ci.yml

name: CI
on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main
    tags:
      - v*

  # Allows to run this via the Actions tab
  workflow_dispatch:

permissions: {}

concurrency:
  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    permissions:
      # Required: allow read access to the content for analysis.
      contents: read
      # Optional: allow read access to pull request. Use with `only-new-issues` option.
      pull-requests: read
      # Optional: Allow write access to checks to allow the action to annotate code in the PR.
      checks: write
    name: Linter
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod
          cache: false
      - name: golangci-lint
        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
        with:
          # Require: The version of golangci-lint to use.
          # When `install-mode` is `binary` (default) the value can be v1.2 or v1.2.3 or `latest` to use the latest version.
          # When `install-mode` is `goinstall` the value can be v1.2.3, `latest`, or the hash of a commit.
          version: v2.11.3

  check-license:
    name: License scan
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
    env:
      REPORT_FILE: gl-license-scanning-report.json

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod
          cache: false
      - name: License scanning
        run: |
          go install github.com/google/go-licenses@v1.6.0
          go-licenses check . --disallowed_types=forbidden,restricted
      - name: Generate license report
        run: |
          go-licenses report . > licenses.csv
      - name: Save license scan report
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: license_scanning
          path: licenses.csv

  check-go-releaser:
    name: Go releaser check
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod
          cache: false
      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
        with:
          # either 'goreleaser' (default) or 'goreleaser-pro'
          distribution: goreleaser
          # 'latest', 'nightly', or a semver
          version: v1.25.1
          args: check

  test:
    name: Tests
    needs:
      - lint
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod
          cache: false
      - name: Run tests
        run: go test -v ./...

  security:
    name: GoReleaser artifacts - govulncheck, Trivy secrets/vulns, Grype
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod
          cache: false
      - name: Check reachable Go vulnerabilities
        run: go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./...
      - name: Build GoReleaser snapshot artifacts
        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
        with:
          distribution: goreleaser
          version: v1.25.1
          args: release --snapshot --clean --skip=publish
      - name: Verify and prepare all release artifacts
        run: scripts/prepare-artifact-scan-rootfs.sh
      - name: Import release artifacts for scanning
        run: docker import artifact-scan/rootfs.tar stackstate-backup-cli:security-scan
      - name: Scan release artifacts with Trivy, Grype, and VEX
        uses: StackVista/image-pipeline/.github/actions/scan-image@6284a6fc006a7cc46a7f00d02c50d5f21b117b63 # main as of 2026-07-10
        with:
          image: stackstate-backup-cli:security-scan
          mode: gate
          severity: CRITICAL,HIGH,MEDIUM,LOW
          with-grype: "true"
          upload-sarif: "false"
      - name: Upload security evidence
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: release-artifact-security
          path: |
            artifact-scan/metadata/
            dist/*_checksums.txt
            reports/
          if-no-files-found: warn

  publish:
    name: Publish the release
    if: ${{ github.ref_type == 'tag' }}
    needs:
      - test
      - security
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: write
    env:
      TAG: ${{ github.ref_name }}
      S3_BUCKET: "s3://cli-dl.stackstate.com/stackstate-backup-cli/"
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod
          cache: false
      - name: Go releaser publish
        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
        with:
          # either 'goreleaser' (default) or 'goreleaser-pro'
          distribution: goreleaser
          # 'latest', 'nightly', or a semver
          version: v1.25.1
          args: release
      - name: Write latest version to file
        run: mkdir -p dist && echo "${TAG}" > dist/LATEST_VERSION

      - name: Authenticate with AWS
        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ secrets.AWS_DEFAULT_REGION }}

      - name: Publish latest version to S3
        run: |
          echo "aws s3 cp dist/LATEST_VERSION ${S3_BUCKET}"
          aws s3 cp dist/LATEST_VERSION "${S3_BUCKET}"