GoSQLGuard/.github/workflows/pipeline.yml at main · SupportTools/GoSQLGuard · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
name: GoSQLGuard CI/CD

on:
  push:
    branches: [ main, master ]
  pull_request:
    branches: [ main, master ]

jobs:
  Test:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v4
        with:
          go-version: "1.23"

      - name: Cache Go modules
        uses: actions/cache@v4
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-

      - name: Install static analysis tools
        run: |
          go install golang.org/x/lint/golint@latest
          go install honnef.co/go/tools/cmd/staticcheck@latest
          go install github.com/securego/gosec/v2/cmd/gosec@latest
          go install github.com/psampaz/go-mod-outdated@latest
          go install github.com/remyoudompheng/go-misc/deadcode@latest

      - name: Go static analysis
        run: |
          # Run linters but don't fail on style issues for now
          golint ./... || true
          staticcheck ./... || true
          go vet ./...
          # deadcode is deprecated, skip it
          # deadcode .

      - name: Dependency management
        run: |
          go mod vendor
          go mod verify
          go mod tidy

      - name: Security scanning
        run: |
          # Run gosec with specific exclusions for false positives
          # G104: Audit errors not checked - too strict for WriteTo/Write/Encode operations
          # G203: XSS via fmt.Fprintf - false positive for HTML template generation
          # G204: Subprocess with variables - controlled environment, parameters are sanitized
          # G304: File path inclusion - paths are controlled and validated
          gosec -exclude=G104,G203,G204,G304 ./...

  Build:
    needs: Test
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to DockerHub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Docker build and push
        run: |
          docker buildx build \
          --platform linux/amd64 \
          --pull \
          --build-arg VERSION=v${{ github.run_number }} \
          --build-arg GIT_COMMIT=${{ github.sha }} \
          --build-arg BUILD_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ") \
          --cache-from supporttools/gosqlguard:latest \
          -t supporttools/gosqlguard:"0.1.${{ github.run_number }}" \
          -t supporttools/gosqlguard:latest \
          --push \
          -f Dockerfile .

  Publish:
    runs-on: ubuntu-latest
    needs:
      - Build

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Helm
        uses: azure/setup-helm@v4.2.0

      - name: Helm Lint
        run: helm lint charts/gosqlguard/

      - name: Package Helm chart
        run: |
          export CHART_VERSION="0.1.${{ github.run_number }}"
          export APP_VERSION="0.1.${{ github.run_number }}"
          export IMAGE_TAG="0.1.${{ github.run_number }}"
          echo "CHART_VERSION=${CHART_VERSION}"
          echo "APP_VERSION=${APP_VERSION}"
          envsubst < charts/gosqlguard/Chart.yaml.template > charts/gosqlguard/Chart.yaml
          envsubst < charts/gosqlguard/values.yaml.template > charts/gosqlguard/values.yaml
          helm package charts/gosqlguard --destination helm/repo

      - name: Checkout helm-chart repository
        uses: actions/checkout@v4
        with:
          repository: supporttools/helm-chart
          path: helm-chart
          token: ${{ secrets.BOT_TOKEN }}

      - name: Configure Git
        run: |
          git config --global user.email "github-action@users.noreply.github.com"
          git config --global user.name "GitHub Action"

      - name: Update Helm repository
        run: |
          mkdir -p helm/repo
          cp helm/repo/gosqlguard-*.tgz helm-chart/
          cd helm-chart
          helm repo index . --url https://charts.support.tools/
          git add .
          git commit -m "Update Helm chart for gosqlguard"
          git push