基于 GitHub Actions 的 CI/CD #

jobs:
  job1:
  job2:
    needs: job1
  job3:
    needs: [job1, job2]

jobs:
  job1:
  job2:
    needs: job1
  job3:
    if: ${{ always() }}
    needs: [job1, job2]

name: Go Test
on: [push, pull_request]

jobs:
build:
    name: Test with go ${{ matrix.go_version }} on ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
strategy:
  matrix:
    go_version: [1.15, 1.16]
    os: [ubuntu-latest, macOS-latest]
steps:
  - name: Set up Go ${{ matrix.go_version }}
    uses: actions/setup-go@v2
    with:
      go-version: ${{ matrix.go_version }}
    id: go

name: Go Test
on: [push, pull_request]
jobs:
  helloci-build:
    name: Test with go
    runs-on: [ubuntu-latest]
    environment:
      name: helloci
    steps:
      - name: use secrets
        env:
          super_secret: ${{ secrets.MySecrets }}

name: golangci-lint
on:
  push:
    tags:
      - v*
    branches:
      - main
    paths-ignore:
      - 'docs/**'
      - 'README.md'
  pull_request:
    paths-ignore:
      - 'docs/**'
      - 'README.md'
permissions:
  contents: read

jobs:
  golangci:
    strategy:
      matrix:
        go: [ '1.20', '1.21' ]
        os: [ ubuntu-latest, windows-latest ]
    permissions:
      contents: read  # for actions/checkout to fetch code
      pull-requests: read  # for golangci/golangci-lint-action to fetch pull requests
    name: lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-go@v4
        with:
          go-version: stable # get the latest stable version from the go-versions repository manifest.
          cache: false
      - name: golangci-lint
        uses: golangci/golangci-lint-action@v3
        with:
          args: --timeout=10m

name: goreleaser

on:
  pull_request:
  push:

permissions:
  contents: write

jobs:
  goreleaser:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Set up Go
        uses: actions/setup-go@v4
      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v5
        with:
          # either 'goreleaser' (default) or 'goreleaser-pro'
          distribution: goreleaser
          version: latest
          args: release --clean --rm-dist --debug
        env:
          GITHUB_TOKEN: ${{ secrets.PAT }}
          # Your GoReleaser Pro key, if you are using the 'goreleaser-pro' distribution
          # GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}

steps:
  - run: npm ci
  - run: npm test
  - name: Upload Test Coverage File
    uses: actions/upload-artifact@v1.0.0
    with:
      name: coverage-output
      path: coverage

# Look for a CLI that's made for this PR
- name: Fetch built CLI
  id: cli-cache
  uses: actions/cache@v2
  with:
    path: ./_output/linux/amd64/bin/crtctl
    # The cache key a combination of the current PR number and the commit SHA
    key: crtctl-${{ github.event.pull_request.number }}-${{ github.sha }}

- if: ${{ steps.cache-npm.outputs.cache-hit != 'true' }}
  name: List the state of node modules
  continue-on-error: true
  run: npm list

on:
  pull_request_target:
    types: [opened, reopened, synchronize, ready_for_review]

jobs:
  # Automatically labels PRs based on file globs in the change.
  triage:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/labeler@v3
        with:
          repo-token: "${{ secrets.GITHUB_TOKEN }}"
          configuration-path: .github/labels.yml

# Set to true to add reviewers to pull requests
addReviewers: true

# Set to true to add assignees to pull requests
addAssignees: false

# Set addAssignees to 'author' to set the PR creator as the assignee.
# addAssignees: author

# A list of reviewers to be added to pull requests (GitHub user name)
reviewers:
  - reviewerA
  - reviewerB
  - reviewerC

# A number of reviewers added to the pull request
# Set 0 to add all the reviewers (default: 0)
numberOfReviewers: 0
# A list of assignees, overrides reviewers if set
# assignees:
#   - assigneeA

# A number of assignees to add to the pull request
# Set to 0 to add all of the assignees.
# Uses numberOfReviewers if unset.
# numberOfAssignees: 2

# Set to true to add reviewers from different groups to pull requests
useReviewGroups: true

# A list of reviewers, split into different groups, to be added to pull requests (GitHub user name)
reviewGroups:
  groupA:
    - reviewerA
    - reviewerB
    - reviewerC
  groupB:
    - reviewerD
    - reviewerE
    - reviewerF

# Set to true to add assignees from different groups to pull requests
useAssigneeGroups: false
# A list of assignees, split into different froups, to be added to pull requests (GitHub user name)
# assigneeGroups:
#   groupA:
#     - assigneeA
#     - assigneeB
#     - assigneeC
#   groupB:
#     - assigneeD
#     - assigneeE
#     - assigneeF

# A list of keywords to be skipped the process that add reviewers if pull requests include it
# skipKeywords:
#   - wip

# The action will only run for non-draft PRs. If you want to run for all PRs, you need to enable it to run on drafts.
# runOnDraft: true

name: "Auto Assign Author"

# pull_request_target means that this will run on pull requests, but in
# the context of the base repo. This should mean PRs from forks are supported.
on:
  pull_request_target:
    types: [opened, reopened, ready_for_review]

jobs:
  # Automatically assigns reviewers and owner
  add-reviews:
    runs-on: ubuntu-latest
    steps:
      - name: Set the author of a PR as the assignee
        uses: kentaro-m/auto-assign-action@v1.2.4
        with:
          configuration-path: ".github/auto_assignees.yml"
          repo-token: "${{ secrets.GITHUB_TOKEN }}"

permissions:
  contents: write # only for delete-branch option
  issues: write
  pull-requests: write

name: "Close stale issues and PRs"
on:
  schedule:
    # First of every month
    - cron: "30 1 * * *"

jobs:
  stale:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/stale@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          stale-issue-message: "This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days. If a Velero team member has requested log or more information, please provide the output of the shared commands."
          close-issue-message: "This issue was closed because it has been stalled for 5 days with no activity."
          days-before-issue-stale: 30
          days-before-issue-close: 5
          # Disable stale PRs for now; they can remain open.
          days-before-pr-stale: -1
          days-before-pr-close: -1
          # Only issues made after Oct 01 2022.
          start-date: "2022-10-01T00:00:00"
          # Only make issues stale if they have these labels. Comma separated.
          only-labels: "Needs info,Duplicate"

name: gitleaks
on:
  pull_request:
  push:
  workflow_dispatch:
  schedule:
    - cron: "0 4 * * *" # run once a day at 4 AM
jobs:
  scan:
    name: gitleaks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
      - uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE}} # Only required for Organizations, not personal accounts.

name: "grype"
on:
  push:
    branches: ['main']
    tags: ['v*']
  pull_request:
jobs:
  scan-source:
    name: scan-source
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      actions: read
      contents: read
    steps:
      - uses: actions/checkout@v3
      - uses: anchore/scan-action@v3
        with:
          path: "."
          fail-build: true

# 扫描时，如果发现严重性达到或超过设置的值，则返回代码为 1。默认为未设置
fail-on-severity: high
# 如果使用 SBOM 输入，则在软件包没有 CPE 时自动生成 CPE
add-cpes-if-none: true
# 输出格式 (允许的值: table, json, cyclonedx)
output: table
# 要从扫描中排除的文件
exclude:
  - "**/testdata/**"
# 如果看到 Grype 报告误报或任何其他不想看到的漏洞匹配，可以配置 "忽略规则"，Grype 会忽略匹配结果
ignore:
  - fix-state: unknown # 允许的值: "fixed", "not-fixed", "wont-fix", or "unknown"
    vulnerability: "CVE-2008-4318" # vulnerability ID

name: "codeql"
on:
  push:
    branches: [ main ]
jobs:
  analyze:
    name: analyze
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-go@v4
        with:
          go-version: stable
      - name: initialize codeql
        uses: github/codeql-action/init@v2
        with:
          languages: go # javascript, csharp, python, cpp, java
      - name: build package
        run: go build ./cmd
      # build package C/C++, C#, Java, Go, Swift  可以直接使用 CodeQL 的 autobuild 作替代
      # - name: auto build package  
      #   uses: github/codeql-action/autobuild@v2
      - uses: github/codeql-action/analyze@v2

name: Format

on: push

jobs:
  format-code:
    runs-on: ubuntu-latest

    permissions:
      # Give the default GITHUB_TOKEN write permission to commit and push the
      # added or changed files to the repository.
      contents: write

    steps:
      - uses: actions/checkout@v3

      # Other steps that change files in the repository

      # Commit all changed files back to the repository
      - uses: stefanzweifel/git-auto-commit-action@v4

name: 'Dependency Review'
on: [pull_request]

permissions:
  contents: read

jobs:
  dependency-review:
    runs-on: ubuntu-latest
    steps:
      - name: 'Checkout Repository'
        uses: actions/checkout@v3
      - name: 'Dependency Review'
        uses: actions/dependency-review-action@v3