ci.yaml

name: CI

on:
  pull_request:
    branches-ignore:
    - newdocs
  merge_group:
  push:
    branches:
    - main
    - release-*

permissions:
  contents: read

jobs:
  test-unit:
    runs-on: ubuntu-latest
    steps:
    - name: Harden the runner (Audit all outbound calls)
      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
      with:
        egress-policy: audit

    - name: Checkout code
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
    - name: Set up Go
      # This is the Go minor version that unit tests, linters, and codegen run
      # against. It is capped by the golangci-lint version pinned in
      # hack/tools.mk: a linter binary built with go1.X panics under go1.(X+1),
      # so raising Go here requires a linter upgrade, which typically surfaces
      # new findings requiring code or configuration changes.
      #
      # It must match the base image in Dockerfile.dev. Everything else,
      # including anything we ship, uses the default that the setup-go action
      # defines.
      uses: ./.github/actions/setup-go
      with:
        go-version: &goTestVersion "1.27.1"
    - name: Run unit tests
      run: make test-unit
    - name: Remove generated code from report
      run: |
        for report in $(find . -maxdepth 4 -type f -name 'coverage.txt'); do
          tmp_file=$(dirname $report)/coverage.tmp
          grep -v .pb.go $report | grep -v zz_ | grep -v .connect.go | grep -v 'pkg/x/client/generated/' > $tmp_file
          mv $tmp_file $report
        done
    - name: Upload coverage reports
      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
      with:
        token: ${{ secrets.CODECOV_TOKEN }}
  
  lint-and-typecheck-ui:
    runs-on: ubuntu-latest
    steps:
    - name: Harden the runner (Audit all outbound calls)
      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
      with:
        egress-policy: audit

    - name: Checkout code
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
    - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
      with:
        path: ~/.pnpm-store
        key: ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
        restore-keys: |
          ${{ runner.os }}-pnpm-
    - name: Install pnpm
      uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
      with:
        package_json_file: ui/package.json
    - name: Install nodejs
      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
      with:
        node-version: "24.15.0"
        cache: "pnpm"
        cache-dependency-path: "**/pnpm-lock.yaml"
    - name: Run typecheck
      run: make typecheck-ui
    - name: Run linter
      run: make lint-ui
    - name: Run unit tests
      run: make test-unit-ui

  lint-go:
    permissions:
      contents: read # Permissions to read the repository, required because we override the default permissions
      checks: write # Used to create checks (linting comments) on PRs
    runs-on: ubuntu-latest
    steps:
    - name: Harden the runner (Audit all outbound calls)
      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
      with:
        egress-policy: audit

    - name: Checkout code
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
    - name: Set up Go
      uses: ./.github/actions/setup-go
      with:
        go-version: *goTestVersion
    - name: Cache golangci-lint
      id: cache-golangci-lint
      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
      with:
        path: |
          hack/bin/golangci-lint
          hack/bin/golangci-lint-*
        key: ${{ runner.os }}-golangci-lint-${{ hashFiles('hack/tools.mk') }}
    - name: Install golangci-lint
      if: steps.cache-golangci-lint.outputs.cache-hit != 'true'
      run: make install-golangci-lint
    - name: Run linter
      run: make lint-go

  lint-charts:
    runs-on: ubuntu-latest
    steps:
    - name: Harden the runner (Audit all outbound calls)
      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
      with:
        egress-policy: audit

    - name: Checkout code
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
    - name: Cache helm
      id: cache-helm
      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
      with:
        path: |
          hack/bin/helm
          hack/bin/helm-*
        key:
          ${{ runner.os }}-helm-${{ hashFiles('go.mod', 'hack/tools.mk') }}
    - name: Install helm
      if: steps.cache-helm.outputs.cache-hit != 'true'
      run: make install-helm
    - name: Run linter
      run: make lint-charts

  test-chart:
    runs-on: ubuntu-latest
    steps:
    - name: Harden the runner (Audit all outbound calls)
      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
      with:
        egress-policy: audit

    - name: Checkout code
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
    - name: Cache helm
      id: cache-helm
      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
      with:
        path: |
          hack/bin/helm
          hack/bin/helm-*
        key:
          ${{ runner.os }}-helm-${{ hashFiles('go.mod', 'hack/tools.mk') }}
    - name: Install helm
      if: steps.cache-helm.outputs.cache-hit != 'true'
      run: make install-helm
    - name: Run chart unit tests
      run: |
        set -o pipefail
        make test-chart 2>&1 | tee /tmp/chart-tests.log
    - name: Publish chart test summary
      if: always()
      run: |
        [ -f /tmp/chart-tests.log ] || exit 0
        {
          echo '## Chart unit tests'
          echo '```'
          sed -n '/^### Chart/,$p' /tmp/chart-tests.log
          echo '```'
        } >> "$GITHUB_STEP_SUMMARY"

  check-codegen:
    runs-on: ubuntu-latest
    steps:
    - name: Harden the runner (Audit all outbound calls)
      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
      with:
        egress-policy: audit

    - name: Checkout code
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
    - name: Set up Go
      uses: ./.github/actions/setup-go
      with:
        go-version: *goTestVersion
    - name: Install java
      uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
      with:
        distribution: temurin
        java-version: "21"
        java-package: jre
    - name: Install pnpm
      uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
      with:
        package_json_file: ui/package.json
    - name: Install nodejs
      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
      with:
        node-version: "24.15.0"
        cache: "pnpm"
        cache-dependency-path: "**/pnpm-lock.yaml"
    - name: Install nodejs dependencies
      run: pnpm install --dev
      working-directory: ./ui
    - name: Cache tools
      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
      with:
        path: |
          hack/bin
          hack/include
        key: ${{ runner.os }}-tools-${{ hashFiles('hack/tools.mk') }}
    - name: Run Codegen
      run: make codegen
    - name: Check nothing has changed
      run: git diff --exit-code -- .

  build-image:
    needs: [test-unit, lint-go, lint-charts, lint-and-typecheck-ui, check-codegen]
    runs-on: ubuntu-latest
    services:
      registry:
        image: registry:3.0.0
        ports:
        - 5000:5000
    steps:
    - name: Harden the runner (Audit all outbound calls)
      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
      with:
        egress-policy: audit

    - name: Set up QEMU
      uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
      with:
        driver-opts: network=host
    - name: Checkout code
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
    - name: Build base image
      run: |
        BASE_IMAGE=localhost:5000/kargo-base make build-base-image
        docker push localhost:5000/kargo-base:latest-arm64
        docker push localhost:5000/kargo-base:latest-amd64
    - name: Build final image
      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
      with:
        platforms: linux/amd64,linux/arm64
        build-args: |
          BASE_IMAGE=localhost:5000/kargo-base
        # Push to the job-local registry service (nothing leaves the runner)
        # so the built image can be scanned for CVEs below.
        tags: localhost:5000/kargo:scan
        push: true
        cache-from: type=gha
        cache-to: type=gha,mode=max
    - name: Install Grype
      id: grype
      uses: anchore/scan-action/download-grype@27805bf3b4e84b4a5c980df22ed233c00390a439 # v7.4.2
      with:
        cache-db: true
    # cve-scan.sh re-stamps the VEX product @id to the scanned digest, which it
    # resolves from the job-local registry tag via crane.
    - name: Install Crane
      uses: imjasonh/setup-crane@feee3b6bb0d4c68370f256a4502498c9227e5c6b # v0.7
    - name: Scan image for CVEs
      env:
        GRYPE_CMD: ${{ steps.grype.outputs.cmd }}
        GRYPE_REGISTRY_INSECURE_USE_HTTP: "true" # job-local registry service
        CRANE_INSECURE: "true" # job-local registry is plain HTTP
        VEX_IMAGE: kargo-oss # monitored image name for the VEX lookup
        FAIL_ON: "" # report-only; set to "high" to enforce
      run: ./hack/cve-scan.sh "registry:localhost:5000/kargo:scan"

  build-cli:
    needs: [test-unit, lint-go, lint-charts, lint-and-typecheck-ui, check-codegen]
    runs-on: ubuntu-latest
    steps:
    - name: Harden the runner (Audit all outbound calls)
      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
      with:
        egress-policy: audit

    - name: Checkout code
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
    - name: Set up Go
      uses: ./.github/actions/setup-go
    - name: Build CLI
      env:
        GOFLAGS: -buildvcs=false
      run: make build-cli