@@ -7,18 +7,21 @@ on:
77 pull_request:
88 branches:
99 - '**'
10+ workflow_dispatch:
11+
1012permissions:
1113 contents: read
1214 id-token: write
15+ security-events: write
1316
1417jobs:
1518 build:
1619 runs-on: ubuntu-latest
17− env:
18− COVER: true
1920 steps:
2021 - name: Check out code
2122 uses: actions/checkout@v6
23+ with:
24+ fetch-depth: 0
2225
2326 - name: Get Go version
2427 run: |
@@ -33,11 +36,10 @@ jobs:
3336 check-latest: true
3437
3538 - name: Install golangci-lint
36− env:
37− # renovate: datasource=github-tags depName=golangci/golangci-lint
38− GOLANGCI_LINT_VERSION: v2.8.0
39− run: |
40− curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin ${GOLANGCI_LINT_VERSION}
39+ uses: golangci/golangci-lint-action@v9
40+ with:
41+ install-only: true
42+ version: v2.8.0 # renovate: datasource=github-tags depName=golangci/golangci-lint
4143
4244 - name: Verify Code Generation
4345 run: |
@@ -59,13 +61,15 @@ jobs:
5961 make release
6062
6163 - name: Test
64+ env:
65+ COVER: true
6266 run: |
6367 make test
6468
6569 - name: Generate Coverage Report
6670 if: github.event_name == 'push'
6771 run: |
68− go install github.com/jandelgado/gcov2lcov@latest
72+ go install github.com/jandelgado/gcov2lcov@25681830fb515e3d4c117e136b4f049e21efb4d0
6973 gcov2lcov -infile=c.out -outfile=lcov.info
7074
7175 - name: Upload Coverage Report
@@ -75,11 +79,30 @@ jobs:
7579 oidc: true
7680 files: lcov.info
7781
82+ - name: Run Trivy vulnerability scanner
83+ if: (!startsWith(github.head_ref, 'release'))
84+ uses: aquasecurity/trivy-action@0.35.0
85+ with:
86+ scan-type: 'rootfs'
87+ scan-ref: './oauth2-proxy'
88+ severity: 'CRITICAL,HIGH'
89+ hide-progress: true
90+ format: 'sarif'
91+ output: 'trivy-results.sarif'
92+ exit-code: '0'
93+
94+ - name: Upload Trivy scan results
95+ uses: github/codeql-action/upload-sarif@v4
96+ with:
97+ sarif_file: 'trivy-results.sarif'
98+
7899 docker:
79100 runs-on: ubuntu-latest
80101 steps:
81102 - name: Check out code
82103 uses: actions/checkout@v6
104+ with:
105+ fetch-depth: 0
83106
84107 - name: Set up QEMU
85108 uses: docker/setup-qemu-action@v3