fix typo (#64) #88
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI Pipeline | |
| on: | |
| push: | |
| branches: ["*"] | |
| pull_request: | |
| branches: ["*"] | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Set up Go | |
| uses: actions/setup-go@v4 | |
| with: | |
| go-version: "1.23" | |
| - name: Cache Go modules | |
| uses: actions/cache@v3 | |
| with: | |
| path: | | |
| ~/.cache/go-build | |
| ~/go/pkg/mod | |
| key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} | |
| restore-keys: | | |
| ${{ runner.os }}-go- | |
| - name: Install dependencies | |
| run: go mod download | |
| - name: Run unit tests | |
| run: go test -v -race -coverprofile=coverage.out ./... | |
| - name: Upload coverage to Codecov | |
| uses: codecov/codecov-action@v4 | |
| with: | |
| file: ./coverage.out | |
| flags: unittests | |
| name: codecov-umbrella | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Set up Go | |
| uses: actions/setup-go@v4 | |
| with: | |
| go-version: "1.23" | |
| - name: Run golangci-lint | |
| uses: golangci/golangci-lint-action@v3 | |
| with: | |
| version: latest | |
| args: --timeout=5m | |
| # Security vulnerability scanning | |
| security-scan: | |
| runs-on: ubuntu-latest | |
| name: Security Vulnerability Scan | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Set up Go | |
| uses: actions/setup-go@v4 | |
| with: | |
| go-version: "1.23" | |
| - name: Cache Go modules | |
| uses: actions/cache@v3 | |
| with: | |
| path: | | |
| ~/.cache/go-build | |
| ~/go/pkg/mod | |
| key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} | |
| restore-keys: | | |
| ${{ runner.os }}-go- | |
| - name: Install dependencies | |
| run: go mod download | |
| - name: Install govulncheck | |
| run: go install golang.org/x/vuln/cmd/govulncheck@latest | |
| - name: Run govulncheck and generate SARIF | |
| run: | | |
| echo "Current directory: $(pwd)" | |
| echo "Files in current directory:" | |
| ls -la | |
| govulncheck -format=sarif ./... > govulncheck-results.sarif | |
| govulncheck -json ./... > vuln.json | |
| count=$(jq '[.[] | select(.finding != null and .finding.trace != null)] | length' vuln.json || echo 0) | |
| echo "Found $count vulnerabilities" | |
| if [ "$count" -gt 0 ]; then | |
| echo "⚠️ Vulnerabilities found by govulncheck (see Security tab for details)" | |
| else | |
| echo "✅ No vulnerabilities found by govulncheck" | |
| fi | |
| continue-on-error: true | |
| - name: Upload govulncheck results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v3 | |
| if: always() | |
| with: | |
| sarif_file: govulncheck-results.sarif | |
| category: govulncheck | |
| - name: Install gosec | |
| run: go install github.com/securego/gosec/v2/cmd/gosec@latest | |
| - name: Run gosec security scanner | |
| run: | | |
| gosec -fmt sarif -out gosec-results.sarif -exclude G304 ./... | |
| continue-on-error: true | |
| - name: Upload gosec results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v3 | |
| if: always() | |
| with: | |
| sarif_file: gosec-results.sarif | |
| category: gosec | |
| # CodeQL Analysis | |
| codeql-analysis: | |
| name: CodeQL Analysis | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: ["go"] | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Set up Go | |
| uses: actions/setup-go@v4 | |
| with: | |
| go-version: "1.23" | |
| - name: Cache Go modules | |
| uses: actions/cache@v3 | |
| with: | |
| path: | | |
| ~/.cache/go-build | |
| ~/go/pkg/mod | |
| key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} | |
| restore-keys: | | |
| ${{ runner.os }}-go- | |
| - name: Install dependencies | |
| run: go mod download | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| queries: +security-and-quality | |
| - name: Build for CodeQL | |
| run: | | |
| go build -v ./cmd/mpcium | |
| go build -v ./cmd/mpcium-cli | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: "/language:${{matrix.language}}" | |
| # SBOM Generation | |
| sbom: | |
| runs-on: ubuntu-latest | |
| name: Generate SBOM | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Set up Go | |
| uses: actions/setup-go@v4 | |
| with: | |
| go-version: "1.23" | |
| - name: Cache Go modules | |
| uses: actions/cache@v3 | |
| with: | |
| path: | | |
| ~/.cache/go-build | |
| ~/go/pkg/mod | |
| key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} | |
| restore-keys: | | |
| ${{ runner.os }}-go- | |
| - name: Install dependencies | |
| run: go mod download | |
| - name: Build binaries | |
| run: | | |
| go build -o mpcium ./cmd/mpcium | |
| go build -o mpcium-cli ./cmd/mpcium-cli | |
| - name: Generate SBOM with anchore/sbom-action (SPDX-JSON) | |
| uses: anchore/sbom-action@v0 | |
| with: | |
| artifact-name: sbom-spdx.json | |
| output-file: sbom.spdx.json | |
| format: spdx-json | |
| - name: Generate SBOM with anchore/sbom-action (CycloneDX) | |
| uses: anchore/sbom-action@v0 | |
| with: | |
| artifact-name: sbom-cyclonedx.json | |
| output-file: sbom.cyclonedx.json | |
| format: cyclonedx-json | |
| upload-artifact: false | |
| - name: Generate SBOM with anchore/sbom-action (Syft JSON) | |
| uses: anchore/sbom-action@v0 | |
| with: | |
| artifact-name: sbom-syft.json | |
| output-file: sbom.syft.json | |
| format: syft-json | |
| upload-artifact: false | |
| - name: Upload all SBOM artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: sbom-files | |
| path: | | |
| sbom.spdx.json | |
| sbom.cyclonedx.json | |
| sbom.syft.json | |
| retention-days: 30 | |
| - name: Install Grype | |
| run: | | |
| curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin | |
| - name: Scan SBOM with Grype | |
| run: | | |
| grype sbom.spdx.json -o sarif --file grype-results.sarif | |
| continue-on-error: true | |
| - name: Upload Grype results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v3 | |
| if: always() | |
| with: | |
| sarif_file: grype-results.sarif | |
| category: grype | |
| - name: Display SBOM summary | |
| run: | | |
| echo "📦 SBOM Generation Summary" | |
| echo "=========================" | |
| echo "Generated SBOM files:" | |
| ls -la sbom.* | |
| echo "" | |
| echo "SBOM package count:" | |
| echo "SPDX: $(jq '.packages | length' sbom.spdx.json)" | |
| echo "CycloneDX: $(jq '.components | length' sbom.cyclonedx.json)" | |
| echo "Syft: $(jq '.artifacts | length' sbom.syft.json)" | |
| build: | |
| runs-on: ubuntu-latest | |
| needs: [test, lint, security-scan, codeql-analysis, sbom] | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Set up Go | |
| uses: actions/setup-go@v4 | |
| with: | |
| go-version: "1.23" | |
| - name: Cache Go modules | |
| uses: actions/cache@v3 | |
| with: | |
| path: | | |
| ~/.cache/go-build | |
| ~/go/pkg/mod | |
| key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} | |
| restore-keys: | | |
| ${{ runner.os }}-go- | |
| - name: Build mpcium | |
| run: go build -v ./cmd/mpcium | |
| - name: Build mpcium-cli | |
| run: go build -v ./cmd/mpcium-cli |