main.yaml

name: Build, Test and Publish

on:
  merge_group:
  push:
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  lint:
    name: Lints
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
      with:
        fetch-depth: 0
    - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
      with:
        cache-dependency-path: './go.sum'
        check-latest: true
        go-version: '>=1.21.0'
    - name: golangci-lint
      uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0
      with:
        version: latest

  audit:
    name: Security Audits
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
      with:
        fetch-depth: 0
    - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
      with:
        cache-dependency-path: './go.sum'
        check-latest: true
        go-version: '>=1.21.0'

    - name: Run govulncheck
      run: make audit

  test:
    name: Tests
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
      with:
        fetch-depth: 0

    - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
      with:
        cache-dependency-path: './go.sum'
        check-latest: true
        go-version: '>=1.21.0'

    - name: Build
      run: make build

    - name: Run unit test
      run: make test

  shellcheck:
    name: Shellcheck
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Run ShellCheck
        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 #2.0.0

  test-go-releaser:
    name: Test Release Process
    if: startsWith(github.ref, 'refs/tags/v') != true
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
      with:
        fetch-depth: 0
    - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
      with:
        cache-dependency-path: './go.sum'
        check-latest: true
        go-version: '>=1.21.0'

    - name: Extract Version from Tag
      id: tag_name
      run: |
        echo "current_version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
      shell: bash

    - name: Checkout
      uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
      with:
        fetch-depth: 0

    - name: Set up Go
      uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
      with:
        cache-dependency-path: './go.sum'
        check-latest: true
        go-version: '>=1.21.0'

    - uses: anchore/sbom-action/download-syft@78fc58e266e87a38d4194b2137a3d4e9bcaf7ca1 # v0.14.3

    - name: Run GoReleaser
      uses: goreleaser/goreleaser-action@3fa32b8bb5620a2c1afe798654bbad59f9da4906 # v4.4.0
      with:
        distribution: goreleaser
        version: latest
        args: release --clean --config .goreleaser.yaml --snapshot --skip-sign --skip-publish --skip-announce

  release:
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v')
    needs: [lint,audit,test,shellcheck]
    permissions:
      contents: write
      packages: write # publish a new github release
      id-token: write # needed for keyless signing
    steps:
      - name: Extract Version from Tag
        id: tag_name
        run: |
          echo "current_version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
        shell: bash

      - name: Checkout
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
        with:
          cache-dependency-path: './go.sum'
          check-latest: true
          go-version: '>=1.21.0'

      - name: Login to Docker Hub
        uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 # v3.1.1
      - uses: anchore/sbom-action/download-syft@78fc58e266e87a38d4194b2137a3d4e9bcaf7ca1 # v0.14.3

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@3fa32b8bb5620a2c1afe798654bbad59f9da4906 # v4.4.0
        with:
          distribution: goreleaser
          version: latest
          args: release --clean --config .goreleaser.yaml
        env:
          GITHUB_TOKEN: ${{ secrets.GORELEASER_GITHUB_TOKEN }}

      - name: Update Docker Hub Description
        uses: peter-evans/dockerhub-description@dc67fad7001ef9e8e3c124cb7a64e16d0a63d864 # v3.4.2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
          repository: openfga/cli
          short-description: ${{ github.event.repository.description }}