build.yaml

name: Build and publish xk6-kafka

on:
  push:
    tags:
      - "v*"

jobs:
  build:
    name: Build xk6-kafka
    runs-on: ubuntu-latest
    steps:
      - name: Checkout 🛎️
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Install Go 🧑‍💻
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
        uses: actions/setup-go@v3
        with:
          go-version: "1.19"

      - name: Install xk6 and build xk6-kafka for different platforms 🏗️
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
        run: |
          mkdir dist
          go install go.k6.io/xk6/cmd/xk6@latest
          GOOS=linux GOARCH=amd64 xk6 build --output dist/xk6-kafka_${{ github.ref_name }}_linux_amd64 --with github.com/mostafa/xk6-kafka@${{ github.ref_name }}
          tar cvzf dist/xk6-kafka_${{ github.ref_name }}_linux_amd64.tar.gz dist/xk6-kafka_${{ github.ref_name }}_linux_amd64
          GOOS=darwin GOARCH=amd64 xk6 build --output dist/xk6-kafka_${{ github.ref_name }}_darwin_amd64 --with github.com/mostafa/xk6-kafka@${{ github.ref_name }}
          tar cvzf dist/xk6-kafka_${{ github.ref_name }}_darwin_amd64.tar.gz dist/xk6-kafka_${{ github.ref_name }}_darwin_amd64
          GOOS=windows GOARCH=amd64 xk6 build --output dist/xk6-kafka_${{ github.ref_name }}_windows_amd64.exe --with github.com/mostafa/xk6-kafka@${{ github.ref_name }}
          tar cvzf dist/xk6-kafka_${{ github.ref_name }}_windows_amd64.tar.gz dist/xk6-kafka_${{ github.ref_name }}_windows_amd64.exe

      - name: Generate CycloneDX SBOM artifacts 📃
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
        run: |
          go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest
          cyclonedx-gomod mod -json -licenses -output code-cyclonedx-xk6-kafka-${{ github.ref_name }}.json

      - name: Docker meta 📝
        id: meta
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
        uses: docker/metadata-action@v4
        with:
          images: mostafamoradian/xk6-kafka
          tags: |
            type=semver,pattern={{version}}

      - name: Login to DockerHub 🔒
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
        uses: docker/login-action@v1
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push Docker image 🛳️
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
        uses: docker/build-push-action@v2
        with:
          context: .
          push: true
          build-args: K6_BINARY=./dist/xk6-kafka_${{ github.ref_name }}_linux_amd64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

      - name: Install cosign ⬇️
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
        uses: sigstore/cosign-installer@main

      - name: Sign the Docker image ✍️
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
        run: echo "${{ steps.meta.outputs.tags }}" | xargs -I {} cosign sign -y docker.io/{}

      - name: Verify the Docker image signature ✅
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
        run: |
          echo "${{ steps.meta.outputs.tags }}" | xargs -I {} cosign verify --certificate-identity ${IDENTITY} --certificate-oidc-issuer ${OIDC_ISSUER_URL} docker.io/{}
        env:
          IDENTITY: ${{ secrets.IDENTITY }}
          OIDC_ISSUER_URL: ${{ secrets.OIDC_ISSUER_URL }}

      - name: Scan code with Trivy vulnerability scanner 🔍
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: mostafamoradian/xk6-kafka:${{ github.ref_name }}
          scan-type: "fs"
          format: "sarif"
          output: "trivy-results.sarif"
          exit-code: 1
          ignore-unfixed: true
          severity: "CRITICAL,HIGH"
          skip-dirs: "fixtures"

      - name: Upload Trivy scan results to GitHub Security tab ⬆️
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
        uses: github/codeql-action/upload-sarif@v1
        with:
          sarif_file: "trivy-results.sarif"

      - name: Scan Docker image with Syft and generate SBOM 🦉
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
        uses: anchore/sbom-action@v0
        with:
          artifact-name: docker-image-cyclonedx-xk6-kafka-${{ github.ref_name }}.json
          format: cyclonedx-json
          dependency-snapshot: true

      - name: Create Release 📦 and add binaries and SBOM files 💾
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
        uses: softprops/action-gh-release@v1
        with:
          files: |
            dist/*.tar.gz
            code-cyclonedx-xk6-kafka-${{ github.ref_name }}.json
            docker-image-cyclonedx-xk6-kafka-${{ github.ref_name }}.json