ci.yml

name: CI Pipeline

on:
  push:
    branches: ["*"]
  pull_request:
    branches: ["*"]

jobs:
  test:
    runs-on: ubuntu-latest
    env:
      GOEXPERIMENT: runtimesecret

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.26"

      - name: Cache Go modules
        uses: actions/cache@v4
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-

      - name: Download dependencies
        run: GOWORK=off go mod download

      - name: Run unit tests
        run: GOWORK=off CGO_ENABLED=1 go test -v -race -coverprofile=coverage.out ./...

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v4
        with:
          file: ./coverage.out
          flags: unittests
          name: codecov-umbrella

  lint:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.26"

      - name: Run golangci-lint
        uses: golangci/golangci-lint-action@v6
        env:
          GOWORK: "off"
          CGO_ENABLED: "0"
        with:
          version: latest
          install-mode: goinstall
          args: --timeout=5m
          skip-cache: true

  # Security vulnerability scanning
  security-scan:
    runs-on: ubuntu-latest
    name: Security Vulnerability Scan
    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.26"

      - name: Cache Go modules
        uses: actions/cache@v4
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-

      - name: Vendor dependencies
        run: GOWORK=off go mod vendor

      - name: Install govulncheck
        run: go install golang.org/x/vuln/cmd/govulncheck@latest

      - name: Run govulncheck and generate SARIF
        run: |
          echo "Current directory: $(pwd)"
          echo "Files in current directory:"
          ls -la
          govulncheck -format=sarif ./... > govulncheck-results.sarif
          
          govulncheck -json ./... > vuln.json
          count=$(jq '[.[] | select(.finding != null and .finding.trace != null)] | length' vuln.json || echo 0)
          echo "Found $count vulnerabilities"
          
          if [ "$count" -gt 0 ]; then
            echo "⚠️ Vulnerabilities found by govulncheck (see Security tab for details)"
          else
            echo "✅ No vulnerabilities found by govulncheck"
          fi
        continue-on-error: true

      - name: Upload govulncheck results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        continue-on-error: true
        with:
          sarif_file: govulncheck-results.sarif
          category: govulncheck

      - name: Install gosec
        run: go install github.com/securego/gosec/v2/cmd/gosec@latest

      - name: Run gosec security scanner
        run: |
          gosec -fmt sarif -out gosec-results.sarif -exclude G304 ./...
        continue-on-error: true

      - name: Upload gosec results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        continue-on-error: true
        with:
          sarif_file: gosec-results.sarif
          category: gosec

  # CodeQL Analysis
  codeql-analysis:
    name: CodeQL Analysis
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        language: ["go"]

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.26"

      - name: Cache Go modules
        uses: actions/cache@v4
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-

      - name: Vendor dependencies
        run: GOWORK=off go mod vendor

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: ${{ matrix.language }}
          queries: +security-and-quality

      - name: Build for CodeQL
        run: |
          CGO_ENABLED=0 go build -v ./cmd/mpcd
          CGO_ENABLED=0 go build -v ./cmd/lux-mpc-cli

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3
        with:
          category: "/language:${{matrix.language}}"

  # SBOM Generation
  sbom:
    runs-on: ubuntu-latest
    name: Generate SBOM
    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.26"

      - name: Cache Go modules
        uses: actions/cache@v4
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-

      - name: Vendor dependencies
        run: GOWORK=off go mod vendor

      - name: Build binaries
        run: |
          CGO_ENABLED=0 go build -o mpcd ./cmd/mpcd
          CGO_ENABLED=0 go build -o lux-mpc-cli ./cmd/lux-mpc-cli

      - name: Generate SBOM with anchore/sbom-action (SPDX-JSON)
        uses: anchore/sbom-action@v0
        with:
          artifact-name: sbom-spdx.json
          output-file: sbom.spdx.json
          format: spdx-json

      - name: Generate SBOM with anchore/sbom-action (CycloneDX)
        uses: anchore/sbom-action@v0
        with:
          artifact-name: sbom-cyclonedx.json
          output-file: sbom.cyclonedx.json
          format: cyclonedx-json
          upload-artifact: false

      - name: Generate SBOM with anchore/sbom-action (Syft JSON)
        uses: anchore/sbom-action@v0
        with:
          artifact-name: sbom-syft.json
          output-file: sbom.syft.json
          format: syft-json
          upload-artifact: false

      - name: Upload all SBOM artifacts
        uses: actions/upload-artifact@v4
        with:
          name: sbom-files
          path: |
            sbom.spdx.json
            sbom.cyclonedx.json
            sbom.syft.json
          retention-days: 30

      - name: Install Grype
        run: |
          curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin

      - name: Scan SBOM with Grype
        run: |
          grype sbom.spdx.json -o sarif --file grype-results.sarif
        continue-on-error: true

      - name: Upload Grype results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        continue-on-error: true
        with:
          sarif_file: grype-results.sarif
          category: grype

      - name: Display SBOM summary
        run: |
          echo "📦 SBOM Generation Summary"
          echo "========================="
          echo "Generated SBOM files:"
          ls -la sbom.*
          echo ""
          echo "SBOM package count:"
          echo "SPDX: $(jq '.packages | length' sbom.spdx.json)"
          echo "CycloneDX: $(jq '.components | length' sbom.cyclonedx.json)"
          echo "Syft: $(jq '.artifacts | length' sbom.syft.json)"

  build:
    runs-on: lux-build-linux-amd64
    needs: [test, lint, codeql-analysis, sbom]
    env:
      GOEXPERIMENT: runtimesecret

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.26"

      - name: Cache Go modules
        uses: actions/cache@v4
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-

      - name: Vendor dependencies
        run: GOWORK=off go mod vendor

      - name: Build mpcd
        run: CGO_ENABLED=0 GOWORK=off go build -mod=vendor -v ./cmd/mpcd

      - name: Build lux-mpc-cli
        run: CGO_ENABLED=0 GOWORK=off go build -mod=vendor -v ./cmd/lux-mpc-cli