.github/workflows/build.yml

name: "[Blocking] Build"
on:
  push:
    branches:
      - main
      - release-*
    tags:
      - v*
    paths-ignore:
      - "**.md"
      - "website/**"
      - "docs/**"
      - "demo/**"
  pull_request:
    branches:
      - main
      - release-*
    paths-ignore:
      - "**.md"
      - "website/**"
      - "docs/**"
      - "demo/**"
  workflow_dispatch:

env:
  TRIVY_VERSION: 0.59.1
  BUILDKIT_VERSION: 0.19.0
  TRIVY_DISABLE_VEX_NOTICE: "true"

permissions:
  contents: read

jobs:
  unit-test:
    name: Unit Test
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions: read-all
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.3.1
        with:
          egress-policy: audit
      - name: Check out code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
        with:
          go-version: "1.24"
          check-latest: true
      - name: Add containerd-snapshotter to docker daemon
        run: |
          echo '{"features": { "containerd-snapshotter": true }}' | sudo tee /etc/docker/daemon.json
          sudo systemctl restart docker
      - name: Unit test
        shell: bash
        env:
          CODECOV_OPTS: "-coverprofile=coverage.txt -covermode=atomic"
        run: make test
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@ad3126e916f78f00edff4ed0317cf185271ccc2d # v5.4.2
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
  build:
    name: Build
    runs-on: ${{ matrix.os }}
    timeout-minutes: 5
    permissions:
      packages: write
      contents: read
    strategy:
      matrix:
        os: [ubuntu-latest]
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.3.1
        with:
          egress-policy: audit
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
        with:
          go-version: "1.24"
          check-latest: true
      - name: Build copa
        shell: bash
        run: |
          make build
          make archive
      - name: Upload copa to build artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: copa_edge_linux_amd64.tar.gz
          path: dist/linux_amd64/release/copa_edge_linux_amd64.tar.gz
      - name: Load test cases for patch testing
        id: load-test-envs-matrix
        shell: bash
        run: echo "buildkitenvs=$(.github/workflows/scripts/buildkit-env-matrix.sh)" | tee -a "${GITHUB_OUTPUT}"
    outputs:
      buildkitenvs: ${{ steps.load-test-envs-matrix.outputs.buildkitenvs }}

  test-patch-trivy:
    needs: build
    name: Test patch with trivy ${{ matrix.buildkit_mode }}
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions: read-all
    strategy:
      fail-fast: false
      matrix:
        buildkit_mode: ${{fromJson(needs.build.outputs.buildkitenvs)}}
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
        with:
          egress-policy: audit

      - name: Download copa from build artifacts
        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
        with:
          name: copa_edge_linux_amd64.tar.gz
      - run: docker system prune -a -f --volumes
      - name: Check out code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
        with:
          go-version: "1.24"
          check-latest: true
      - name: Install required tools
        shell: bash
        run: .github/workflows/scripts/download-tooling.sh
      - name: Download copa from build artifacts
        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
        with:
          name: copa_edge_linux_amd64.tar.gz
      - name: Extract copa
        shell: bash
        run: |
          tar xzf copa_edge_linux_amd64.tar.gz
          ./copa --version
      - name: Set up QEMU
        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
      - name: Run functional test
        shell: bash
        run: |
          set -eu -o pipefail
          . .github/workflows/scripts/buildkitenvs/${{ matrix.buildkit_mode}}
          go test -v ./integration --addr="${COPA_BUILDKIT_ADDR}" --copa="$(pwd)/copa" -timeout 0 --report-file

  test-patch-no-report:
    needs: build
    name: Test patch no report ${{ matrix.buildkit_mode }}
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions: read-all
    strategy:
      fail-fast: false
      matrix:
        buildkit_mode: ${{fromJson(needs.build.outputs.buildkitenvs)}}
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
        with:
          egress-policy: audit

      - name: Download copa from build artifacts
        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
        with:
          name: copa_edge_linux_amd64.tar.gz
      - run: docker system prune -a -f --volumes
      - name: Check out code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
        with:
          go-version: "1.24"
          check-latest: true
      - name: Install required tools
        shell: bash
        run: .github/workflows/scripts/download-tooling.sh
      - name: Download copa from build artifacts
        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
        with:
          name: copa_edge_linux_amd64.tar.gz
      - name: Extract copa
        shell: bash
        run: |
          tar xzf copa_edge_linux_amd64.tar.gz
          ./copa --version
      - name: Set up QEMU
        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
      - name: Run functional test
        shell: bash
        run: |
          set -eu -o pipefail
          . .github/workflows/scripts/buildkitenvs/${{ matrix.buildkit_mode}}
          echo "COPA_BUILDKIT_ADDR=${COPA_BUILDKIT_ADDR}" >> "$GITHUB_ENV"
          go test -v ./integration --addr="${COPA_BUILDKIT_ADDR}" --copa="$(pwd)/copa" -timeout 0
      - name: Test RPM validation - noreplace files
        shell: bash
        run: |
            set -eux -o pipefail

            if [[ -n "${COPA_BUILDKIT_ADDR}" && "${COPA_BUILDKIT_ADDR}" == docker://* ]]; then
                export DOCKER_HOST="${COPA_BUILDKIT_ADDR#docker://}"
            fi
      
            docker create --name test ghcr.io/project-copacetic/copacetic/test/openssl:test-patched /bin/sh
            tmp="$(mktemp)"
            docker cp test:/etc/pki/tls/openssl.cnf "${tmp}"
            
            if ! grep -q foo "${tmp}"; then
                echo "Error: openssl.cnf content replaced" >&2
                rm "${tmp}"
                docker rm -f test
                exit 1
            fi

            rm "${tmp}"
            docker rm -f test
      - name: Test RPM validation - symlink
        shell: bash
        run: |
          set -eux -o pipefail

          _cleanup() {
              docker rm -f "$DOCKER_CUSTOM_UNIX_ID"
              sudo rm -rf "$SOCK_DIR"
          }

          if [[ -n "${COPA_BUILDKIT_ADDR}" && "${COPA_BUILDKIT_ADDR}" == docker://* ]]; then
              export DOCKER_HOST="${COPA_BUILDKIT_ADDR#docker://}"
              trap '_cleanup' EXIT
          fi

          docker create --name test ghcr.io/project-copacetic/copacetic/test/openssl:test-patched /bin/sh
          tmp="$(mktemp)"

          symlink_path="/sbin"
          docker cp test:"$symlink_path" "${tmp}_symlink"

          if [ ! -L "${tmp}_symlink" ]; then
              echo "Error: The path $symlink_path is not a symlink."
              rm "${tmp}" "${tmp}_symlink"
              docker rm -f test
              exit 1
          fi

          rm "${tmp}" "${tmp}_symlink"
          docker rm -f test

  test-plugin:
    needs: build
    name: Test plugin
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions: read-all
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.3.1
        with:
          egress-policy: audit
      - name: Check out code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
        with:
          go-version: "1.24"
          check-latest: true
      - name: Install scanner-plugin-template
        shell: bash
        run: |
          go install github.com/project-copacetic/scanner-plugin-template@latest
          mv $(go env GOPATH)/bin/scanner-plugin-template $(go env GOPATH)/bin/copa-fake
          mv $(go env GOPATH)/bin/copa-fake /usr/local/bin
      - name: Install required tools
        shell: bash
        run: .github/workflows/scripts/download-tooling.sh
      - name: Download copa from build artifacts
        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
        with:
          name: copa_edge_linux_amd64.tar.gz
      - name: Extract copa
        shell: bash
        run: |
          tar xzf copa_edge_linux_amd64.tar.gz
          ./copa --version
      - name: Set up QEMU
        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
      - name: Run e2e tests
        shell: bash
        run: |
          set -eu -o pipefail
          . .github/workflows/scripts/buildkitenvs/direct/tcp
          go test -v ./test/e2e/plugin --addr="${COPA_BUILDKIT_ADDR}" --copa="$(pwd)/copa" --scanner fake -timeout 0

  test-push:
    needs: build
    name: Test push
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions: read-all
    steps:
      - name: Check out code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
        with:
          go-version: "1.24"
          check-latest: true
      - name: Add containerd-snapshotter to docker daemon
        run: |
          echo '{"features": { "containerd-snapshotter": true }}' | sudo tee /etc/docker/daemon.json
          sudo systemctl restart docker
      - name: Set up buildx
        uses: docker/setup-buildx-action@v3
        with:
          install: true
      - name: Install oras CLI
        uses: oras-project/setup-oras@5c0b487ce3fe0ce3ab0d034e63669e426e294e4d # v1.2.2
      - name: Install required tools
        shell: bash
        run: .github/workflows/scripts/download-tooling.sh
      - name: Download copa from build artifacts
        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
        with:
          name: copa_edge_linux_amd64.tar.gz
      - name: Extract copa
        shell: bash
        run: |
          tar xzf copa_edge_linux_amd64.tar.gz
          ./copa --version
      - name: Set up QEMU
        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
      - name: Run e2e tests
        shell: bash
        run: |
          set -eu -o pipefail
          go test -v ./test/e2e/push --addr="docker://" --copa="$(pwd)/copa"