Bump github.com/aws/aws-sdk-go-v2 from 1.42.0 to 1.42.1 #1028
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - "**" | |
| tags: | |
| - "v*" | |
| permissions: | |
| contents: read | |
| env: | |
| IMAGE_NAME: ghcr.io/${{ github.repository }} | |
| RELAY_IMAGE_NAME: ghcr.io/${{ github.repository_owner }}/stream-ingress | |
| jobs: | |
| test: | |
| name: Go tests | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Set up Go | |
| uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6 | |
| with: | |
| go-version-file: go.mod | |
| cache-dependency-path: go.sum | |
| - name: Run go vet | |
| run: go vet ./... | |
| - name: Run tests | |
| run: go test -covermode=atomic -coverprofile=coverage.out ./... | |
| - name: Summarize coverage | |
| run: | | |
| { | |
| echo "### Go coverage" | |
| echo '```text' | |
| go tool cover -func=coverage.out | |
| echo '```' | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| - name: Upload coverage artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: go-coverage | |
| path: coverage.out | |
| if-no-files-found: error | |
| postgres-integration: | |
| name: PostgreSQL metadata tests | |
| runs-on: ubuntu-latest | |
| services: | |
| postgres: | |
| image: postgres:18-alpine@sha256:96d56f7f57c6aacd1fcb908bc83b345ec5f83231ee486dd66a1baadce274db88 | |
| env: | |
| POSTGRES_DB: proofline_test | |
| POSTGRES_USER: proofline | |
| POSTGRES_PASSWORD: proofline | |
| ports: | |
| - 5432:5432 | |
| options: >- | |
| --health-cmd "pg_isready -U proofline -d proofline_test" | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Set up Go | |
| uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6 | |
| with: | |
| go-version-file: go.mod | |
| cache-dependency-path: go.sum | |
| - name: Run PostgreSQL metadata integration tests | |
| env: | |
| SAFE_POSTGRES_TEST_DSN: postgres://proofline:proofline@127.0.0.1:5432/proofline_test?sslmode=disable | |
| run: go test ./internal/postgresdb -count=1 | |
| govulncheck: | |
| name: Go vulnerability scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Set up Go | |
| uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6 | |
| with: | |
| go-version-file: go.mod | |
| cache-dependency-path: go.sum | |
| - name: Run govulncheck | |
| run: go run golang.org/x/vuln/cmd/govulncheck@v1.3.0 ./... | |
| build-binary: | |
| name: Build Linux binary | |
| runs-on: ubuntu-latest | |
| needs: test | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Set up Go | |
| uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6 | |
| with: | |
| go-version-file: go.mod | |
| cache-dependency-path: go.sum | |
| - name: Build binary | |
| run: | | |
| mkdir -p dist | |
| CGO_ENABLED=1 GOOS=linux GOARCH=amd64 go build -trimpath -ldflags="-s -w" -o dist/proofline-server-linux-amd64 ./cmd/api | |
| - name: Smoke-test binary startup | |
| env: | |
| SAFE_MAIN_BIND_ADDRS: 127.0.0.1:18080 | |
| SAFE_ADMIN_BIND_ADDRS: 127.0.0.1:18081 | |
| SAFE_AUTH_BOOTSTRAP_SECRET: ci-smoke-bootstrap-secret | |
| run: | | |
| set -euo pipefail | |
| data_dir="$RUNNER_TEMP/proofline-binary-smoke-data" | |
| log_file="$RUNNER_TEMP/proofline-binary-smoke.log" | |
| rm -rf "$data_dir" | |
| mkdir -p "$data_dir" | |
| SAFE_DATA_DIR="$data_dir" \ | |
| SAFE_DB_PATH="$data_dir/safety.db" \ | |
| ./dist/proofline-server-linux-amd64 >"$log_file" 2>&1 & | |
| server_pid="$!" | |
| cleanup() { | |
| kill "$server_pid" 2>/dev/null || true | |
| wait "$server_pid" 2>/dev/null || true | |
| } | |
| trap cleanup EXIT | |
| for _ in {1..30}; do | |
| if curl --fail --silent --show-error --output /dev/null "http://127.0.0.1:18080/static/styles.css" && | |
| curl --fail --silent --show-error --output /dev/null "http://127.0.0.1:18081/admin/static/styles.css"; then | |
| exit 0 | |
| fi | |
| if ! kill -0 "$server_pid" 2>/dev/null; then | |
| cat "$log_file" | |
| exit 1 | |
| fi | |
| sleep 1 | |
| done | |
| cat "$log_file" | |
| exit 1 | |
| - name: Upload binary artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: proofline-server-linux-amd64 | |
| path: dist/proofline-server-linux-amd64 | |
| if-no-files-found: error | |
| attest-binary: | |
| name: Attest Linux binary | |
| runs-on: ubuntu-latest | |
| needs: | |
| - build-binary | |
| - govulncheck | |
| if: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') }} | |
| permissions: | |
| contents: read | |
| id-token: write | |
| attestations: write | |
| steps: | |
| - name: Download binary artifact | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: proofline-server-linux-amd64 | |
| path: dist | |
| - name: Generate binary artifact attestation | |
| uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4 | |
| with: | |
| subject-path: dist/proofline-server-linux-amd64 | |
| upload-release-binary: | |
| name: Upload release binary | |
| runs-on: ubuntu-latest | |
| needs: attest-binary | |
| if: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') }} | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Download binary artifact | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: proofline-server-linux-amd64 | |
| path: dist | |
| - name: Create release if missing and upload binary | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| REPO: ${{ github.repository }} | |
| TAG_NAME: ${{ github.ref_name }} | |
| run: | | |
| set -euo pipefail | |
| prerelease_args=() | |
| if [[ "$TAG_NAME" == *"-rc."* || "$TAG_NAME" == *"-rc" || "$TAG_NAME" == *"-alpha" || "$TAG_NAME" == *"-beta" ]]; then | |
| prerelease_args+=(--prerelease --latest=false) | |
| fi | |
| if ! gh release view "$TAG_NAME" --repo "$REPO" >/dev/null 2>&1; then | |
| gh release create "$TAG_NAME" \ | |
| --repo "$REPO" \ | |
| --verify-tag \ | |
| --title "$TAG_NAME" \ | |
| --notes "Automated release shell for $TAG_NAME. Maintainers should review and replace these notes before relying on this release." \ | |
| "${prerelease_args[@]}" | |
| fi | |
| gh release upload "$TAG_NAME" dist/proofline-server-linux-amd64 --repo "$REPO" | |
| docker: | |
| name: Build Docker image | |
| runs-on: ubuntu-latest | |
| needs: test | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4 | |
| - name: Normalize Docker image name | |
| id: image-name | |
| run: | | |
| image_name="$(printf '%s' "$IMAGE_NAME" | tr '[:upper:]' '[:lower:]')" | |
| echo "value=$image_name" >> "$GITHUB_OUTPUT" | |
| - name: Generate Docker metadata | |
| id: meta | |
| uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6 | |
| with: | |
| images: ${{ steps.image-name.outputs.value }} | |
| tags: | | |
| type=ref,event=branch | |
| type=ref,event=pr | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=sha,prefix=sha- | |
| - name: Build Docker image | |
| uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7 | |
| with: | |
| context: . | |
| file: ./Dockerfile | |
| push: false | |
| load: true | |
| tags: | | |
| proofline-server:ci-smoke | |
| ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Smoke-test Docker image startup | |
| run: | | |
| set -euo pipefail | |
| volume_name="proofline-ci-smoke-${GITHUB_RUN_ID:-local}-${GITHUB_RUN_ATTEMPT:-0}" | |
| docker volume create "$volume_name" >/dev/null | |
| cleanup() { | |
| if [ -n "${container_id:-}" ]; then | |
| docker rm -f "$container_id" >/dev/null 2>&1 || true | |
| fi | |
| docker volume rm "$volume_name" >/dev/null 2>&1 || true | |
| } | |
| trap cleanup EXIT | |
| container_id="$(docker run --detach \ | |
| --env SAFE_AUTH_BOOTSTRAP_SECRET=ci-smoke-bootstrap-secret \ | |
| --publish 127.0.0.1:18082:8080 \ | |
| --publish 127.0.0.1:18083:8081 \ | |
| --volume "$volume_name:/var/lib/proofline" \ | |
| proofline-server:ci-smoke)" | |
| for _ in {1..30}; do | |
| if curl --fail --silent --show-error --output /dev/null "http://127.0.0.1:18082/static/styles.css" && | |
| curl --fail --silent --show-error --output /dev/null "http://127.0.0.1:18083/admin/static/styles.css"; then | |
| exit 0 | |
| fi | |
| if ! docker container inspect "$container_id" --format '{{.State.Running}}' 2>/dev/null | grep -q true; then | |
| docker logs "$container_id" | |
| exit 1 | |
| fi | |
| sleep 1 | |
| done | |
| docker logs "$container_id" | |
| exit 1 | |
| docker-relay: | |
| name: Build stream-ingress Docker image | |
| runs-on: ubuntu-latest | |
| needs: test | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4 | |
| - name: Normalize stream-ingress image name | |
| id: image-name | |
| run: | | |
| image_name="$(printf '%s' "$RELAY_IMAGE_NAME" | tr '[:upper:]' '[:lower:]')" | |
| echo "value=$image_name" >> "$GITHUB_OUTPUT" | |
| - name: Generate stream-ingress Docker metadata | |
| id: meta | |
| uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6 | |
| with: | |
| images: ${{ steps.image-name.outputs.value }} | |
| tags: | | |
| type=ref,event=branch | |
| type=ref,event=pr | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=sha,prefix=sha- | |
| - name: Build stream-ingress Docker image | |
| uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7 | |
| with: | |
| context: . | |
| file: ./Dockerfile.ingress | |
| push: false | |
| load: true | |
| tags: | | |
| proofline-stream-ingress:ci-smoke | |
| ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Smoke-test stream-ingress Docker image startup | |
| run: | | |
| set -euo pipefail | |
| volume_name="proofline-ingress-ci-smoke-${GITHUB_RUN_ID:-local}-${GITHUB_RUN_ATTEMPT:-0}" | |
| docker volume create "$volume_name" >/dev/null | |
| cleanup() { | |
| if [ -n "${container_id:-}" ]; then | |
| docker rm -f "$container_id" >/dev/null 2>&1 || true | |
| fi | |
| docker volume rm "$volume_name" >/dev/null 2>&1 || true | |
| } | |
| trap cleanup EXIT | |
| container_id="$(docker run --detach \ | |
| --env SAFE_STREAM_INGRESS_READY=true \ | |
| --env SAFE_STREAM_INGRESS_RELAY_ID=ci-relay \ | |
| --env SAFE_STREAM_INGRESS_REGION=ci \ | |
| --env SAFE_STREAM_INGRESS_CORE_BASE_URL=http://127.0.0.1:8080 \ | |
| --env SAFE_STREAM_INGRESS_CORE_SERVICE_AUTH_TOKEN=ci-local-relay-service-token-12345 \ | |
| --publish 127.0.0.1:18090:8090 \ | |
| --volume "$volume_name:/var/lib/proofline-stream-ingress" \ | |
| proofline-stream-ingress:ci-smoke)" | |
| for _ in {1..30}; do | |
| if curl --fail --silent --show-error --output /dev/null "http://127.0.0.1:18090/health/live" && | |
| curl --fail --silent --show-error --output /dev/null "http://127.0.0.1:18090/health/ready"; then | |
| for path in /admin /admin/api/accounts /v1/incidents /i/viewer-token /metrics; do | |
| status="$(curl --silent --show-error --output /dev/null --write-out "%{http_code}" "http://127.0.0.1:18090${path}")" | |
| if [ "$status" != "404" ]; then | |
| echo "stream-ingress route ${path} returned HTTP ${status}, want 404" >&2 | |
| exit 1 | |
| fi | |
| done | |
| exit 0 | |
| fi | |
| if ! docker container inspect "$container_id" --format '{{.State.Running}}' 2>/dev/null | grep -q true; then | |
| docker logs "$container_id" | |
| exit 1 | |
| fi | |
| sleep 1 | |
| done | |
| docker logs "$container_id" | |
| exit 1 | |
| docker-publish: | |
| name: Publish Docker image | |
| runs-on: ubuntu-latest | |
| needs: | |
| - test | |
| - govulncheck | |
| - docker | |
| - docker-relay | |
| if: ${{ github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/tags/v')) }} | |
| permissions: | |
| contents: read | |
| id-token: write | |
| attestations: write | |
| packages: write | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4 | |
| - name: Normalize Docker image name | |
| id: image-name | |
| run: | | |
| image_name="$(printf '%s' "$IMAGE_NAME" | tr '[:upper:]' '[:lower:]')" | |
| echo "value=$image_name" >> "$GITHUB_OUTPUT" | |
| - name: Generate Docker metadata | |
| id: meta | |
| uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6 | |
| with: | |
| images: ${{ steps.image-name.outputs.value }} | |
| tags: | | |
| type=ref,event=branch | |
| type=ref,event=pr | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=sha,prefix=sha- | |
| - name: Log in to GitHub Container Registry | |
| uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build and publish Docker image | |
| id: build-and-publish | |
| uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7 | |
| with: | |
| context: . | |
| file: ./Dockerfile | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Generate Docker image attestation | |
| uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4 | |
| with: | |
| subject-name: ${{ steps.image-name.outputs.value }} | |
| subject-digest: ${{ steps.build-and-publish.outputs.digest }} | |
| push-to-registry: true | |
| create-storage-record: false | |
| - name: Normalize stream-ingress image name | |
| id: relay-image-name | |
| run: | | |
| image_name="$(printf '%s' "$RELAY_IMAGE_NAME" | tr '[:upper:]' '[:lower:]')" | |
| echo "value=$image_name" >> "$GITHUB_OUTPUT" | |
| - name: Generate stream-ingress Docker metadata | |
| id: relay-meta | |
| uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6 | |
| with: | |
| images: ${{ steps.relay-image-name.outputs.value }} | |
| tags: | | |
| type=ref,event=branch | |
| type=ref,event=pr | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=sha,prefix=sha- | |
| - name: Build and publish stream-ingress Docker image | |
| id: relay-build-and-publish | |
| uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7 | |
| with: | |
| context: . | |
| file: ./Dockerfile.ingress | |
| push: true | |
| tags: ${{ steps.relay-meta.outputs.tags }} | |
| labels: ${{ steps.relay-meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Generate stream-ingress Docker image attestation | |
| uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4 | |
| with: | |
| subject-name: ${{ steps.relay-image-name.outputs.value }} | |
| subject-digest: ${{ steps.relay-build-and-publish.outputs.digest }} | |
| push-to-registry: true | |
| create-storage-record: false |