test.yml

name: Test and build
on:
  pull_request:
    types:
    - opened
  push:

jobs:
  tests:
    name: Test
    strategy:
      matrix:
        go_version:
        - "1.22"
        - "1.23"
        - "1.24"
    runs-on: ubuntu-latest
    steps:
    - name: Checkout repository
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        show-progress: false
    - name: Use golang ${{ matrix.go_version }}
      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
      with:
        go-version: ${{ matrix.go_version }}
        check-latest: true
    - name: Go get dependencies
      run: go get -v -t -d ./...
    - name: Run tests
      run: make coverage
    - name: Send the coverage output
      uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b # v2.3.6
      with:
        flag-name: go-${{ join(matrix.*, '-') }}
        parallel: true
        file: coverage.out

  post-tests:
    needs: tests
    runs-on: ubuntu-latest
    steps:
    - name: Coveralls Finished
      uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b # v2.3.6
      with:
        parallel-finished: true

  test-latest:
    name: Test latest
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
    - name: Checkout repository
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        show-progress: false
    - name: Use golang stable
      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
      with:
        go-version: stable
        check-latest: true
    - name: Go get dependencies
      run: go get -v -t -d ./...
    - name: Run tests
      run: make coverage

  bench:
    name: Benchmark
    runs-on: ubuntu-latest
    steps:
    - name: Checkout repository
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        show-progress: false
    - name: Setup golang
      uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
      with:
        go-version-file: go.mod
        check-latest: true
    - name: Run benchmark
      run: make bench | tee output.txt; exit ${PIPESTATUS[0]}
    - name: Download previous benchmark data
      uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
      with:
        path: ./cache
        key: ${{ runner.os }}-benchmark
    - name: Store benchmark result
      uses: benchmark-action/github-action-benchmark@d48d326b4ca9ba73ca0cd0d59f108f9e02a381c7 # v1.20.4
      with:
        tool: go
        output-file-path: ./output.txt
        external-data-json-path: ./cache/benchmark-data.json
        comment-on-alert: false
        fail-on-alert: true
    # only execute this step when cache was restored
    # do not fail hard here, as the key might not exist
    - name: Clear cache
      shell: bash
      if: ${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
      env:
        GH_TOKEN: ${{ github.token }}
      run: |
        gh extension install actions/gh-actions-cache
        gh actions-cache delete '${{ runner.os }}-benchmark' --confirm
      continue-on-error: true
    - name: Update benchmark data
      if: ${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
      uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
      with:
        path: ./cache
        key: ${{ runner.os }}-benchmark

  build:
    name: Build Docker Images
    runs-on: ubuntu-latest
    if: ${{ startsWith(github.ref, 'refs/tags/') || github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
    permissions:
      actions: read
      contents: write
      packages: write
      id-token: write
    steps:
    - name: Checkout code
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        show-progress: false
    - name: Docker Login to GitHub Repository
      uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    - name: Docker Login to DockerHub
      uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
      with:
        username: ${{ secrets.BOT_DOCKER_USERNAME }}
        password: ${{ secrets.BOT_DOCKER_TOKEN }}
    - name: Login to Mia registry
      uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
      with:
        registry: nexus.mia-platform.eu
        username: ${{ secrets.MIA_PLATFORM_DOCKER_REGISTRY_USERNAME }}
        password: ${{ secrets.MIA_PLATFORM_DOCKER_REGISTRY_PASSWORD }}
    - name: Install Cosign
      uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
    - name: Set up QEMU
      uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
      with:
        platforms: amd64,arm64
    - name: Configure docker metadata
      id: meta
      uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
      env:
        DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
      with:
        images: |
          ghcr.io/rond-authz/rond
          docker.io/rondauthz/rond
          nexus.mia-platform.eu/rond-authz/rond
        tags: |
          type=ref,event=branch
          type=semver,pattern={{version}}
          type=semver,pattern={{major}}.{{minor}}
          type=semver,pattern={{major}}
        labels: |
          org.opencontainers.image.documentation=https://rond-authz.io
          org.opencontainers.image.vendor=rond authz
        annotations: |
          org.opencontainers.image.documentation=https://rond-authz.io
          org.opencontainers.image.vendor=rond authz
    - name: Setup Buildx Context
      uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
      id: buildx
      with:
        platforms: linux/amd64,linux/arm64
    - name: Build and push
      id: docker-build
      uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
      with:
        context: .
        push: true
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        annotations: ${{ steps.meta.output.annotations }}
        platforms: ${{ steps.buildx.outputs.platforms }}
        cache-from: type=gha
        cache-to: type=gha,mode=max
    - name: Generate SBOM
      uses: anchore/sbom-action@f325610c9f50a54015d37c8d16cb3b0e2c8f4de0 # v0.18.0
      if: github.ref_type == 'tag'
      with:
        artifact-name: rond-authz-sbom.spdx.json
        output-file: ./rond-authz-sbom.spdx.json
        image: nexus.mia-platform.eu/rond-authz/rond:${{ steps.meta.output.version.main }}
        upload-release-assets: true
    - name: GCP Auth
      uses: google-github-actions/auth@71f986410dfbc7added4569d411d040a91dc6935 # v2.1.8
      if: github.ref_type == 'tag'
      with:
        project_id: ${{ secrets.MIA_PLATFORM_KMS_PROJECT }}
        workload_identity_provider: ${{ secrets.MIA_PLATFORM_GCP_WIF }}
        create_credentials_file: true
    - name: Sign public images with Mia-Platform key
      if: github.ref_type == 'tag'
      run: |
        for tag in ${TAGS}; do
          image="${tag}@${DIGEST}"
          cosign sign --recursive --yes --key "${COSIGN_PRIVATE_KEY}" "${image}"
          cosign attest --recursive --yes --key "${COSIGN_PRIVATE_KEY}" --predicate "rond-authz-sbom.spdx.json" --type="spdxjson" "${image}"
        done
      env:
        TAGS: |
          ghcr.io/rond-authz/rond:${{ steps.meta.output.version.main }}
          docker.io/rondauthz/rond:${{ steps.meta.output.version.main }}
          nexus.mia-platform.eu/rond-authz/rond:${{ steps.meta.output.version.main }}
        DIGEST: ${{ steps.docker-build.outputs.digest }}
        COSIGN_PRIVATE_KEY: ${{ secrets.MIA_PLATFORM_COSIGN_KEY }}