main.yaml

name: Build, Test and Publish

on:
  merge_group:
  push:
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  lint:
    name: Lints
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.5.4
      with:
        fetch-depth: 0
    - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
      with:
        cache-dependency-path: './go.sum'
        check-latest: true
        go-version: '>=1.21.0'
    - name: golangci-lint
      uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0
      with:
        version: latest

  audit:
    name: Security Audits
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.5.4
      with:
        fetch-depth: 0
    - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
      with:
        cache-dependency-path: './go.sum'
        check-latest: true
        go-version: '>=1.21.0'

    - name: Run govulncheck
      run: make audit

  test:
    name: Tests
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.5.4
      with:
        fetch-depth: 0

    - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
      with:
        cache-dependency-path: './go.sum'
        check-latest: true
        go-version: '>=1.21.0'

    - name: Build
      run: make build

    - name: Run unit test
      run: make test

  shellcheck:
    name: Shellcheck
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
      - name: Run ShellCheck
        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 #2.0.0

  test-go-releaser:
    name: Test Release Process
    if: startsWith(github.ref, 'refs/tags/v') != true
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.5.4
      with:
        fetch-depth: 0
    - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
      with:
        cache-dependency-path: './go.sum'
        check-latest: true
        go-version: '>=1.21.0'

    - name: Extract Version from Tag
      id: tag_name
      run: |
        echo "current_version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
      shell: bash

    - name: Checkout
      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.5.4
      with:
        fetch-depth: 0

    - name: Set up Go
      uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
      with:
        cache-dependency-path: './go.sum'
        check-latest: true
        go-version: '>=1.21.0'

    - uses: anchore/sbom-action/download-syft@78fc58e266e87a38d4194b2137a3d4e9bcaf7ca1 # v0.14.3

    - name: Run GoReleaser
      uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
      with:
        distribution: goreleaser
        version: latest
        args: release --clean --config .goreleaser.yaml --snapshot --skip-sign --skip-publish --skip-announce

  release:
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v')
    needs: [lint,audit,test,shellcheck]
    permissions:
      contents: write
      packages: write # publish a new github release
      id-token: write # needed for keyless signing
    steps:
      - name: Extract Version from Tag
        id: tag_name
        run: |
          echo "current_version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
        shell: bash

      - name: Checkout
        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.5.4
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
        with:
          cache-dependency-path: './go.sum'
          check-latest: true
          go-version: '>=1.21.0'

      - name: Login to Docker Hub
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - uses: sigstore/cosign-installer@11086d25041f77fe8fe7b9ea4e48e3b9192b8f19 # v3.1.2
      - uses: anchore/sbom-action/download-syft@78fc58e266e87a38d4194b2137a3d4e9bcaf7ca1 # v0.14.3

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
        with:
          distribution: goreleaser
          version: latest
          args: release --clean --config .goreleaser.yaml
        env:
          GITHUB_TOKEN: ${{ secrets.GORELEASER_GITHUB_TOKEN }}

      - name: Update Docker Hub Description
        uses: peter-evans/dockerhub-description@dc67fad7001ef9e8e3c124cb7a64e16d0a63d864 # v3.4.2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
          repository: openfga/cli
          short-description: ${{ github.event.repository.description }}