From b394e17fd4fadfa56949d757995dd1d5abd1378f Mon Sep 17 00:00:00 2001 From: Daniel Bourdrez <3641580+bytemare@users.noreply.github.com> Date: Sun, 7 Jul 2024 14:59:30 +0200 Subject: [PATCH] Update CI (#64) * Update CI Signed-off-by: bytemare <3641580+bytemare@users.noreply.github.com> --- .github/.golangci.yml | 10 ++- .github/dependency-review.yml | 27 ------- .github/sonar-project.properties | 8 ++ .github/workflows/ci.yml | 130 ------------------------------- .github/workflows/code-scan.yml | 36 +++++++++ .github/workflows/codeql.yml | 34 ++------ .github/workflows/scorecards.yml | 87 +++++++-------------- .github/workflows/snyk.yml | 35 --------- .github/workflows/tests.yml | 22 ++++++ README.md | 2 +- 10 files changed, 104 insertions(+), 287 deletions(-) delete mode 100644 .github/dependency-review.yml create mode 100644 .github/sonar-project.properties delete mode 100644 .github/workflows/ci.yml create mode 100644 .github/workflows/code-scan.yml delete mode 100644 .github/workflows/snyk.yml create mode 100644 .github/workflows/tests.yml diff --git a/.github/.golangci.yml b/.github/.golangci.yml index 390baf8..dbaa240 100644 --- a/.github/.golangci.yml +++ b/.github/.golangci.yml @@ -106,6 +106,8 @@ linters-settings: # - io/ioutil.ReadFile # - io.Copy(*bytes.Buffer) # - io.Copy(os.Stdout) + exhaustive: + default-signifies-exhaustive: true funlen: lines: 100 statements: 50 @@ -149,7 +151,9 @@ linters-settings: gosimple: checks: [ "all" ] govet: - check-shadowing: true + settings: + shadow: + strict: true disable-all: true enable: - asmdecl @@ -209,8 +213,6 @@ linters-settings: prealloc: simple: false for-loops: true - unused: - check-exported: false whitespace: multi-if: false multi-func: false @@ -231,7 +233,7 @@ issues: # But independently from this option we use default exclude patterns, # it can be disabled by `exclude-use-default: false`. To list all # excluded by default patterns execute `golangci-lint run --help` - exclude: + #exclude: #- "should have a package comment, unless it's in another file for this package" #- "do not define dynamic errors, use wrapped static errors instead" #- "missing cases in switch of type Group: maxID" diff --git a/.github/dependency-review.yml b/.github/dependency-review.yml deleted file mode 100644 index d2488d0..0000000 --- a/.github/dependency-review.yml +++ /dev/null @@ -1,27 +0,0 @@ -# Dependency Review Action -# -# This Action will scan dependency manifest files that change as part of a Pull Request, -# surfacing known-vulnerable versions of the packages declared or updated in the PR. -# Once installed, if the workflow run is marked as required, -# PRs introducing known-vulnerable packages will be blocked from merging. -# -# Source repository: https://github.com/actions/dependency-review-action -name: 'Dependency Review' -on: [pull_request] - -permissions: - contents: read - -jobs: - dependency-review: - runs-on: ubuntu-latest - steps: - - name: Harden Runner - uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0 - with: - egress-policy: block - - - name: 'Checkout Repository' - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - - name: 'Dependency Review' - uses: actions/dependency-review-action@0efb1d1d84fc9633afcdaad14c485cbbc90ef46c # v2.5.1 diff --git a/.github/sonar-project.properties b/.github/sonar-project.properties new file mode 100644 index 0000000..5e06d5a --- /dev/null +++ b/.github/sonar-project.properties @@ -0,0 +1,8 @@ +sonar.organization=bytemare +sonar.projectKey=crypto +sonar.sources=. +sonar.tests=tests/ +sonar.test.exclusions=tests/** +sonar.verbose=true +sonar.coverage.exclusions=tests/** +sonar.go.coverage.reportPaths=coverage.out \ No newline at end of file diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml deleted file mode 100644 index 4131a59..0000000 --- a/.github/workflows/ci.yml +++ /dev/null @@ -1,130 +0,0 @@ -name: Crypto -on: - pull_request: - branches: - - main - -permissions: - contents: read - -jobs: - lint: - name: Lint - runs-on: ubuntu-latest - steps: - - uses: step-security/harden-runner@6d3c2fe731c8f225990c8018cb71c337c0d9dfcd - with: - disable-sudo: true - egress-policy: block - allowed-endpoints: > - api.github.com:443 - github.com:443 - objects.githubusercontent.com:443 - proxy.golang.org:443 - raw.githubusercontent.com:443 - - - name: Checkout repo - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 - with: - fetch-depth: 0 - - name: Setup Go - uses: actions/setup-go@4ab57d7ea2fd0c9948210b2e0784e280674e7144 - with: - go-version-file: ./go.mod - - # Linting - - name: Linting - uses: golangci/golangci-lint-action@031a2fcd4afedd71ec636137da88172250868de4 - with: - version: latest - args: --config=./.github/.golangci.yml ./... - only-new-issues: true - - test: - name: Test - runs-on: ubuntu-latest - strategy: - fail-fast: false - matrix: - go: [ '1.22', '1.21' ] - steps: - - uses: step-security/harden-runner@6d3c2fe731c8f225990c8018cb71c337c0d9dfcd - with: - disable-sudo: true - egress-policy: block - allowed-endpoints: > - github.com:443 - proxy.golang.org:443 - storage.googleapis.com:443 - sum.golang.org:443 - - - name: Checkout repo - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 - with: - fetch-depth: 0 - - name: Setup Go - uses: actions/setup-go@4ab57d7ea2fd0c9948210b2e0784e280674e7144 - with: - go-version: ${{ matrix.go }} - - # Test - - name: Run Tests - run: cd .github && make test - - analyze: - name: Analyze - runs-on: ubuntu-latest - steps: - - uses: step-security/harden-runner@6d3c2fe731c8f225990c8018cb71c337c0d9dfcd - with: - disable-sudo: true - egress-policy: block - allowed-endpoints: > - api.codecov.io:443 - api.github.com:443 - cli.codecov.io:443 - ea6ne4j2sb.execute-api.eu-central-1.amazonaws.com:443 - github.com:443 - objects.githubusercontent.com:443 - proxy.golang.org:443 - scanner.sonarcloud.io:443 - sonarcloud.io:443 - storage.googleapis.com:443 - - - name: Checkout repo - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 - with: - fetch-depth: 0 - - name: Setup Go - uses: actions/setup-go@4ab57d7ea2fd0c9948210b2e0784e280674e7144 - with: - go-version-file: ./go.mod - - # Coverage - - name: Run coverage - run: cd .github && make cover - - # Codecov - - name: Codecov - uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 - env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} - with: - file: .github/coverage.out - - # Sonar - - name: SonarCloud Scan - uses: SonarSource/sonarcloud-github-action@e44258b109568baa0df60ed515909fc6c72cba92 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} - with: - args: > - -Dsonar.projectKey=crypto - -Dsonar.organization=bytemare - -Dsonar.go.coverage.reportPaths=.github/coverage.out - -Dsonar.sources=. - -Dsonar.test.exclusions=tests/** - -Dsonar.coverage.exclusions=tests/** - -Dsonar.tests=tests/ - -Dsonar.verbose=true diff --git a/.github/workflows/code-scan.yml b/.github/workflows/code-scan.yml new file mode 100644 index 0000000..0acaf49 --- /dev/null +++ b/.github/workflows/code-scan.yml @@ -0,0 +1,36 @@ +name: Code Scan + +on: + push: + branches: + - main + pull_request: + branches: + - main + schedule: + # random HH:MM to avoid a load spike on GitHub Actions at 00:00 + - cron: '4 1 * * *' + +permissions: {} + +jobs: + Lint: + permissions: + contents: read + uses: bytemare/workflows/.github/workflows/golangci-lint.yml@488639cc8162524432d0c8257cd1adf7d05b90c9 + with: + config-path: ./.github/.golangci.yml + scope: ./... + + Analyze: + permissions: + contents: read + uses: bytemare/workflows/.github/workflows/scan-go.yml@488639cc8162524432d0c8257cd1adf7d05b90c9 + with: + sonar-configuration: .github/sonar-project.properties + coverage-output-file: coverage.out + secrets: + github: ${{ secrets.GITHUB_TOKEN }} + sonar: ${{ secrets.SONAR_TOKEN }} + codecov: ${{ secrets.CODECOV_TOKEN }} + semgrep: ${{ secrets.SEMGREP_APP_TOKEN }} \ No newline at end of file diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 564fb91..2a0e92a 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -10,38 +10,14 @@ on: schedule: - cron: '31 10 * * 0' -permissions: - contents: read +permissions: {} jobs: - codeql: - name: CodeQL - runs-on: ubuntu-latest + CodeQL: permissions: actions: read contents: read security-events: write - - strategy: - fail-fast: false - - steps: - - uses: step-security/harden-runner@6d3c2fe731c8f225990c8018cb71c337c0d9dfcd - with: - disable-sudo: true - egress-policy: audit - - - name: Checkout repository - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 - - # Initializes the CodeQL tools for scanning. - - name: Initialize CodeQL - uses: github/codeql-action/init@bd2ebac9380cbba2fb338fab55bf29a2a18fd436 - with: - languages: go - - - name: Autobuild - uses: github/codeql-action/autobuild@bd2ebac9380cbba2fb338fab55bf29a2a18fd436 - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@bd2ebac9380cbba2fb338fab55bf29a2a18fd436 + uses: bytemare/workflows/.github/workflows/codeql.yml@488639cc8162524432d0c8257cd1adf7d05b90c9 + with: + language: go diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index 528131f..d49ef23 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -1,74 +1,39 @@ -name: Scorecard analysis workflow +name: Scorecard Analysis Workflow + on: - # Only the default branch is supported. - branch_protection_rule: + push: + branches: + - main + pull_request: + branches: + - main schedule: # Weekly on Saturdays. - cron: '30 1 * * 6' - push: - branches: [ main ] -# Declare default permissions as read only. -permissions: read-all +permissions: {} jobs: analysis: - name: Scorecard analysis - runs-on: ubuntu-latest permissions: # Needed if using Code scanning alerts security-events: write # Needed for GitHub OIDC token if publish_results is true id-token: write - - steps: - - uses: step-security/harden-runner@6d3c2fe731c8f225990c8018cb71c337c0d9dfcd - with: - disable-sudo: true - egress-policy: block - allowed-endpoints: > - api.github.com:443 - api.osv.dev:443 - api.securityscorecards.dev:443 - fulcio.sigstore.dev:443 - github.com:443 - oss-fuzz-build-logs.storage.googleapis.com:443 - rekor.sigstore.dev:443 - tuf-repo-cdn.sigstore.dev:443 - www.bestpractices.dev:443 - - - name: "Checkout code" - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 - with: - persist-credentials: false - - - name: "Run analysis" - uses: ossf/scorecard-action@0a8153a7e8d76932ff5903ccdbed894237ef223d - with: - results_file: results.sarif - results_format: sarif - # (Optional) fine-grained personal access token. Uncomment the `repo_token` line below if: - # - you want to enable the Branch-Protection check on a *public* repository, or - # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-fine-grained-pat-optional. - repo_token: ${{ secrets.SCORECARD_TOKEN }} - - # Publish the results for public repositories to enable scorecard badges. For more details, see - # https://github.com/ossf/scorecard-action#publishing-results. - # For private repositories, `publish_results` will automatically be set to `false`, regardless - # of the value entered here. - publish_results: true - - # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF - # format to the repository Actions tab. - - name: "Upload artifact" - uses: actions/upload-artifact@552bf3722c16e81001aea7db72d8cedf64eb5f68 - with: - name: SARIF file - path: results.sarif - retention-days: 5 - - # required for Code scanning alerts - - name: "Upload SARIF results to code scanning" - uses: github/codeql-action/upload-sarif@bd2ebac9380cbba2fb338fab55bf29a2a18fd436 - with: - sarif_file: results.sarif + # Needed for nested workflow + actions: read + attestations: read + checks: read + contents: read + deployments: read + issues: read + discussions: read + packages: read + pages: read + pull-requests: read + repository-projects: read + statuses: read + + uses: bytemare/workflows/.github/workflows/scorecard.yml@488639cc8162524432d0c8257cd1adf7d05b90c9 + secrets: + token: ${{ secrets.SCORECARD_TOKEN }} \ No newline at end of file diff --git a/.github/workflows/snyk.yml b/.github/workflows/snyk.yml deleted file mode 100644 index 4d7e931..0000000 --- a/.github/workflows/snyk.yml +++ /dev/null @@ -1,35 +0,0 @@ -name: Snyk - -on: - push: - branches: [ main ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ main ] - schedule: - - cron: '31 10 * * 0' - -permissions: - contents: read - -jobs: - snyk: - name: Snyk - runs-on: ubuntu-latest - steps: - - uses: step-security/harden-runner@6d3c2fe731c8f225990c8018cb71c337c0d9dfcd - with: - disable-sudo: true - egress-policy: block - allowed-endpoints: > - api.snyk.io:443 - github.com:443 - proxy.golang.org:443 - - - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 - - name: Run Snyk to check for vulnerabilities - uses: snyk/actions/golang@d406fd286b663eb8c6f8adcced4f7bcd199c0a3f - env: - SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} - with: - args: --sarif-file-output=snyk.sarif diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml new file mode 100644 index 0000000..663b9cd --- /dev/null +++ b/.github/workflows/tests.yml @@ -0,0 +1,22 @@ +name: Run Tests + +on: + push: + branches: + - main + pull_request: + branches: + - main + +permissions: {} + +jobs: + Test: + strategy: + fail-fast: false + matrix: + go: [ '1.22', '1.21' ] + uses: bytemare/workflows/.github/workflows/test-go.yml@488639cc8162524432d0c8257cd1adf7d05b90c9 + with: + command: cd .github && make test + version: ${{ matrix.go }} diff --git a/README.md b/README.md index fed793f..afa020f 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,5 @@ # Prime-order Elliptic Curve Groups -[![CI](https://github.com/bytemare/crypto/actions/workflows/ci.yml/badge.svg)](https://github.com/bytemare/crypto/actions/workflows/ci.yml) +[![CI](https://github.com/bytemare/crypto/actions/workflows/code-scan.yml/badge.svg)](https://github.com/bytemare/crypto/actions/workflows/code-scan.yml) [![Go Reference](https://pkg.go.dev/badge/github.com/bytemare/crypto.svg)](https://pkg.go.dev/github.com/bytemare/crypto) [![codecov](https://codecov.io/gh/bytemare/crypto/branch/main/graph/badge.svg?token=5bQfB0OctA)](https://codecov.io/gh/bytemare/crypto)