core.yml

# SPDX-FileCopyrightText: 2021 Belcan Advanced Solutions
# SPDX-FileCopyrightText: 2021 Kaelan Thijs Fouwels <kaelan.thijs@fouwels.com>
#
# SPDX-License-Identifier: Apache-2.0

name: Core
on:
  push:
env:
  REPO: ${{github.repository}}
  REGISTRY: containers.fouwels.app
  GOSEC_VERSION: 2.8.0
  STATICCHECK_VERSION: 2021.1
  ARCH: linux_amd64
jobs:
  code-security:
    runs-on: ubuntu-latest
    name: Code Security (MITRE)
    steps:
      - id: vars
        run: echo ::set-output name=TAG::${GITHUB_REF##*/}

      - name: Print headers
        run: echo "Running for target ${{env.REGISTRY}}/${{env.REPO}}:${{steps.vars.outputs.TAG}} in ${GITHUB_WORKSPACE}"

      - name: Checkout repo
        uses: actions/checkout@master
        with:
          lfs: true

      - run: echo Working in ${GITHUB_WORKSPACE}

      - name: Downloading and extracting gosec ${{env.GOSEC_VERSION}}
        run: wget https://github.com/securego/gosec/releases/download/v${{env.GOSEC_VERSION}}/gosec_${{env.GOSEC_VERSION}}_${{env.ARCH}}.tar.gz -O gosec.tar.gz && tar -xzf gosec.tar.gz

      - name: Run gosec/MITRE static security scanner (init)
        run: cd ${GITHUB_WORKSPACE}/init && ${GITHUB_WORKSPACE}/gosec -exclude=G307,G306,G302,G204 ./...

  static-check:
    runs-on: ubuntu-latest
    name: Code Security (static checks)
    steps:
      - id: vars
        run: echo ::set-output name=TAG::${GITHUB_REF##*/}

      - name: Print headers
        run: echo "Running for target ${{env.REGISTRY}}/${{env.REPO}}:${{steps.vars.outputs.TAG}} in ${GITHUB_WORKSPACE}"

      - name: Checkout repo
        uses: actions/checkout@master
        with:
          lfs: true

      - run: echo Working in ${GITHUB_WORKSPACE}

      - name: Downloading and extracting static check ${{env.GOSEC_VERSION}}
        run: wget https://github.com/dominikh/go-tools/releases/download/${{env.STATICCHECK_VERSION}}/staticcheck_${{env.ARCH}}.tar.gz -O staticcheck.tar.gz && tar -xzf staticcheck.tar.gz

      - name: Run static checks (init)
        run: cd ${GITHUB_WORKSPACE}/init && ${GITHUB_WORKSPACE}/staticcheck/staticcheck ./...

  licencing:
    runs-on: ubuntu-latest
    name: Licensing (SPDX)
    steps:
      - uses: actions/checkout@v2
      - name: REUSE Compliance Check
        uses: fsfe/reuse-action@v1