Merge pull request #3 from project-ncl/add-go-lint-and-renovate

Improve go CI.

.github/workflows/go-ci.yaml

@@ -0,0 +1,90 @@
+name: GoLang CI
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: './go.mod'
+      - name: golangci-lint
+        uses: golangci/[email protected]
+        with:
+          args: "--timeout=10m --build-tags='normal periodic minikube'"
+  go:
+    name: Check sources
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+      - name: Install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: './go.mod'
+      - name: Check go mod status
+        run: |
+          go mod tidy
+          if [[ ! -z $(git status -s) ]]
+          then
+            echo "Go mod state is not clean:"
+            git --no-pager diff
+            exit 1
+          fi
+      - name: Check format
+        run: |
+          go fmt ./cmd/... ./pkg/...
+          if [[ ! -z $(git status -s) ]]
+          then
+            echo "not all golang files properly gofmt'ed:"
+            git --no-pager diff
+            exit 1
+          fi
+  unit:
+    name: Golang Unit tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+      - name: Install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: './go.mod'
+      - name: Build Domain Proxy Server
+        run: go build -v -o bin/domainproxyserver cmd/server/main.go
+      - name: Build Domain Proxy Client
+        run: go build -v -o bin/domainproxyclient cmd/client/main.go
+      - name: Test
+        run: go test -v ./test
+      - name: Codecov
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          verbose: true
+  security_scan:
+    name: Security scan
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: './go.mod'
+      # https://github.com/securego/gosec/blob/12be14859bc7d4b956b71bef0b443694aa519d8a/README.md#integrating-with-code-scanning
+      - name: Run Gosec Security Scanner
+        uses: securego/gosec@master
+        with:
+          # we let the report trigger content trigger a failure using the GitHub Security features.
+          args: '-tags normal,periodic -no-fail -fmt sarif -out results.sarif ./...'
+      - name: Upload SARIF file
+        uses: github/codeql-action/[email protected]
+        with:
+          # Path to SARIF file relative to the root of the repository
+          sarif_file: results.sarif

.gitignore

@@ -11,9 +11,6 @@
 # Output of the go coverage tool, specifically when used with LiteIDE
 *.out
 
-# Dependency directories (remove the comment below to include it)
-/vendor/
-
 # Go workspace file
 go.work
 go.work.sum

deploy/Dockerfile.all-in-one

@@ -1,13 +1,12 @@
-FROM registry.access.redhat.com/ubi9/go-toolset:1.22.5-1731639025@sha256:45170b6e45114849b5d2c0e55d730ffa4a709ddf5f58b9e810548097b085e78f as builder
+FROM registry.access.redhat.com/ubi9/go-toolset@sha256:ead35188c5748efe2b9420352aba56b02b43d8fcd7e879cc96c6b9ac2548e454 as builder
 USER 0
 WORKDIR /work
 COPY ./ .
 
 ENV GOTOOLCHAIN=auto \
     GOSUMDB=sum.golang.org
 
-RUN go mod tidy && \
-    go build -o domainproxyserver cmd/server/main.go && \
+RUN go build -o domainproxyserver cmd/server/main.go && \
     go build -o domainproxyclient cmd/client/main.go
 
 FROM quay.io/konflux-ci/buildah-task:latest@sha256:5cbd487022fb7ac476cbfdea25513b810f7e343ec48f89dc6a4e8c3c39fa37a2