VAST collation MVP (#140) #309
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI/CD Pipeline | |
| on: | |
| pull_request: | |
| branches: [ 'main' ] | |
| push: | |
| branches: [ 'main' ] | |
| permissions: | |
| contents: read | |
| packages: write | |
| security-events: write | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: openads-auction/openadsserver | |
| jobs: | |
| test: | |
| name: Test and Validate | |
| runs-on: ubuntu-22.04 | |
| if: github.event_name == 'pull_request' || github.event_name == 'push' | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.23.0' | |
| cache: true | |
| - name: Cache Go modules | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cache/go-build | |
| ~/go/pkg/mod | |
| key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} | |
| restore-keys: | | |
| ${{ runner.os }}-go- | |
| - name: Install dependencies | |
| run: | | |
| go mod download | |
| go mod verify | |
| - name: Run validation script | |
| run: | | |
| chmod +x validate.sh | |
| ./validate.sh --cov --race 2 | |
| build: | |
| name: Build Docker Image | |
| needs: test | |
| runs-on: ubuntu-22.04 | |
| permissions: | |
| contents: write | |
| packages: write | |
| if: | | |
| (github.event_name == 'push' && github.ref_name == github.event.repository.default_branch) || | |
| (github.event_name == 'pull_request' && (github.event.action == 'opened' || github.event.action == 'synchronize')) | |
| outputs: | |
| version: ${{ steps.version.outputs.tag }} | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Log in to Container Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Generate version tag | |
| id: version | |
| run: | | |
| SHORT_SHA=$(git rev-parse --short ${{ github.sha }}) | |
| if [ "${{ github.event_name }}" = "pull_request" ]; then | |
| echo "tag=pr-${{ github.event.number }}" >> $GITHUB_OUTPUT | |
| echo "unique_tag=pr-${{ github.event.number }}-${SHORT_SHA}" >> $GITHUB_OUTPUT | |
| else | |
| CALVER=$(date -u +%Y.%m.%d)-${SHORT_SHA} | |
| echo "tag=${CALVER}" >> $GITHUB_OUTPUT | |
| echo "unique_tag=${CALVER}" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Push git tag | |
| id: tag | |
| if: github.event_name == 'push' && github.ref_name == github.event.repository.default_branch | |
| run: | | |
| git tag ${{ steps.version.outputs.tag }} | |
| git push origin ${{ steps.version.outputs.tag }} | |
| - name: Extract metadata | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| tags: | | |
| type=raw,value=${{ steps.version.outputs.tag }} | |
| type=raw,value=${{ steps.version.outputs.unique_tag }} | |
| type=raw,value=latest,enable={{is_default_branch}} | |
| - name: Build and push Docker image | |
| id: build | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: . | |
| platforms: linux/amd64 | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Extract attestation artifacts from Docker image | |
| run: | | |
| IMAGE_TAG="${{ steps.version.outputs.unique_tag }}" | |
| # Create a temporary container to extract artifacts | |
| CONTAINER_ID=$(docker create ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:$IMAGE_TAG) | |
| docker cp $CONTAINER_ID:/artifacts ./artifacts | |
| docker rm $CONTAINER_ID | |
| # Verify artifacts were extracted | |
| if [ -f "artifacts/build_key.pub" ]; then | |
| echo "✅ Successfully extracted attestation artifacts from Docker build" | |
| echo "Public key:" | |
| cat artifacts/build_key.pub | |
| else | |
| echo "❌ Failed to extract attestation artifacts" | |
| exit 1 | |
| fi | |
| - name: Upload public key artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: build-public-key-${{ github.sha }} | |
| path: artifacts/build_key.pub | |
| retention-days: ${{ github.event_name == 'pull_request' && 30 || 365 }} | |
| # security-scan: | |
| # name: Security Scan | |
| # needs: build | |
| # runs-on: ubuntu-22.04 | |
| # if: always() && needs.build.result == 'success' | |
| # steps: | |
| # - name: Checkout Code | |
| # uses: actions/checkout@v4 | |
| # | |
| # - name: Run Trivy vulnerability scanner | |
| # uses: aquasecurity/trivy-action@master | |
| # with: | |
| # scan-type: 'fs' | |
| # ignore-unfixed: true | |
| # format: 'sarif' | |
| # output: 'trivy-results.sarif' | |
| # severity: 'CRITICAL,HIGH' | |
| # | |
| # - name: Upload Trivy scan results to GitHub Security tab | |
| # uses: github/codeql-action/upload-sarif@v3 | |
| # if: always() | |
| # with: | |
| # sarif_file: 'trivy-results.sarif' | |
| release: | |
| name: Create Release | |
| needs: [build] #[build, security-scan] | |
| runs-on: ubuntu-22.04 | |
| if: github.event_name == 'push' && github.ref_name == github.event.repository.default_branch | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Download public key artifact | |
| if: needs.build.result == 'success' | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: build-public-key-${{ github.sha }} | |
| path: artifacts/ | |
| - name: Create Release | |
| uses: softprops/action-gh-release@v1 | |
| with: | |
| files: artifacts/build_key.pub | |
| generate_release_notes: true | |
| draft: false | |
| prerelease: false | |
| tag_name: ${{ needs.build.outputs.version }} | |
| name: Release ${{ needs.build.outputs.version }} | |
| body: | | |
| ## Docker Image | |
| ```bash | |
| docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.build.outputs.version }} | |
| ``` | |
| token: ${{ secrets.GITHUB_TOKEN }} |