SOARCA/.github/workflows/release.yml at development · COSSAS/SOARCA · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
name: release

on:
  push:
    tags:
      - '[0-9]+.[0-9]+.[0-9]+\-?*'

jobs:
  compile:
    name: Cross compile binaries
    runs-on: ubuntu-latest
    container:
      image: golangci/golangci-lint:latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Make repo safe
        run: git config --global --add safe.directory /__w/SOARCA/SOARCA

      - name: Install swaggo
        run:  go install github.com/swaggo/swag/cmd/swag@latest

      - name: Build with make
        run: |
          go install github.com/swaggo/swag/cmd/swag@latest
          go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest
          make compile
          make sbom

      - name: 'Upload Artifact'
        uses: actions/upload-artifact@v4
        with:
          name: ${{ github.sha }}
          path: bin/*
          retention-days: 1

  docker-build:
    needs: compile
    name: Build docker image and release it to docker hub
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Make repo safe
        run: git config --global --add safe.directory /__w/SOARCA/SOARCA

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Download bin
        uses: actions/download-artifact@v4
        with:
          pattern: ${{ github.sha }}

      - name: Move files to bin folder and make executable
        run: |
          mkdir -p bin
          mv ${{ github.sha }}/* ./bin/
          chmod +x bin/soarca-*

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_HUB_USER }}
          password: ${{ secrets.DOCKER_HUB_TOKEN }}

      - name: Get version
        run: |
          export VERSION=$(git describe --tags --dirty)
          echo "describe_version=$(git describe --tags --dirty)" >> "$GITHUB_ENV"

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          build-args: |
            VERSION=${{ env.describe_version }}
          push: true
          tags: cossas/soarca:${{ env.describe_version }},cossas/soarca:latest

  release-binary:
    needs: compile
    name: Create release artifacts
    runs-on: ubuntu-latest
    steps:
      - name: Setup Go
        uses: actions/setup-go@v4
        with:
          go-version: '1.23.x'
      - name: Import GPG key
        uses: crazy-max/ghaction-import-gpg@v6
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.GPG_PASSPHRASE }}
      - name: Checkout Code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Make repo safe
        run: git config --global --add safe.directory /__w/SOARCA/SOARCA

      - name: Build and sbom swagger
        run: |
          go install github.com/swaggo/swag/cmd/swag@latest
          go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest
          make sbom
          zip -r bin/sbom.zip bin

      - name: Release soarca binary
        uses: goreleaser/goreleaser-action@v5
        with:
          distribution: goreleaser
          version: latest
          args: release --clean
          workdir: cmd/soarca
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}

      - name: Upload release sbom
        uses: actions/github-script@v4
        with:
          script: |
            const fs = require('fs');
            const tag = context.ref.replace("refs/tags/", "");
            // Get release for this tag
            const release = await github.repos.getReleaseByTag({
              owner: context.repo.owner,
              repo: context.repo.repo,
              tag
            });
            // Upload the release asset
            await github.repos.uploadReleaseAsset({
              owner: context.repo.owner,
              repo: context.repo.repo,
              release_id: release.data.id,
              name: "sbom.zip",
              data: await fs.readFileSync("bin/sbom.zip")
            });