This repository was archived by the owner on Jun 26, 2026. It is now read-only.
Nightly #204
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Nightly | |
| on: | |
| workflow_dispatch: {} # Allow for manual triggers | |
| schedule: | |
| - cron: "0 8 * * 1-5" # Mo-Fr, at 8:00 UTC | |
| env: | |
| BB_VERSION: 1.3.186 | |
| jobs: | |
| prereqs: | |
| name: Prereqs | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: StyraOSS/styra-init-action@main | |
| build: | |
| name: Build and Test | |
| needs: prereqs | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Tune GitHub-hosted runner network | |
| uses: smorimoto/tune-github-hosted-runner-network@bb252dcb5c8609a31087e7993daa086f5a1c0069 # v1.0.0 | |
| - name: Free Disk Space | |
| uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1 | |
| - uses: open-policy-agent/setup-opa@950f159a49aa91f9323f36f1de81c7f6b5de9576 # v2.3.0 | |
| - name: checkout EOPA | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| fetch-depth: 0 | |
| path: eopa | |
| - id: go_version | |
| name: Read go version | |
| run: echo "go_version=$(cat .go-version)" >> $GITHUB_OUTPUT | |
| working-directory: eopa | |
| - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0 | |
| with: | |
| go-version: ${{ steps.go_version.outputs.go_version }} | |
| cache-dependency-path: eopa/go.sum | |
| - uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9 | |
| - name: Build | |
| run: make build | |
| env: | |
| SKIP_IMAGES: true | |
| working-directory: eopa | |
| - name: Upload image tarball | |
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 | |
| with: | |
| name: image | |
| path: eopa/local.tar | |
| race: | |
| name: Race Detector | |
| needs: prereqs | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Tune GitHub-hosted runner network | |
| uses: smorimoto/tune-github-hosted-runner-network@bb252dcb5c8609a31087e7993daa086f5a1c0069 # v1.0.0 | |
| - name: Free Disk Space | |
| uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1 | |
| - uses: open-policy-agent/setup-opa@950f159a49aa91f9323f36f1de81c7f6b5de9576 # v2.3.0 | |
| - name: checkout EOPA | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| fetch-depth: 0 | |
| path: eopa | |
| - id: go_version | |
| name: Read go version | |
| run: echo "go_version=$(cat .go-version)" >> $GITHUB_OUTPUT | |
| working-directory: eopa | |
| - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0 | |
| with: | |
| go-version: ${{ steps.go_version.outputs.go_version }} | |
| cache-dependency-path: eopa/go.sum | |
| - name: pick up eopa data | |
| id: eopa | |
| run: | | |
| echo "opa_version=v$(build/get-opa-version.sh)" >> $GITHUB_OUTPUT | |
| echo "image=$(docker load --quiet --input local.tar | awk '{print $3}')" >> $GITHUB_OUTPUT | |
| echo "bundles=$(pwd)/e2e" >> $GITHUB_OUTPUT | |
| working-directory: eopa | |
| - name: pick up paths | |
| id: paths | |
| run: | | |
| echo "opa_dir=$(pwd)/opa" >> $GITHUB_OUTPUT | |
| - name: checkout OPA | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| repository: open-policy-agent/opa | |
| ref: ${{ steps.eopa.outputs.opa_version }} | |
| path: opa | |
| - run: make test-race | |
| working-directory: eopa | |
| env: | |
| OPA_ROOT: ${{ steps.paths.outputs.opa_dir }} | |
| goreleaser: | |
| name: GoReleaser | |
| needs: prereqs | |
| runs-on: ubuntu-24.04 | |
| env: | |
| QUILL_SIGN_P12: ${{ secrets.QUILL_SIGN_P12 }} # base64 encoded contents | |
| QUILL_SIGN_PASSWORD: ${{ secrets.QUILL_SIGN_PASSWORD }} # p12 password | |
| QUILL_NOTARY_KEY: ${{ secrets.QUILL_NOTARY_KEY }} | |
| QUILL_NOTARY_KEY_ID: ${{ secrets.QUILL_NOTARY_KEY_ID }} | |
| QUILL_NOTARY_ISSUER: ${{ secrets.QUILL_NOTARY_ISSUER }} | |
| steps: | |
| - name: Tune GitHub-hosted runner network | |
| uses: smorimoto/tune-github-hosted-runner-network@bb252dcb5c8609a31087e7993daa086f5a1c0069 # v1.0.0 | |
| - name: Free disk space | |
| run: | | |
| df -h | |
| sudo rm -rf /usr/share/dotnet | |
| sudo rm -rf /opt/ghc | |
| sudo rm -rf "/usr/local/share/boost" | |
| sudo apt clean | |
| docker image ls -aq | xargs -r docker rmi | |
| df -h | |
| - uses: open-policy-agent/setup-opa@950f159a49aa91f9323f36f1de81c7f6b5de9576 # v2.3.0 | |
| - name: Check out code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| fetch-depth: 0 | |
| - id: go_version | |
| name: Read go version | |
| run: echo "go_version=$(cat .go-version)" >> $GITHUB_OUTPUT | |
| - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0 | |
| with: | |
| go-version: ${{ steps.go_version.outputs.go_version }} | |
| - name: Install goversioninfo for Windows binary icon and version | |
| run: go install github.com/josephspurrier/goversioninfo/cmd/goversioninfo@v1.5.0 | |
| - name: Install GoReleaser | |
| uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0 | |
| with: | |
| install-only: true | |
| - name: Install anchore/quill (macos signing) | |
| run: | | |
| curl -sSfL https://raw.githubusercontent.com/anchore/quill/main/install.sh |\ | |
| sh -s -- -b /usr/local/bin | |
| - name: Make GoReleaser | |
| run: make release | |
| env: | |
| HOSTNAME: github.actions.local | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Upload release artifacts | |
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 | |
| with: | |
| name: binaries | |
| path: | | |
| dist/checksums.txt | |
| dist/*build_*/* | |
| cross-build: | |
| name: Cross Build | |
| needs: prereqs | |
| runs-on: ubuntu-24.04 | |
| strategy: | |
| fail-fast: true | |
| matrix: | |
| include: | |
| - GOOS: linux | |
| GOARCH: amd64 | |
| - GOOS: linux | |
| GOARCH: arm64 | |
| - GOOS: darwin | |
| GOARCH: amd64 | |
| - GOOS: windows | |
| GOARCH: amd64 | |
| steps: | |
| - name: Tune GitHub-hosted runner network | |
| uses: smorimoto/tune-github-hosted-runner-network@bb252dcb5c8609a31087e7993daa086f5a1c0069 # v1.0.0 | |
| - name: Free disk space | |
| run: | | |
| df -h | |
| sudo rm -rf /usr/share/dotnet | |
| sudo rm -rf /opt/ghc | |
| sudo rm -rf "/usr/local/share/boost" | |
| sudo apt clean | |
| docker image ls -aq | xargs -r docker rmi | |
| df -h | |
| if: matrix.os == 'ubuntu-24.04' | |
| - name: Check out code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - id: go_version | |
| name: Read go version | |
| run: echo "go_version=$(cat .go-version)" >> $GITHUB_OUTPUT | |
| - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0 | |
| with: | |
| go-version: ${{ steps.go_version.outputs.go_version }} | |
| - uses: turtlequeue/setup-babashka@2d4df498c7a578b4f3e906283f9af913590bdec7 # v1.7.0 | |
| with: | |
| babashka-version: ${{ env.BB_VERSION }} | |
| - run: bb build/cross-build | |
| env: | |
| OUTPUTDIR: bins | |
| GOOS: ${{ matrix.GOOS }} | |
| GOARCH: ${{ matrix.GOARCH }} | |
| - name: Upload test binaries | |
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 | |
| with: | |
| name: cross-binaries-${{ matrix.GOOS }}-${{ matrix.GOARCH }} | |
| path: bins | |
| cross-test-releases: | |
| name: Cross Test Releases | |
| runs-on: ${{ matrix.os }} | |
| needs: | |
| - goreleaser | |
| - cross-build | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - os: ubuntu-24.04 | |
| GOOS: linux | |
| GOARCH: amd64 | |
| - os: ubuntu-24.04 | |
| GOOS: linux | |
| GOARCH: arm64 | |
| - os: macos-latest | |
| GOOS: darwin | |
| GOARCH: amd64 | |
| - os: windows-latest | |
| GOOS: windows | |
| GOARCH: amd64 | |
| steps: | |
| - name: Tune GitHub-hosted runner network | |
| uses: smorimoto/tune-github-hosted-runner-network@bb252dcb5c8609a31087e7993daa086f5a1c0069 # v1.0.0 | |
| if: matrix.os != 'windows-latest' | |
| - name: Free disk space | |
| run: | | |
| df -h | |
| sudo rm -rf /usr/share/dotnet | |
| sudo rm -rf /opt/ghc | |
| sudo rm -rf "/usr/local/share/boost" | |
| sudo apt clean | |
| docker image ls -aq | xargs -r docker rmi | |
| df -h | |
| if: matrix.os == 'ubuntu-24.04' | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0 | |
| with: | |
| platforms: arm64 | |
| if: matrix.GOARCH == 'arm64' | |
| - name: Download release binaries | |
| uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 | |
| with: | |
| name: binaries | |
| path: dist | |
| - name: Download test binaries | |
| uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 | |
| with: | |
| name: cross-binaries-${{ matrix.GOOS }}-${{ matrix.GOARCH }} | |
| path: bins | |
| - uses: turtlequeue/setup-babashka@2d4df498c7a578b4f3e906283f9af913590bdec7 # v1.7.0 | |
| with: | |
| babashka-version: ${{ env.BB_VERSION }} | |
| - run: cp dist/*${{ matrix.GOOS }}_${{ matrix.GOARCH }}*/* bins | |
| - run: bb bins/cross-run | |
| trivy-scan-image: | |
| name: Trivy security scan image | |
| runs-on: ubuntu-24.04 | |
| needs: build | |
| steps: | |
| - name: Tune GitHub-hosted runner network | |
| uses: smorimoto/tune-github-hosted-runner-network@bb252dcb5c8609a31087e7993daa086f5a1c0069 # v1.0.0 | |
| - name: Checkout code # needed for .trivyignore file | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| fetch-depth: 0 | |
| - name: Download image tarball | |
| uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 | |
| with: | |
| name: image | |
| - name: EOPA image | |
| id: eopa | |
| run: echo "image=$(docker load --quiet --input local.tar | awk '{print $3}')" >> $GITHUB_OUTPUT | |
| # Equivalent to: | |
| # $ trivy image $IMAGE | |
| - name: Run Trivy scan on image | |
| uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # 0.33.1 | |
| with: | |
| image-ref: ${{ steps.eopa.outputs.image }} | |
| format: table | |
| exit-code: "1" | |
| ignore-unfixed: true | |
| vuln-type: os,library | |
| severity: CRITICAL,HIGH | |
| env: | |
| TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db | |
| trivy-scan-repo: | |
| name: Trivy security scan repo | |
| needs: prereqs | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Tune GitHub-hosted runner network | |
| uses: smorimoto/tune-github-hosted-runner-network@bb252dcb5c8609a31087e7993daa086f5a1c0069 # v1.0.0 | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| # Equivalent to: | |
| # $ trivy fs . | |
| - name: Run Trivy scan on repo | |
| uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # 0.33.1 | |
| with: | |
| scan-type: fs | |
| format: table | |
| exit-code: "1" | |
| ignore-unfixed: true | |
| severity: CRITICAL,HIGH | |
| env: | |
| TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db | |
| govulncheck: | |
| name: Go vulnerability check | |
| needs: prereqs | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Tune GitHub-hosted runner network | |
| uses: smorimoto/tune-github-hosted-runner-network@bb252dcb5c8609a31087e7993daa086f5a1c0069 # v1.0.0 | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - id: go_version | |
| name: Read go version | |
| run: echo "go_version=$(cat .go-version)" >> $GITHUB_OUTPUT | |
| - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0 | |
| with: | |
| go-version: ${{ steps.go_version.outputs.go_version }} | |
| - run: go install golang.org/x/vuln/cmd/govulncheck@latest | |
| - run: govulncheck ./... | |
| fuzzer: | |
| name: Go Fuzzer | |
| needs: prereqs | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Tune GitHub-hosted runner network | |
| uses: smorimoto/tune-github-hosted-runner-network@bb252dcb5c8609a31087e7993daa086f5a1c0069 # v1.0.0 | |
| - name: Free disk space | |
| run: | | |
| df -h | |
| sudo rm -rf /usr/share/dotnet | |
| sudo rm -rf /opt/ghc | |
| sudo rm -rf "/usr/local/share/boost" | |
| sudo apt clean | |
| docker image ls -aq | xargs -r docker rmi | |
| df -h | |
| - name: Check out code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - id: go_version | |
| name: Read go version | |
| run: echo "go_version=$(cat .go-version)" >> $GITHUB_OUTPUT | |
| - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0 | |
| with: | |
| go-version: ${{ steps.go_version.outputs.go_version }} | |
| - run: make fuzz | |
| - name: Dump crashers | |
| if: ${{ failure() }} | |
| run: | | |
| cd pkg/json/testdata/fuzz | |
| git add -A | |
| git diff HEAD | |
| analyze: | |
| name: CodeQL | |
| needs: prereqs | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Tune GitHub-hosted runner network | |
| uses: smorimoto/tune-github-hosted-runner-network@bb252dcb5c8609a31087e7993daa086f5a1c0069 # v1.0.0 | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| # Initializes the CodeQL tools for scanning. | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@19b2f06db2b6f5108140aeb04014ef02b648f789 # v3.29.5 | |
| with: | |
| languages: go | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@19b2f06db2b6f5108140aeb04014ef02b648f789 # v3.29.5 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@19b2f06db2b6f5108140aeb04014ef02b648f789 # v3.29.5 | |
| with: | |
| category: "/language:go" |