ci.yml

name: Go CI

on:
  push:
    branches:
      - '**'

jobs:
  lint:
    name: Lint Go project
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4.1.6
      - name: Set up Go
        uses: actions/setup-go@v5.0.1
        with:
          go-version: '1.22'
          cache: false
      - name: golangci-lint
        uses: golangci/golangci-lint-action@v6.0.1
        with:
          version: latest
          args: --timeout=10m

  test:
    name: Test Go project
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4.1.6

      - name: Set up Go
        uses: actions/setup-go@v5.0.1
        with:
          go-version: '1.22'
          cache: false

      - name: Install dependencies
        run: go mod download

      - name: Test
        run: go test ./controllers

  docker:
    name: Build and Push Docker Image
    runs-on: ubuntu-latest
    needs:
      - lint
      - test
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4.1.6

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3.3.0

      - name: Login to Docker Hub
        uses: docker/login-action@v3.2.0
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Short SHA
        id: sha
        run: echo "SHA_SHORT=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT

      - name: Build Docker image
        run: docker build -t ${{ secrets.DOCKER_USERNAME }}/${{ vars.APP_NAME }}:${{ steps.sha.outputs.sha_short }} .

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@0.20.0
        with:
          image-ref: ${{ secrets.DOCKER_USERNAME }}/${{ vars.APP_NAME }}:${{ steps.sha.outputs.sha_short }}
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'

      - name: Push Docker image
        run: docker push ${{ secrets.DOCKER_USERNAME }}/${{ vars.APP_NAME }}:${{ steps.sha.outputs.sha_short }}