drogonsec/.github/workflows/ci.yml at bbd19861c99656fe09dbe96b9df5839c7f866911 · filipi86/drogonsec · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
name: CI/CD Pipeline

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]
  release:
    types: [ created ]

permissions:
  contents: read
  security-events: write  # Required for SARIF upload

jobs:
  # ============ BUILD & TEST ============
  build-test:
    name: Build & Test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: '1.22'
          cache: true

      - name: Download dependencies
        run: go mod download

      - name: Run go vet
        run: go vet ./...

      - name: Run tests
        run: go test ./... -v -race -coverprofile=coverage.out -covermode=atomic

      - name: Upload coverage
        uses: codecov/codecov-action@v4
        with:
          file: ./coverage.out

      - name: Build binary
        run: make build

  # ============ LINT ============
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: '1.22'
          cache: true
      - name: Run golangci-lint
        uses: golangci/golangci-lint-action@v4
        with:
          version: latest

  # ============ SECURITY SCAN (Dogfooding - DragonSec scanning itself) ============
  security-scan:
    name: Security Scan (DragonSec)
    runs-on: ubuntu-latest
    needs: build-test
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: '1.22'
          cache: true

      - name: Build DragonSec
        run: make build

      - name: Scan with DragonSec (SARIF output)
        run: |
          ./bin/drogonsec scan . \
            --format sarif \
            --output drogonsec.sarif \
            --severity MEDIUM \
            --no-ai

      - name: Upload SARIF to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: drogonsec.sarif
        continue-on-error: true

  # ============ RELEASE ============
  release:
    name: Release Binaries
    runs-on: ubuntu-latest
    needs: [ build-test, lint ]
    if: github.event_name == 'release'
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: '1.22'

      - name: Build all platforms
        run: make release

      - name: Create checksums
        run: |
          cd bin
          sha256sum drogonsec-* > SHA256SUMS.txt

      - name: Upload release assets
        uses: softprops/action-gh-release@v2
        with:
          files: |
            bin/drogonsec-linux-amd64
            bin/drogonsec-darwin-amd64
            bin/drogonsec-darwin-arm64
            bin/drogonsec-windows-amd64.exe
            bin/SHA256SUMS.txt

  # ============ DOCKER ============
  docker:
    name: Build & Push Docker
    runs-on: ubuntu-latest
    needs: [ build-test ]
    if: github.ref == 'refs/heads/main' || github.event_name == 'release'
    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: |
            ghcr.io/${{ github.repository }}:latest
            ghcr.io/${{ github.repository }}:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max