pvtr-github-repo-scanner/.github/workflows/ci.yaml at main · ossf/pvtr-github-repo-scanner · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
---
name: CI

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

permissions:
  contents: read

jobs:
  ci:
    name: CI
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
      - name: Build
        run: make -B build
      - name: Plugin Test
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -o pipefail
          ./.github/scripts/ci.sh 2>&1 | tee integration_output.txt
      - name: Verify test output
        run: |
          # Keep the workflow aligned with the code-level compatibility contract.
          expected_count=$(go run ./cmd/list-supported-catalogs | wc -l | tr -d ' ')
          actual_count=$(grep -c '^COMPAT_CONFIG_OK ' integration_output.txt)
          test "$actual_count" -eq "$expected_count"

  image-smoke-test:
    name: Container Image Smoke Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Build image
        run: docker build -t pvtr-github-repo-scanner:smoke .
      - name: Run image
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Mirror how osps-baseline-action invokes the published image.
          cat > /tmp/pvtr-config.yml <<EOF
          loglevel: info
          write-directory: evaluation_results
          write: true
          output: yaml
          services:
            pvtr:
              plugin: github-repo
              policy:
                catalogs:
                  - osps-baseline-2026-02
                applicability:
                  - maturity-1
              vars:
                owner: ossf
                repo: pvtr-github-repo-scanner
                token: ${GITHUB_TOKEN}
          EOF
          mkdir -p evaluation_results
          chmod 777 evaluation_results
          docker run --rm \
            -v /tmp/pvtr-config.yml:/.privateer/config.yml \
            -v "$PWD/evaluation_results:/.privateer/bin/evaluation_results" \
            pvtr-github-repo-scanner:smoke
      - name: Verify scan wrote results
        run: |
          ls -R evaluation_results
          test -n "$(find evaluation_results -name '*.log' -type f)"