kyverno/.github/workflows/image-build.yaml

name: image-build
on:
  push:
    branches:
      - 'main'
      - 'release*'

permissions: 
  contents: read
  packages: write
  id-token: write 

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  pre-checks:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0

      - name: Unshallow
        run: git fetch --prune --unshallow

      - name: Set up Go
        uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
        with:
          go-version: ~1.19.4

      - name: Cache Go modules
        uses: actions/cache@4723a57e26efda3a62cbde1812113b730952852d # pin@v3
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod            
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-            

      - name: gofmt check
        run: |
          if [ "$(gofmt -s -l . | wc -l)" -ne 0 ]
          then
           echo "The following files were found to be not go formatted:"
           gofmt -s -l .
           echo "Please run 'make fmt' to go format the above files."
           exit 1
          fi          

      - name: goimports
        run: |
          if [ "$(goimports -l . | wc -l)" -ne 0 ]
          then
           echo "The following files were found to have import formatting issues:"
           goimports -l -l .
           echo "Please run 'make fmt' to go format the above files."
           exit 1
          fi          

      - name: golangci-lint
        uses: reviewdog/action-golangci-lint@53f8eabb87b40b1a2c63ec75b0d418bd0f4aa919 # v2.2.2

      - name: Checking unused pkgs using go mod tidy
        run: |
          make unused-package-check          

  build-init-kyverno:
    runs-on: ubuntu-latest
    needs: pre-checks
    steps:
      - name: Checkout
        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0

      - name: Unshallow
        run: git fetch --prune --unshallow

      - name: Set up Go
        uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
        with:
          go-version: ~1.19.4

      - name: Cache Go modules
        uses: actions/cache@4723a57e26efda3a62cbde1812113b730952852d # pin@v3
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod            
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-            

      - name: ko build
        run: make ko-build-kyvernopre

  build-kyverno:
    runs-on: ubuntu-latest
    needs: pre-checks
    steps:
      - name: Checkout
        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0

      - name: Unshallow
        run: git fetch --prune --unshallow

      - name: Set up Go
        uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
        with:
          go-version: ~1.19.4

      - name: Cache Go modules
        uses: actions/cache@4723a57e26efda3a62cbde1812113b730952852d # pin@v3
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod            
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-            

      - name: ko build
        run: make ko-build-kyverno

      - name: Trivy Scan Image
        uses: aquasecurity/trivy-action@9ab158e8597f3b310480b9a69402b419bc03dbd5
        with:
          scan-type: 'fs'
          ignore-unfixed: true
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'

  build-kyverno-cleanup-controller:
    runs-on: ubuntu-latest
    needs: pre-checks
    steps:
      - name: Checkout
        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0

      - name: Unshallow
        run: git fetch --prune --unshallow

      - name: Set up Go
        uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
        with:
          go-version: ~1.19.4

      - name: Cache Go modules
        uses: actions/cache@4723a57e26efda3a62cbde1812113b730952852d # pin@v3
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod            
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-            

      - name: ko build
        run: make ko-build-cleanup-controller

  build-kyverno-cli:
    runs-on: ubuntu-latest
    needs: pre-checks
    steps:
      - name: Checkout
        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0

      - name: Unshallow
        run: git fetch --prune --unshallow

      - name: Set up Go
        uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
        with:
          go-version: ~1.19.4

      - name: Cache Go modules
        uses: actions/cache@4723a57e26efda3a62cbde1812113b730952852d # pin@v3
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod            
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-            

      - name: ko build
        run: make ko-build-cli