ci-tests.yml

name: Continuous Integration Tests

on:
  pull_request:

permissions:
  contents: read

jobs:
  unit-tests:
    runs-on: cx-public-ubuntu-x64
    steps:
      - name: Checkout the repository
        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2 #v4.0.0
      - name: Set up Go version
        uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 #v4
        with:
          go-version-file: go.mod
      - run: go version
      - name: go test with coverage
        run: |
          sudo chmod +x ./internal/commands/.scripts/up.sh
          ./internal/commands/.scripts/up.sh
      - name: Check if total coverage is greater then 77.7
        shell: bash
        run: |
          CODE_COV=$(go tool cover -func cover.out | grep total | awk '{print substr($3, 1, length($3)-1)}')
          EXPECTED_CODE_COV=77.7
          var=$(awk 'BEGIN{ print "'$CODE_COV'"<"'$EXPECTED_CODE_COV'" }')
          if [ "$var" -eq 1 ];then
            echo "Your code coverage is too low. Coverage precentage is: $CODE_COV"
            exit 1
          else
            echo "Your code coverage test passed! Coverage precentage is: $CODE_COV"
            exit 0
          fi
  integration-tests:
    runs-on: cx-public-ubuntu-x64
    steps:
      - name: Checkout the repository
        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2 #v4.0.0
      - name: Set up Go version
        uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 #v4
        with:
          go-version-file: go.mod
      - run: go version
      - name: Check Python version
        run: python --version
      - name: Install pre-commit
        run: |
           pip config set global.index-url https://:${{ secrets.ECHO_LIBRARIES_ACCESS_KEY }}@pypi.echohq.com/simple
           pip index versions pre-commit
           pip install pre-commit==4.6.0
      - name: Go Build
        run: go build -o ./bin/cx ./cmd
      - name: Install gocovmerge
        run: go install github.com/wadey/gocovmerge@latest
      - name: Go Integration test
        shell: bash
        env:
          CX_BASE_URI: ${{ secrets.CX_BASE_URI }}
          CX_CLIENT_ID: ${{ secrets.CX_CLIENT_ID }}
          CX_CLIENT_SECRET: ${{ secrets.CX_CLIENT_SECRET }}
          CX_BASE_AUTH_URI: ${{ secrets.CX_BASE_AUTH_URI }}
          CX_AST_USERNAME: ${{ secrets.CX_AST_USERNAME }}
          CX_AST_PASSWORD: ${{ secrets.CX_AST_PASSWORD }}
          CX_APIKEY: ${{ secrets.CX_APIKEY }}
          CX_TENANT: ${{ secrets.CX_TENANT }}
          CX_SCAN_SSH_KEY: ${{ secrets.CX_SCAN_SSH_KEY }}
          CX_ORIGIN: "cli-tests"
          PERSONAL_ACCESS_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
          PROXY_HOST: localhost
          PROXY_PORT: 3128
          PROXY_USERNAME: ${{ secrets.PROXY_USER }}
          PROXY_PASSWORD: ${{ secrets.PROXY_PASSWORD }}
          PR_GITHUB_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
          PR_GITHUB_NAMESPACE: "checkmarx"
          PR_GITHUB_REPO_NAME: "ast-cli"
          PR_GITHUB_NUMBER: 983
          PR_GITLAB_TOKEN: ${{ secrets.PR_GITLAB_TOKEN }}
          PR_GITLAB_NAMESPACE: ${{ secrets.PR_GITLAB_NAMESPACE }}
          PR_GITLAB_REPO_NAME: ${{ secrets.PR_GITLAB_REPO_NAME }}
          PR_GITLAB_PROJECT_ID: ${{ secrets.PR_GITLAB_PROJECT_ID }}
          PR_GITLAB_IID: ${{ secrets.PR_GITLAB_IID }}
          AZURE_ORG: ${{ secrets.AZURE_ORG }}
          AZURE_PROJECT: ${{ secrets.AZURE_PROJECT }}
          AZURE_REPOS: ${{ secrets.AZURE_REPOS }}
          AZURE_TOKEN: ${{ secrets.AZURE_TOKEN }}
          AZURE_PR_NUMBER: 1
          BITBUCKET_WORKSPACE: ${{ secrets.BITBUCKET_WORKSPACE }}
          BITBUCKET_REPOS: ${{ secrets.BITBUCKET_REPOS }}
          BITBUCKET_USERNAME: ${{ secrets.BITBUCKET_USERNAME }}
          BITBUCKET_PASSWORD: ${{ secrets.BITBUCKET_PASSWORD }}
          GITLAB_TOKEN: ${{ secrets.GITLAB_TOKEN }}
          GITHUB_ACTOR: ${{ github.actor }}
          PR_BITBUCKET_TOKEN: ${{ secrets.PR_BITBUCKET_TOKEN }}
          PR_BITBUCKET_NAMESPACE: "AstSystemTest"
          PR_BITBUCKET_REPO_NAME: "cliIntegrationTest"
          PR_BITBUCKET_ID: 1
        run: |
          sudo chmod +x ./internal/commands/.scripts/integration_up.sh ./internal/commands/.scripts/integration_down.sh
          ./internal/commands/.scripts/integration_up.sh
          ./internal/commands/.scripts/integration_down.sh

      - name: Coverage report
        uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 #v4
        with:
          name: ${{ runner.os }}-coverage-latest
          path: coverage.html

      - name: Check if total coverage is greater then 75
        shell: bash
        run: |
          CODE_COV=$(go tool cover -func cover.out | grep total | awk '{print substr($3, 1, length($3)-1)}')
          EXPECTED_CODE_COV=75
          var=$(awk 'BEGIN{ print "'$CODE_COV'"<"'$EXPECTED_CODE_COV'" }')
          if [ "$var" -eq 1 ];then
            echo "Your code coverage is too low. Coverage precentage is: $CODE_COV"
            exit 1
          else
            echo "Your code coverage test passed! Coverage precentage is: $CODE_COV"
            exit 0
          fi
  lint:
    permissions:
      contents: read  # for actions/checkout to fetch code
      pull-requests: read  # for golangci/golangci-lint-action to fetch pull requests
    name: lint
    runs-on: cx-public-ubuntu-x64
    steps:
      - uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2 #v4.0.0
      - name: Set up Go version
        uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 #v4
        with:
          go-version-file: go.mod
      - run: go version
      - run: go mod tidy
      - name: golangci-lint
        uses: step-security/golangci-lint-action@1797facf9ea427614d729a4e9cab0fae1a7852d9 # v9.2.0
        with:
          skip-pkg-cache: true
          version: v2.11.3
          args: -c .golangci.yml
            --timeout 10m
          only-new-issues: true

  govulncheck:
    runs-on: cx-public-ubuntu-x64
    name: govulncheck
    steps:
      - uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2 #v4.0.0
      - name: Set up Go version
        uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 #v4
        with:
          go-version-file: go.mod
      - name: Install govulncheck
        run: go install golang.org/x/vuln/cmd/govulncheck@0782b76014f15f24e22a438f30f308df42899ba1 #1.3.0
      - name: Run govulncheck
        run: govulncheck ./...
        continue-on-error: true

  checkDockerImage:
    runs-on: cx-public-ubuntu-x64
    name: scan Docker Image with Trivy
    steps:
      - name: Checkout code
        uses: actions/checkout@722adc63f1aa60a57ec37892e133b1d319cae598 #2.0.0


      # - name: Set up Docker
      #   uses: docker/setup-buildx-action@cf09c5c41b299b55c366aff30022701412eb6ab0 #v1.0.0

      # - name: Log in to Docker Hub
      #   uses: docker/login-action@49ed152c8eca782a232dede0303416e8f356c37b #v2
      #   with:
      #     username: ${{ secrets.DOCKER_USERNAME }}
      #     password: ${{ secrets.DOCKER_PASSWORD }}
      - name: Build the project
        run: go build -o ./cx ./cmd
      - name: Build Docker image
        run: docker build -t ast-cli:${{ github.sha }} .
      - name: Run Trivy scanner without downloading DBs
        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 #v0.35.0
        with:
          scan-type: 'image'
          image-ref: ast-cli:${{ github.sha }}
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          output: './trivy-image-results.txt'
        env:
          TRIVY_SKIP_JAVA_DB_UPDATE: true

      - name: Inspect action report
        if: always()
        shell: bash
        run: cat ./trivy-image-results.txt