Skip to content

Commit 0f3f09d

Browse files
MartinForRealMartinForReal
authored
add release pipeline (#3)
1 parent 7a67d47 commit 0f3f09d

File tree

11 files changed

+511
-0
lines changed

11 files changed

+511
-0
lines changed

‎.github/dependabot.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# To get started with Dependabot version updates, you'll need to specify which
2+
# package ecosystems to update and where the package manifests are located.
3+
# Please see the documentation for all configuration options:
4+
# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
5+
6+
version: 2
7+
updates:
8+
- package-ecosystem: "gomod" # See documentation for possible values
9+
directory: "/" # Location of package manifests
10+
schedule:
11+
interval: "daily"
12+
groups:
13+
all-gomod:
14+
applies-to: version-updates
15+
patterns:
16+
- "*"
17+
update-types:
18+
- "patch"
19+
- "minor"
20+
- "major"
21+
- package-ecosystem: "github-actions"
22+
directory: "/"
23+
schedule:
24+
interval: "daily"
25+
groups:
26+
all-gomod:
27+
applies-to: version-updates
28+
patterns:
29+
- "*"
30+
update-types:
31+
- "patch"
32+
- "minor"
33+
- "major"
34+
- package-ecosystem: "docker"
35+
directory: "/"
36+
schedule:
37+
interval: "daily"
38+
groups:
39+
all-gomod:
40+
applies-to: version-updates
41+
patterns:
42+
- "*"
43+
update-types:
44+
- "patch"
45+
- "minor"
46+
- "major"

‎.github/workflows/ci.yml‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
name: Go CI
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
push:
8+
branches:
9+
- main
10+
11+
jobs:
12+
lint:
13+
name: Lint
14+
runs-on: ubuntu-latest
15+
steps:
16+
- name: Checkout code
17+
uses: actions/[email protected]
18+
with:
19+
fetch-depth: 0
20+
21+
- name: Set up Go
22+
uses: actions/setup-go@v5
23+
with:
24+
go-version: '1.24'
25+
check-latest: true
26+
cache: true
27+
28+
- name: Lint
29+
uses: golangci/golangci-lint-action@v8
30+
with:
31+
version: latest
32+
args: --timeout=5m
33+
34+
test:
35+
name: Test
36+
runs-on: ubuntu-latest
37+
steps:
38+
- name: Checkout code
39+
uses: actions/[email protected]
40+
with:
41+
fetch-depth: 0
42+
43+
- name: Set up Go
44+
uses: actions/setup-go@v5
45+
with:
46+
go-version: '1.24'
47+
check-latest: true
48+
cache: true
49+
50+
- name: Install dependencies
51+
run: go mod download
52+
53+
- name: Run tests with coverage
54+
run: go test -race -coverprofile=coverage.txt -covermode=atomic ./...
55+
continue-on-error: true
56+
57+
- name: Upload coverage to Codecov
58+
uses: codecov/codecov-action@v5
59+
with:
60+
file: ./coverage.txt
61+
fail_ci_if_error: false
62+
63+
- name: Archive code coverage results
64+
uses: actions/upload-artifact@v4
65+
with:
66+
name: code-coverage-report
67+
path: coverage.txt
68+
retention-days: 14
69+
70+
build:
71+
name: Build
72+
runs-on: ubuntu-latest
73+
needs: [lint, test]
74+
steps:
75+
- name: Checkout code
76+
uses: actions/[email protected]
77+
with:
78+
fetch-depth: 0
79+
80+
- name: Set up Go
81+
uses: actions/setup-go@v5
82+
with:
83+
go-version: '1.24'
84+
check-latest: true
85+
cache: true
86+
87+
- name: Build binary
88+
run: |
89+
go build -o aks-mcp ./cmd/aks-mcp
90+
91+
- name: Build Docker image
92+
run: docker build -t aks-mcp:test .
93+
94+
- name: Check Docker image
95+
run: |
96+
docker images aks-mcp:test
97+
docker run --rm aks-mcp:test --help || true
98+
99+
security:
100+
name: Security Scan
101+
runs-on: ubuntu-latest
102+
steps:
103+
- name: Checkout code
104+
uses: actions/[email protected]
105+
with:
106+
fetch-depth: 0
107+
108+
- name: Run Gosec Security Scanner
109+
uses: securego/gosec@master
110+
with:
111+
args: ./...

‎.github/workflows/go-ossf-slsa3-publish.yml‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
# This workflow uses actions that are not certified by GitHub.
2+
# They are provided by a third-party and are governed by
3+
# separate terms of service, privacy policy, and support
4+
# documentation.
5+
6+
# This workflow lets you compile your Go project using a SLSA3 compliant builder.
7+
# This workflow will generate a so-called "provenance" file describing the steps
8+
# that were performed to generate the final binary.
9+
# The project is an initiative of the OpenSSF (openssf.org) and is developed at
10+
# https://github.com/slsa-framework/slsa-github-generator.
11+
# The provenance file can be verified using https://github.com/slsa-framework/slsa-verifier.
12+
# For more information about SLSA and how it improves the supply-chain, visit slsa.dev.
13+
14+
name: SLSA releaser
15+
on:
16+
workflow_dispatch:
17+
push:
18+
tags:
19+
- "v*"
20+
21+
permissions: read-all
22+
env:
23+
IMAGE_REGISTRY: ghcr.io
24+
IMAGE_NAME: ${{ github.repository }}
25+
jobs:
26+
# Generate ldflags dynamically.
27+
# Optional: only needed for ldflags.
28+
args:
29+
runs-on: ubuntu-latest
30+
outputs:
31+
commit-date: ${{ steps.ldflags.outputs.commit-date }}
32+
commit: ${{ steps.ldflags.outputs.commit }}
33+
version: ${{ steps.ldflags.outputs.version }}
34+
tree-state: ${{ steps.ldflags.outputs.tree-state }}
35+
steps:
36+
- id: checkout
37+
uses: actions/checkout@85e6279cec87321a52edac9c87bce653a07cf6c2 # tag=v2.3.4
38+
with:
39+
fetch-depth: 0
40+
- id: ldflags
41+
run: |
42+
echo "commit-date=$(git log --date=iso8601-strict -1 --pretty=%ct)" >> "$GITHUB_OUTPUT"
43+
echo "commit=$GITHUB_SHA" >> "$GITHUB_OUTPUT"
44+
echo "version=$(git describe --tags --always --dirty | cut -c2-)" >> "$GITHUB_OUTPUT"
45+
echo "tree-state=$(if git diff --quiet; then echo "clean"; else echo "dirty"; fi)" >> "$GITHUB_OUTPUT"
46+
build:
47+
permissions:
48+
id-token: write # To sign.
49+
contents: write # To upload release assets.
50+
actions: read # To read workflow path.
51+
strategy:
52+
matrix:
53+
os:
54+
- linux
55+
- windows
56+
- darwin
57+
arch:
58+
- amd64
59+
- arm64
60+
needs: args
61+
uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
62+
with:
63+
go-version: 1.23
64+
private-repository: true
65+
config-file: .slsa-goreleaser/${{matrix.os}}-${{matrix.arch}}.yml
66+
evaluated-envs: "COMMIT_DATE:${{needs.args.outputs.commit-date}}, COMMIT:${{needs.args.outputs.commit}}, VERSION:${{needs.args.outputs.version}}, TREE_STATE:${{needs.args.outputs.tree-state}}"
67+
# =============================================================================================================
68+
# Optional: For more options, see https://github.com/slsa-framework/slsa-github-generator#golang-projects
69+
# =============================================================================================================
70+
71+
build-image:
72+
permissions:
73+
contents: read
74+
packages: write
75+
needs: args
76+
outputs:
77+
image: ${{ steps.image.outputs.image }}
78+
digest: ${{ steps.build.outputs.digest }}
79+
runs-on: ubuntu-latest
80+
steps:
81+
- name: Checkout the repository
82+
uses: actions/checkout@85e6279cec87321a52edac9c87bce653a07cf6c2 # v2.3.4
83+
84+
- name: Set up Docker Buildx
85+
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
86+
87+
- name: Authenticate Docker
88+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
89+
with:
90+
registry: ${{ env.IMAGE_REGISTRY }}
91+
username: ${{ github.actor }}
92+
password: ${{ secrets.GITHUB_TOKEN }}
93+
94+
- name: Extract metadata (tags, labels) for Docker
95+
id: meta
96+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
97+
with:
98+
images: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}
99+
100+
- name: Build and push Docker image
101+
uses: docker/build-push-action@1dc73863535b631f98b2378be8619f83b136f4a0 # v6.17.0
102+
id: build
103+
with:
104+
push: true
105+
tags: ${{ steps.meta.outputs.tags }}
106+
labels: ${{ steps.meta.outputs.labels }}
107+
build-args: |
108+
VERSION=${{ needs.args.outputs.version }}
109+
GIT_COMMIT=${{ needs.args.outputs.commit }}
110+
BUILD_DATE=${{ needs.args.outputs.commit-date }}
111+
GIT_TREE_STATE=${{ needs.args.outputs.tree-state }}
112+
- name: Output image
113+
id: image
114+
run: |
115+
# NOTE: Set the image as an output because the `env` context is not
116+
# available to the inputs of a reusable workflow call.
117+
image_name=$(echo "${IMAGE_REGISTRY}/${IMAGE_NAME}"| tr '[:upper:]' '[:lower:]')
118+
echo "image=$image_name" >> "$GITHUB_OUTPUT"
119+
# This step calls the container workflow to generate provenance and push it to
120+
# the container registry.
121+
provenance:
122+
needs: build-image
123+
permissions:
124+
actions: read # for detecting the Github Actions environment.
125+
id-token: write # for creating OIDC tokens for signing.
126+
packages: write # for uploading attestations.
127+
uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
128+
with:
129+
image: ${{ needs.build-image.outputs.image }}
130+
digest: ${{ needs.build-image.outputs.digest }}
131+
registry-username: ${{ github.actor }}
132+
private-repository: true
133+
secrets:
134+
registry-password: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/lint.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
name: golangci-lint
2+
on:
3+
push:
4+
branches:
5+
- main
6+
- master
7+
pull_request:
8+
9+
permissions:
10+
contents: read
11+
# Optional: allow read access to pull request. Use with `only-new-issues` option.
12+
# pull-requests: read
13+
14+
jobs:
15+
golangci:
16+
strategy:
17+
matrix:
18+
go: [stable]
19+
os: [ubuntu-latest, macos-latest, windows-latest]
20+
name: lint
21+
runs-on: ${{ matrix.os }}
22+
steps:
23+
- uses: actions/checkout@v4
24+
- uses: actions/setup-go@v5
25+
with:
26+
go-version: ${{ matrix.go }}
27+
- name: golangci-lint
28+
uses: golangci/golangci-lint-action@v8
29+
with:
30+
version: v2.1

‎.slsa-goreleaser/darwin-amd64.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# Version for this file.
2+
version: 1
3+
4+
# (Optional) List of env variables used during compilation.
5+
env:
6+
- GO111MODULE=on
7+
- CGO_ENABLED=0
8+
9+
# The OS to compile for. `GOOS` env variable will be set to this value.
10+
goos: darwin
11+
12+
# The architecture to compile for. `GOARCH` env variable will be set to this value.
13+
goarch: amd64
14+
15+
# (Optional) Entrypoint to compile.
16+
main: ./cmd/aks-mcp
17+
18+
# (Optional) Working directory. (default: root of the project)
19+
# dir: ./relative/path/to/dir
20+
21+
# Binary output name.
22+
# {{ .Os }} will be replaced by goos field in the config file.
23+
# {{ .Arch }} will be replaced by goarch field in the config file.
24+
binary: aks-mcp-{{ .Os }}-{{ .Arch }}

‎.slsa-goreleaser/darwin-arm64.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# Version for this file.
2+
version: 1
3+
4+
# (Optional) List of env variables used during compilation.
5+
env:
6+
- GO111MODULE=on
7+
- CGO_ENABLED=0
8+
9+
# The OS to compile for. `GOOS` env variable will be set to this value.
10+
goos: darwin
11+
12+
# The architecture to compile for. `GOARCH` env variable will be set to this value.
13+
goarch: arm64
14+
15+
# (Optional) Entrypoint to compile.
16+
main: ./cmd/aks-mcp
17+
18+
# (Optional) Working directory. (default: root of the project)
19+
# dir: ./relative/path/to/dir
20+
21+
# Binary output name.
22+
# {{ .Os }} will be replaced by goos field in the config file.
23+
# {{ .Arch }} will be replaced by goarch field in the config file.
24+
binary: aks-mcp-{{ .Os }}-{{ .Arch }}

0 commit comments

Comments
 (0)