Skip to content

Commit 8a884d8

Browse files
pandatixpandatix
committed
feat: add victor first draft
0 parents  commit 8a884d8

18 files changed

+1453
-0
lines changed

‎.github/dependabot.yaml

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
version: 2
2+
updates:
3+
# Github actions
4+
- package-ecosystem: "github-actions"
5+
directory: "/"
6+
schedule:
7+
interval: "weekly"
8+
9+
# Root Go module
10+
- package-ecosystem: "gomod"
11+
directory: "/"
12+
schedule:
13+
interval: "weekly"
14+
assignees:
15+
- "pandatix"

‎.github/workflows/ci.yaml

+63
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
name: CI
2+
3+
on: [push, pull_request]
4+
5+
permissions:
6+
contents: read
7+
8+
jobs:
9+
setup:
10+
runs-on: ubuntu-latest
11+
steps:
12+
- name: Cancel previous
13+
uses: styfle/[email protected]
14+
with:
15+
access_token: ${{ github.token }}
16+
17+
unit-tests:
18+
strategy:
19+
matrix:
20+
go-version: [1.x, 1.21.x]
21+
platform: [ubuntu-latest]
22+
include:
23+
- go-version: 1.x
24+
platform: ubuntu-latest
25+
update-coverage: true
26+
runs-on: ${{ matrix.platform }}
27+
needs: [setup]
28+
steps:
29+
- name: Checkout code
30+
uses: actions/checkout@v4
31+
32+
- name: Setup Go
33+
uses: actions/setup-go@v4
34+
with:
35+
go-version: ${{ matrix.go-version }}
36+
37+
- name: Cache go modules
38+
uses: actions/cache@v3
39+
with:
40+
path: ~/go/pkg/mod
41+
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
42+
restore-keys: ${{ runner.os }}-go-
43+
44+
- name: Run go test
45+
run: go test -v -race -coverprofile coverage.txt ./...
46+
47+
- name: Upload coverage to Coveralls
48+
if: ${{ matrix.update-coverage }}
49+
uses: shogo82148/actions-goveralls@v1
50+
with:
51+
path-to-profile: coverage.txt
52+
53+
go-lint:
54+
runs-on: ubuntu-latest
55+
needs: [setup]
56+
steps:
57+
- uses: actions/checkout@v4
58+
- uses: actions/setup-go@v4
59+
with:
60+
go-version: 1.21.x
61+
62+
- name: go-lint
63+
uses: golangci/golangci-lint-action@v3

‎.github/workflows/codeql-analysis.yaml

+42
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
name: "CodeQL"
2+
3+
on:
4+
push:
5+
branches: [ "main" ]
6+
pull_request:
7+
branches: [ "main" ]
8+
schedule:
9+
- cron: '0 6 * * 5'
10+
11+
jobs:
12+
analyze:
13+
name: Analyze
14+
runs-on: ubuntu-latest
15+
permissions:
16+
actions: read
17+
contents: read
18+
security-events: write
19+
20+
strategy:
21+
fail-fast: false
22+
matrix:
23+
language: [ 'go' ]
24+
25+
steps:
26+
- name: Checkout repository
27+
uses: actions/checkout@v4
28+
29+
- uses: actions/setup-go@v4
30+
with:
31+
go-version: '1.21.0'
32+
33+
- name: Initialize CodeQL
34+
uses: github/codeql-action/init@v2
35+
with:
36+
languages: ${{ matrix.language }}
37+
38+
- name: Autobuild
39+
uses: github/codeql-action/autobuild@v2
40+
41+
- name: Perform CodeQL Analysis
42+
uses: github/codeql-action/analyze@v2

‎.github/workflows/goreleaser.yaml

+91
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
name: goreleaser
2+
3+
on:
4+
push:
5+
tags:
6+
- "v*"
7+
8+
permissions:
9+
contents: read
10+
11+
jobs:
12+
goreleaser:
13+
outputs:
14+
hashes: ${{ steps.hash.outputs.hashes }}
15+
permissions:
16+
contents: write # for goreleaser/goreleaser-action to create a GitHub release
17+
runs-on: ubuntu-latest
18+
steps:
19+
- name: Checkout
20+
uses: actions/checkout@v4
21+
with:
22+
fetch-depth: 0
23+
- name: Set up Go
24+
uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491
25+
with:
26+
go-version: "1.21"
27+
check-latest: true
28+
- name: Install Syft
29+
run: |
30+
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
31+
- name: Run GoReleaser
32+
id: run-goreleaser
33+
uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8
34+
with:
35+
version: latest
36+
args: release --clean
37+
env:
38+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
39+
VERSION_LDFLAGS: ${{ steps.ldflags.outputs.version }}
40+
- name: Generate subject
41+
id: hash
42+
env:
43+
ARTIFACTS: "${{ steps.run-goreleaser.outputs.artifacts }}"
44+
run: |
45+
set -euo pipefail
46+
47+
checksum_file=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Checksum") | .path')
48+
echo "hashes=$(cat $checksum_file | base64 -w0)" >> "$GITHUB_OUTPUT"
49+
50+
provenance:
51+
needs: [goreleaser]
52+
permissions:
53+
actions: read # To read the workflow path.
54+
id-token: write # To sign the provenance.
55+
contents: write # To add assets to a release.
56+
uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
57+
with:
58+
base64-subjects: "${{ needs.goreleaser.outputs.hashes }}"
59+
upload-assets: true # upload to a new release
60+
verification:
61+
needs: [goreleaser, provenance]
62+
runs-on: ubuntu-latest
63+
permissions: read-all
64+
steps:
65+
- name: Install the verifier
66+
uses: slsa-framework/slsa-verifier/actions/[email protected]
67+
68+
- name: Download assets
69+
env:
70+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
71+
PROVENANCE: "${{ needs.provenance.outputs.provenance-name }}"
72+
run: |
73+
set -euo pipefail
74+
gh -R "$GITHUB_REPOSITORY" release download "$GITHUB_REF_NAME" -p "*.tar.gz"
75+
gh -R "$GITHUB_REPOSITORY" release download "$GITHUB_REF_NAME" -p "*.sbom"
76+
gh -R "$GITHUB_REPOSITORY" release download "$GITHUB_REF_NAME" -p "$PROVENANCE"
77+
- name: Verify assets
78+
env:
79+
CHECKSUMS: ${{ needs.goreleaser.outputs.hashes }}
80+
PROVENANCE: "${{ needs.provenance.outputs.provenance-name }}"
81+
run: |
82+
set -euo pipefail
83+
checksums=$(echo "$CHECKSUMS" | base64 -d)
84+
while read -r line; do
85+
fn=$(echo $line | cut -d ' ' -f2)
86+
echo "Verifying $fn"
87+
slsa-verifier verify-artifact --provenance-path "$PROVENANCE" \
88+
--source-uri "github.com/$GITHUB_REPOSITORY" \
89+
--source-tag "$GITHUB_REF_NAME" \
90+
"$fn"
91+
done <<<"$checksums"

‎.github/workflows/scoreboard.yaml

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: Scorecard supply-chain security
2+
on:
3+
branch_protection_rule:
4+
schedule:
5+
- cron: '30 6 * * 6'
6+
push:
7+
branches: [ "main" ]
8+
9+
permissions: read-all
10+
11+
jobs:
12+
analysis:
13+
name: Scorecard analysis
14+
runs-on: ubuntu-latest
15+
permissions:
16+
security-events: write
17+
id-token: write
18+
19+
steps:
20+
- name: Checkout repository
21+
uses: actions/checkout@v4
22+
with:
23+
persist-credentials: false
24+
25+
- name: Run analysis
26+
uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
27+
with:
28+
results_file: results.sarif
29+
results_format: sarif
30+
publish_results: true
31+
32+
- name: Upload to code-scanning
33+
uses: github/codeql-action/upload-sarif@17573ee1cc1b9d061760f3a006fc4aac4f944fd5 # v2.2.4
34+
with:
35+
sarif_file: results.sarif

‎.goreleaser.yaml

+41
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
before:
2+
hooks:
3+
- go mod tidy
4+
5+
gomod:
6+
proxy: true
7+
8+
builds:
9+
- main: ./cmd/victor
10+
binary: victor
11+
env:
12+
- CGO_ENABLED=0
13+
goos:
14+
- linux
15+
goarch:
16+
- amd64
17+
18+
dockers:
19+
- image_templates:
20+
- "ctfer-io/{{ .ProjectName }}:latest"
21+
- "ctfer-io/{{ .ProjectName }}:{{ .Tag }}"
22+
build_flag_templates:
23+
- "--label=org.opencontainers.image.created={{ .Date }}"
24+
- "--label=org.opencontainers.image.title={{ .ProjectName }}"
25+
- "--label=org.opencontainers.image.revision={{ .FullCommit }}"
26+
- "--label=org.opencontainers.image.version={{ .Version }}"
27+
28+
changelog:
29+
sort: asc
30+
filters:
31+
exclude:
32+
- '^docs:'
33+
- '^test:'
34+
35+
source:
36+
enabled: true
37+
38+
checksum: {}
39+
40+
sboms:
41+
- artifacts: source

0 commit comments

Comments
 (0)