scan.yaml

name: Scan

# Run workflow each time code is pushed to your repository and on a schedule.
# The scheduled workflow runs every at 00:00 on Sunday UTC time.
on:
  push:
    tags:
    - v*
    branches:
    - main
  pull_request:
  #schedule:
  #- cron: '0 0 * * 0'

permissions:
  contents: read
  security-events: write

jobs:
  hadolint:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - uses: hadolint/hadolint-action@v3.1.0
      with:
        dockerfile: Dockerfile
  gosec:
    runs-on: ubuntu-latest
    steps:
    - name: Check out code into the Go module directory
      uses: actions/checkout@v4
    - name: Security Scan
      uses: securego/gosec@master
      with:
        # we let the report trigger content trigger a failure using the GitHub Security features.
        args: '-no-fail -fmt sarif -out results.sarif ./...'
    - name: Upload SARIF file
      uses: github/codeql-action/upload-sarif@v3
      with:
        # Path to SARIF file relative to the root of the repository
        sarif_file: results.sarif
  golangci:
    name: lint
    runs-on: ubuntu-latest
    steps:
    - uses: actions/setup-go@v5
    - uses: actions/checkout@v4
    - name: golangci-lint
      uses: golangci/golangci-lint-action@v6
      with:
        # Optional: version of golangci-lint to use in form of v1.2 or v1.2.3 or `latest` to use the latest version
        version: latest

        # Optional: working directory, useful for monorepos
        # working-directory: somedir

        # Optional: golangci-lint command line arguments.
        # args: --issues-exit-code=0
        args: --timeout=5m

        # Optional: show only new issues if it's a pull request. The default value is `false`.
        # only-new-issues: true

        # Optional: if set to true then the all caching functionality will be complete disabled,
        #           takes precedence over all other caching options.
        # skip-cache: true

        # Optional: if set to true then the action don't cache or restore ~/go/pkg.
        # skip-pkg-cache: true

        # Optional: if set to true then the action don't cache or restore ~/.cache/go-build.
        # skip-build-cache: true