scan
with:
path: "."
fail-build: false
- name: Show Anchore scan SARIF report
run: cat ${{ steps.scan.outputs.sarif }}
- name: Upload Anchore scan SARIF report
uses: github/codeql-action/upload-sarif@f09c1c0a94de965c15400f5634aa42fac8fb8f88
with:
sarif_file: ${{ steps.scan.outputs.sarif }}