main.yaml

name: Build, Test and Publish

on:
  merge_group:
  push:
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  lint:
    name: Lints
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
      with:
        fetch-depth: 0
    - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
      with:
        cache-dependency-path: './go.sum'
        check-latest: true
        go-version: '>=1.20.6'
    - name: golangci-lint
      uses: golangci/golangci-lint-action@639cd343e1d3b897ff35927a75193d57cfcba299 # v3.6.0
      with:
        version: latest

  audit:
    name: Security Audits
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
      with:
        fetch-depth: 0
    - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
      with:
        cache-dependency-path: './go.sum'
        check-latest: true
        go-version: '>=1.20.6'

    - name: Run govulncheck
      run: make audit

  test:
    name: Tests
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
      with:
        fetch-depth: 0

    - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
      with:
        cache-dependency-path: './go.sum'
        check-latest: true
        go-version: '>=1.20.6'

    - name: Build
      run: make build

    - name: Run unit test
      run: make test

  shellcheck:
    name: Shellcheck
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Run ShellCheck
        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 #2.0.0

  test-go-releaser:
    name: Test Release Process
    if: startsWith(github.ref, 'refs/tags/v') != true
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
      with:
        fetch-depth: 0
    - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
      with:
        cache-dependency-path: './go.sum'
        check-latest: true
        go-version: '>=1.20.6'

    - name: Extract Version from Tag
      id: tag_name
      run: |
        echo "current_version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
      shell: bash

    - name: Checkout
      uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
      with:
        fetch-depth: 0

    - name: Set up Go
      uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
      with:
        cache-dependency-path: './go.sum'
        check-latest: true
        go-version: '>=1.20.6'

    - uses: anchore/sbom-action/download-syft@78fc58e266e87a38d4194b2137a3d4e9bcaf7ca1 # v0.14.3

    - name: Run GoReleaser
      uses: goreleaser/goreleaser-action@336e29918d653399e599bfca99fadc1d7ffbc9f7 # v4.3.0
      with:
        distribution: goreleaser
        version: latest
        args: release --clean --config .goreleaser.yaml --snapshot --skip-sign --skip-publish --skip-announce

  release:
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v')
    needs: [lint,audit,test,shellcheck]
    permissions:
      contents: write
      packages: write # publish a new github release
      id-token: write # needed for keyless signing
    steps:
      - name: Extract Version from Tag
        id: tag_name
        run: |
          echo "current_version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
        shell: bash

      - name: Checkout
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
        with:
          cache-dependency-path: './go.sum'
          check-latest: true
          go-version: '>=1.20.6'

      - name: Login to Docker Hub
        uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 # v3.1.1
      - uses: anchore/sbom-action/download-syft@78fc58e266e87a38d4194b2137a3d4e9bcaf7ca1 # v0.14.3

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@336e29918d653399e599bfca99fadc1d7ffbc9f7 # v4.3.0
        with:
          distribution: goreleaser
          version: latest
          args: release --clean --config .goreleaser.yaml
        env:
          GITHUB_TOKEN: ${{ secrets.GORELEASER_GITHUB_TOKEN }}

      - name: Update Docker Hub Description
        uses: peter-evans/dockerhub-description@dc67fad7001ef9e8e3c124cb7a64e16d0a63d864 # v3.4.2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
          repository: openfga/cli
          short-description: ${{ github.event.repository.description }}