docs: document CycloneDX SBOM export across docs and monitor help (#37) #140
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI/CD Pipeline | |
| on: | |
| push: | |
| branches: [ main ] | |
| pull_request: | |
| branches: [ main ] | |
| release: | |
| types: [ created ] | |
| permissions: | |
| contents: read | |
| security-events: write # Required for SARIF upload | |
| packages: write # Required for GHCR Docker push | |
| jobs: | |
| # ============ BUILD & TEST ============ | |
| build-test: | |
| name: Build & Test | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: '1.26.4' | |
| cache: true | |
| - name: Download dependencies | |
| run: go mod download | |
| - name: Verify module checksums | |
| run: go mod verify | |
| - name: Scan for known CVEs (govulncheck) | |
| run: | | |
| go install golang.org/x/vuln/cmd/govulncheck@latest | |
| govulncheck ./... | |
| - name: Run go vet | |
| run: go vet ./... | |
| - name: Run tests | |
| run: go test ./... -v -race -coverprofile=coverage.out -covermode=atomic | |
| - name: Upload coverage | |
| uses: codecov/codecov-action@v7 | |
| with: | |
| files: ./coverage.out | |
| - name: Build binary | |
| run: | | |
| mkdir -p bin | |
| go build \ | |
| -ldflags "-X main.Version=$(git describe --tags --always 2>/dev/null || echo '0.1.0') \ | |
| -X github.com/filipi86/drogonsec/internal/cli.Environment=production" \ | |
| -o bin/drogonsec \ | |
| ./cmd/drogonsec | |
| # ============ LINT ============ | |
| lint: | |
| name: Lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version: '1.26.4' | |
| cache: true | |
| - name: Run golangci-lint | |
| uses: golangci/golangci-lint-action@v9 | |
| with: | |
| version: latest | |
| # ============ SECURITY SCAN (Dogfooding - DrogonSec scanning itself) ============ | |
| security-scan: | |
| name: Security Scan (DrogonSec) | |
| runs-on: ubuntu-latest | |
| needs: build-test | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version: '1.26.4' | |
| cache: true | |
| - name: Build DrogonSec | |
| run: make build | |
| - name: Scan with DrogonSec (SARIF output) | |
| continue-on-error: true | |
| run: | | |
| ./bin/drogonsec scan . \ | |
| --format sarif \ | |
| --output drogonsec.sarif \ | |
| --severity MEDIUM | |
| - name: Upload SARIF to GitHub Security | |
| if: hashFiles('drogonsec.sarif') != '' | |
| uses: github/codeql-action/upload-sarif@v4 | |
| with: | |
| sarif_file: drogonsec.sarif | |
| continue-on-error: true | |
| # ============ RELEASE ============ | |
| release: | |
| name: Release Binaries | |
| runs-on: ubuntu-latest | |
| needs: [ build-test, lint ] | |
| if: github.event_name == 'release' | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version: '1.26.4' | |
| - name: Build all platforms | |
| run: make release | |
| - name: Create checksums | |
| run: | | |
| cd bin | |
| sha256sum drogonsec-* > SHA256SUMS.txt | |
| - name: Upload release assets | |
| uses: softprops/action-gh-release@v3 | |
| with: | |
| files: | | |
| bin/drogonsec-linux-amd64 | |
| bin/drogonsec-darwin-amd64 | |
| bin/drogonsec-darwin-arm64 | |
| bin/drogonsec-windows-amd64.exe | |
| bin/SHA256SUMS.txt | |
| # ============ DOCKER ============ | |
| docker: | |
| name: Build & Push Docker | |
| runs-on: ubuntu-latest | |
| needs: [ build-test ] | |
| if: github.ref == 'refs/heads/main' || github.event_name == 'release' | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Login to GitHub Container Registry | |
| uses: docker/login-action@v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build and push | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: . | |
| push: true | |
| tags: | | |
| ghcr.io/${{ github.repository }}:latest | |
| ghcr.io/${{ github.repository }}:${{ github.sha }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max |