Ietf status list #601
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Pre-Release | |
| on: | |
| pull_request: | |
| types: | |
| - opened | |
| - synchronize | |
| - reopened | |
| - labeled | |
| - unlabeled | |
| branches: | |
| - main | |
| concurrency: | |
| group: pre-release-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| env: | |
| REGISTRY: quay.io | |
| REPOSITORY: fiware | |
| IMAGE_NAME: vcverifier | |
| jobs: | |
| generate-version: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| version: ${{ steps.out.outputs.version }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - id: bump | |
| uses: zwaldowski/match-label-action@v1 | |
| with: | |
| allowed: major,minor,patch | |
| - uses: zwaldowski/semver-release-action@v6 | |
| with: | |
| dry_run: true | |
| bump: ${{ steps.bump.outputs.match }} | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Set pre-release version | |
| id: out | |
| run: echo "version=${VERSION}-PRE-${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT | |
| build-scan-push: | |
| needs: generate-version | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: go.mod | |
| - name: Compile | |
| run: go build -o app . | |
| - uses: docker/setup-buildx-action@v4 | |
| - name: Build image for scanning | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: . | |
| load: true | |
| tags: local/${{ env.IMAGE_NAME }}:scan | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - uses: aquasecurity/trivy-action@v0.36.0 | |
| continue-on-error: true | |
| with: | |
| image-ref: local/${{ env.IMAGE_NAME }}:scan | |
| format: sarif | |
| output: trivy-results.sarif | |
| severity: CRITICAL,HIGH | |
| - uses: github/codeql-action/upload-sarif@v4 | |
| if: always() | |
| with: | |
| sarif_file: trivy-results.sarif | |
| - uses: docker/setup-qemu-action@v4 | |
| - uses: docker/login-action@v4 | |
| with: | |
| registry: quay.io | |
| username: ${{ secrets.QUAY_USERNAME }} | |
| password: ${{ secrets.QUAY_PASSWORD }} | |
| - uses: docker/build-push-action@v7 | |
| with: | |
| context: . | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: ${{ env.REGISTRY }}/${{ env.REPOSITORY }}/${{ env.IMAGE_NAME }}:${{ needs.generate-version.outputs.version }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| build-binaries: | |
| needs: generate-version | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| include: | |
| - goos: linux | |
| goarch: amd64 | |
| - goos: linux | |
| goarch: arm64 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: go.mod | |
| - name: Build binary | |
| env: | |
| CGO_ENABLED: "0" | |
| GOOS: ${{ matrix.goos }} | |
| GOARCH: ${{ matrix.goarch }} | |
| run: go build -ldflags="-s -w" -o vcverifier-${{ matrix.goos }}-${{ matrix.goarch }} . | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: vcverifier-${{ matrix.goos }}-${{ matrix.goarch }} | |
| path: vcverifier-${{ matrix.goos }}-${{ matrix.goarch }} | |
| retention-days: 1 | |
| git-release: | |
| needs: | |
| - generate-version | |
| - build-scan-push | |
| - build-binaries | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/download-artifact@v4 | |
| with: | |
| path: release-assets | |
| pattern: vcverifier-* | |
| merge-multiple: true | |
| - uses: marvinpinto/action-automatic-releases@latest | |
| with: | |
| repo_token: ${{ secrets.GITHUB_TOKEN }} | |
| automatic_release_tag: ${{ needs.generate-version.outputs.version }} | |
| prerelease: true | |
| title: ${{ needs.generate-version.outputs.version }} | |
| files: | | |
| LICENSE | |
| release-assets/vcverifier-* |