linode-cloud-controller-manager/.github/workflows/build-test.yml at 32becc38b378489dc3bff5c7c6dd6eff2915c104 · linode/linode-cloud-controller-manager · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
name: Build Test
on:
  push:
    branches:
      - main
  pull_request: null

permissions:
  contents: read
  pull-requests: read
  actions: read

concurrency:
  group: build-test-${{ github.event.pull_request.number || github.ref_name }}
  cancel-in-progress: true

jobs:
  changes:
    runs-on: ubuntu-latest
    outputs:
      paths: ${{ steps.filter.outputs.changes }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            github.com:443
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.event.pull_request.head.sha }}
      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
        id: filter
        with:
          base: ${{ github.ref }}
          filters: .github/filters.yml

  build-test:
    runs-on: ubuntu-latest
    needs: changes
    if: ${{ contains(fromJSON(needs.changes.outputs.paths), 'src') }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            github.com:443
            golang.org:443
            proxy.golang.org:443
            sum.golang.org:443
            dl.google.com:443
            *.githubusercontent.com:443
            storage.googleapis.com:443
            cli.codecov.io:443
            api.codecov.io:443
            ingest.codecov.io:443
            get.helm.sh:443
            golangci-lint.run:443
            mise.jdx.dev:443
            mise-versions.jdx.dev:443
            tuf-repo-cdn.sigstore.dev:443
            dl.k8s.io:443
            get.helm.sh:443
            githubapp.com:443
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Set up Mise
        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
        with:
          install_args: go golangci-lint helm

      - name: Vet
        run: mise run vet

      - name: lint
        run: mise run lint

      - name: nilcheck
        run: mise run nilcheck

      - name: Helm Lint
        run: mise run helm-lint

      - name: Test
        run: mise run test

      - name: Build
        run: mise run build

  ko-build:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            auth.docker.io:443
            dl.google.com:443
            github.com:443
            production.cloudflare.docker.com:443
            golang.org:443
            proxy.golang.org:443
            registry-1.docker.io:443
            sum.golang.org:443
            storage.googleapis.com:443
            production.cloudfront.docker.com:443
            sentry.io:443
            cli.codecov.io:443
            api.codecov.io:443
            ingest.codecov.io:443
            get.helm.sh:443
            golangci-lint.run:443
            tuf-repo-cdn.sigstore.dev:443
            dl.k8s.io:443
            get.helm.sh:443
            githubapp.com:443
            cgr.dev:443
            mise.jdx.dev:443
            mise-versions.jdx.dev:443
            *.githubusercontent.com:443
            *.githubapp.com:443
            gcr.io:443
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Set up Mise
        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
        with:
          install_args: go ko

      - name: Validate ko image build
        run: mise run ko-build