diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..c2a6b26 --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,69 @@ +name: goreleaser + +on: + push: + tags: + - 'v*' + +permissions: + contents: write + id-token: write + packages: write + issues: write + security-events: write + +env: + GO111MODULE: on + CGO_ENABLED: 0 + ACTIONS_ALLOW_UNSECURE_COMMANDS: true + +jobs: + gosec: + runs-on: ubuntu-latest + steps: + - name: Checkout Source + uses: actions/checkout@v3 + + - name: Run Gosec Security Scanner + uses: securego/gosec@master + with: + args: ./... + + trivy: + runs-on: ubuntu-20.04 + steps: + - name: Checkout code + uses: actions/checkout@v3 + - name: Build an image from Dockerfile + run: | + docker build -t docker.io/my-organization/my-app:${{ github.sha }} . + - name: Run Trivy vulnerability scanner + uses: aquasecurity/trivy-action@master + with: + image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}' + format: 'table' + exit-code: '1' + ignore-unfixed: true + vuln-type: 'os,library' + severity: 'CRITICAL,HIGH' + + goreleaser: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + + - name: Unshallow + run: git fetch --prune --unshallow + + - uses: actions/setup-go@v4 + with: + go-version: 1.19 + + - uses: goreleaser/goreleaser-action@v4 + with: + distribution: goreleaser + version: latest + args: release --clean + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + diff --git a/go.sum b/go.sum new file mode 100644 index 0000000..6c4f79e --- /dev/null +++ b/go.sum @@ -0,0 +1,2 @@ +golang.org/x/net v0.8.0 h1:Zrh2ngAOFYneWTAIAPethzeaQLuHwhuBkuV6ZiRnUaQ= +golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=