AST-162098: Migrate CI/CD from CircleCI to GitHub Actions

.github/workflows/codecov-scan.yaml

@@ -1,5 +1,4 @@
-
-name: Codecov Scan
+name: Coverage
 
 on:
   push:
@@ -8,39 +7,48 @@ on:
   pull_request:
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
 jobs:
   run:
+    name: Coverage
     runs-on: cx-public-ubuntu-x64
 
     steps:
     - name: Checkout code
       uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      with:
+        persist-credentials: false
 
     - name: Set up Go
       uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
       with:
         go-version-file: go.mod
-      env:
-        GOPROXY: direct
-        GONOSUMDB: "*"
-        GOPRIVATE: https://github.com/CheckmarxDev/
 
-    - name: Install dependencies 
-      run: go install golang.org/x/tools/cmd/cover@latest
+    - name: Run tests and generate coverage
+      run: go test ./... -coverpkg=./... -v -coverprofile cover.out
 
-    - name: Run tests and generate coverage 
+    - name: Report coverage
+      if: always()
       run: |
-        go test ./... -coverpkg=./... -v -coverprofile cover.out
-
-
-    - name: Upload coverage to Codecov
-      uses: step-security/codecov-action@87e66f47a0f8ab4cae465a323eb9ec63d8b6b875 # v6.0.1
+        if [ -f cover.out ]; then
+          CODE_COV=$(go tool cover -func cover.out | grep total | awk '{print substr($3, 1, length($3)-1)}')
+          go tool cover -html=cover.out -o coverage.html
+          echo "### Coverage: ${CODE_COV}%" >> "$GITHUB_STEP_SUMMARY"
+        else
+          echo "### Coverage: no cover.out produced" >> "$GITHUB_STEP_SUMMARY"
+        fi
+
+    - name: Upload coverage report
+      if: always()
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
-        token: ${{ secrets.CODECOV_TOKEN }} 
-        files: ./cover.out  
-        flags: target=auto
-        fail_ci_if_error: true
-        verbose: false
+        name: coverage-report
+        path: coverage.html
+        retention-days: 7
+        if-no-files-found: warn

.github/workflows/cx-one-scan.yaml

@@ -9,13 +9,24 @@ on:
   schedule:
     - cron: '00 7 * * *'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   cx-one-scan:
     name: cx-one-scan
+    permissions:
+      contents: read
     runs-on: cx-public-ubuntu-x64
     steps:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - name: Checkmarx One CLI Action
         uses: checkmarx/ast-github-action@86e9ae570a811f9a1fb85903647a307aa3bf6253 # 2.0.44
         with:

.github/workflows/govulncheck.yaml

@@ -0,0 +1,33 @@
+name: Govulncheck
+
+on:
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  govulncheck:
+    name: Govulncheck
+    runs-on: cx-public-ubuntu-x64
+    steps:
+      - name: Checkout
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+        with:
+          go-version-file: go.mod
+
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@0782b76014f15f24e22a438f30f308df42899ba1 # v1.3.0
+
+      - name: Run govulncheck
+        run: govulncheck ./...
+        continue-on-error: true

.github/workflows/lint.yaml

@@ -0,0 +1,40 @@
+name: Lint
+
+on:
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  golangci-lint:
+    name: Lint (golangci-lint)
+    runs-on: cx-public-ubuntu-x64
+    permissions:
+      contents: read  # for actions/checkout to fetch code
+      pull-requests: read  # for golangci-lint-action to fetch pull requests
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+        with:
+          go-version-file: go.mod
+
+      - name: go mod tidy
+        run: go mod tidy
+
+      - name: Run golangci-lint
+        uses: step-security/golangci-lint-action@1797facf9ea427614d729a4e9cab0fae1a7852d9 # v9.2.0
+        with:
+          version: v2.11.3
+          args: -c .golangci.yml --timeout 10m
+          only-new-issues: true

.github/workflows/pr-linter.yaml

@@ -0,0 +1,27 @@
+name: PR Linter
+
+on:
+  pull_request:
+    types: [opened, edited]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    name: Validate PR Title
+    runs-on: cx-public-ubuntu-x64
+    steps:
+      - name: Check PR Title
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          if ! [[ "$PR_TITLE" =~ ^AST-[0-9]+:\ .+ ]]; then
+            echo "::error::PR title must start with a Jira ticket ID in the format 'AST-XXXX: Description'."
+            exit 1
+          fi
+        shell: bash

.gitignore

@@ -18,6 +18,7 @@
 
 !README.md
 !LICENSE
+!CLAUDE.md
 
 !*.yml
 !*.json