ci-main.yml

#
name: Main CI
#
on:
  push:
    branches:
      - "next"
      - "next-major"
  pull_request:
    branches:
      - "main"
      - "next"
      - "next-major"
  workflow_dispatch:
env:
  DOCKER_REGISTRY_IMAGE: ghcr.io/${{ github.repository_owner }}/containers/${{ github.event.repository.name }}
permissions:
  contents: read # for actions/checkout to fetch code

jobs:
  lint-test:
    runs-on: ubuntu-latest
    steps:
      - name: Install 1Password CLI
        uses: 1password/install-cli-action@v1
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Helm
        uses: azure/setup-helm@v3
        with:
          version: v3.13.0

      - uses: actions/setup-python@v5
        with:
          python-version: '3.9'
          check-latest: true

      - name: Set up chart-testing
        uses: helm/chart-testing-action@v2.6.1

      - name: inject secrets
        run: find charts/s3proxy/ci/ -type f -name "*.1ptpl" -exec bash -c 'op inject -f -i $1 -o ${1%.*}' bash {} \;

      - name: Run chart-testing (lint)
        run: ct lint --target-branch ${{ github.event.repository.default_branch }} --all

      - name: Create kind cluster
        uses: helm/kind-action@v1.8.0

      - name: Run chart-testing (install)
        run: ct install --target-branch ${{ github.event.repository.default_branch }} --all

  checkov-gha:
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Checkov GitHub Action
        uses: bridgecrewio/checkov-action@v12
        with:
          # This will add both a CLI output to the console and create a results.sarif file
          output_format: cli,sarif
          output_file_path: console,results.sarif
          quiet: true
          framework: github_configuration

      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@v2

        # Results are generated only on a success or failure
        # this is required since GitHub by default won't run the next step
        # when the previous one has failed. Security checks that do not pass will 'fail'.
        # An alternative is to add `continue-on-error: true` to the previous step
        # Or 'soft_fail: true' to checkov.
        if: success() || failure()
        with:
          sarif_file: results.sarif
  checkov-helm:
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
    strategy:
      matrix:
        values:
          - filesystem
          - azureblob-azurekey
    runs-on: ubuntu-latest
    steps:
      - name: Install 1Password CLI
        uses: 1password/install-cli-action@v1
      - uses: actions/checkout@v4
      - name: Checkov GitHub Action
        uses: bridgecrewio/checkov-action@v12
        with:
          # This will add both a CLI output to the console and create a results.sarif file
          output_format: cli,sarif
          output_file_path: console,results.sarif
          quiet: true
          framework: helm
          directory: charts/s3proxy
          var_file: "${{ matrix.values }}-values.yaml"

      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@v2

        # Results are generated only on a success or failure
        # this is required since GitHub by default won't run the next step
        # when the previous one has failed. Security checks that do not pass will 'fail'.
        # An alternative is to add `continue-on-error: true` to the previous step
        # Or 'soft_fail: true' to checkov.
        if: success() || failure()
        with:
          sarif_file: results.sarif


  release:
    runs-on: ubuntu-latest
    needs:
      - lint-test
      - checkov-gha
      - checkov-helm
    permissions:
      contents: write
      issues: write
      packages: write
    outputs:
      version: ${{ steps.version.outputs.new_release_version }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      - name: Run chart-releaser
        uses: helm/chart-releaser-action@v1.6.0
        with:
          install_only: true
      - name: Semantic Release
        id: version
        uses: cycjimmy/semantic-release-action@v4
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # REGISTRY_HOST: ghcr.io
          REGISTRY_USERNAME: ${{ github.actor }}
          REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
        with:
          semantic_version: 19.0.5
          extra_plugins: |
            @semantic-release/commit-analyzer@9.0.2
            @semantic-release/release-notes-generator@10.0.3
            @semantic-release/git@10.0.1
            @semantic-release/github@8.1.0
            @semantic-release/changelog@6.0.3
            conventional-changelog-conventionalcommits@6.1.0
            @semantic-release/exec@6.0.3
            semantic-release-helm3@2.9.3