report.yml

---
name: Reporting

on:
  push:
    branches:
      - devel
      - release-*

permissions: {}

jobs:
  unit-coverage:
    name: Go Unit Test Coverage
    if: github.repository_owner == 'submariner-io'
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
        with:
          fetch-depth: 0

      - name: Run Go unit tests
        run: make unit

      - name: Run SonarScan, upload Go test results and coverage
        uses: sonarsource/sonarcloud-github-action@db501078e936e4b4c8773d1bb949ba9ddb7b6b6a
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  variant-analysis:
    name: Variant Analysis
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - name: Check out the repository
        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
      - name: Initialize CodeQL
        uses: github/codeql-action/init@86f3159a697a097a813ad9bfa0002412d97690a4
        with:
          languages: go
      - name: Run CodeQL variant analysis
        uses: github/codeql-action/analyze@86f3159a697a097a813ad9bfa0002412d97690a4
      - name: Show CodeQL scan SARIF report
        if: always()
        run: cat ../results/go.sarif

  vulnerability-scan:
    name: Vulnerability Scanning
    if: github.repository_owner == 'submariner-io'
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - name: Check out the repository
        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
      - name: Run Anchore vulnerability scanner
        uses: anchore/scan-action@24fd7c9060f3c96848dd1929fac8d796fb5ae4b4
        id: scan
        with:
          path: "."
          fail-build: false
      - name: Show Anchore scan SARIF report
        run: cat ${{ steps.scan.outputs.sarif }}
      - name: Upload Anchore scan SARIF report
        uses: github/codeql-action/upload-sarif@00e563ead9f72a8461b24876bee2d0c2e8bd2ee8
        with:
          sarif_file: ${{ steps.scan.outputs.sarif }}