TrogonEventStore/.github/workflows/common.yml at master · TrogonStack/TrogonEventStore · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
name: Common

on:
  pull_request:
    paths-ignore:
      - "docs/**"
      - "samples/**"
      - "**.md"
  push:
    branches:
      - master
      - main
      - release/v*
    tags:
      - v*
    paths-ignore:
      - "docs/**"
      - "samples/**"
      - "**.md"

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  packages: read

jobs:
  semantic-conventions:
    runs-on: ubuntu-latest
    name: Semantic Conventions
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          persist-credentials: false
      - name: Install repository tools
        uses: jdx/mise-action@v4.2.1
        with:
          cache: false
      - name: Verify semantic conventions
        run: mise run semconv:check

  csharp-quality:
    runs-on: ubuntu-latest
    name: C# Quality
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - name: Install net10.0
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: 10.0.x
      - name: Set up .NET NuGet authentication
        run: |
          dotnet nuget add source "https://nuget.pkg.github.com/TrogonStack/index.json" \
            --name "github" \
            --username "${{ github.actor }}" \
            --password ${{ secrets.GITHUB_TOKEN }} \
            --store-password-in-clear-text
      - name: Resolve comparison refs
        id: refs
        shell: bash
        run: |
          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
            echo "base=${{ github.event.pull_request.base.sha }}" >> "$GITHUB_OUTPUT"
            echo "head=${{ github.event.pull_request.head.sha }}" >> "$GITHUB_OUTPUT"
          else
            echo "base=${{ github.event.before }}" >> "$GITHUB_OUTPUT"
            echo "head=${{ github.sha }}" >> "$GITHUB_OUTPUT"
          fi
      - name: Restore
        run: |
          dotnet restore src/EventStore.sln
      - name: Lint unused variables
        run: |
          dotnet build --no-restore --configuration Release -p:Platform=x64 -warnaserror:CS0168,CS0219,CS8321 src/EventStore.sln
      - name: Verify C# formatting
        run: |
          ./ci/csharp-format-changed.sh src/EventStore.sln "${{ steps.refs.outputs.base }}" "${{ steps.refs.outputs.head }}"
      - name: Verify semantic convention package
        run: |
          dotnet pack --no-restore --configuration Release --output artifacts/packages \
            src/TrogonEventStore.SemanticConventions/TrogonEventStore.SemanticConventions.csproj

  vulnerability-scan:
    runs-on: ubuntu-latest
    name: Scan for Vulnerabilities
    steps:
      - name: Checkout
        uses: actions/checkout@v7
      - name: Install net10.0
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: 10.0.x
      - name: Set up .NET NuGet authentication
        run: |
          dotnet nuget add source "https://nuget.pkg.github.com/TrogonStack/index.json" \
            --name "github" \
            --username ${{ github.actor }} \
            --password ${{ secrets.GITHUB_TOKEN }} \
            --store-password-in-clear-text
      - name: Scan for Vulnerabilities
        run: |
          cd src
          dotnet restore
          dotnet list package --vulnerable --include-transitive | tee vulnerabilities.txt
          ! cat vulnerabilities.txt | grep -q "has the following vulnerable packages"

  protolock:
    runs-on: ubuntu-latest
    name: Protolock Status
    steps:
      - name: Checkout
        uses: actions/checkout@v7
      - name: Protolock Status
        shell: bash
        run: |
          ./protolock.sh status --uptodate
  docker-compose:
    runs-on: ubuntu-latest
    name: Docker Compose Smoke Test
    steps:
      - name: Checkout
        uses: actions/checkout@v7
      - name: Github Registry Docker Login
        uses: docker/login-action@v4
        with:
          registry: docker.pkg.github.com
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Docker Compose Smoke Test
        env:
          DOCKER_BUILDKIT: 1
          NUGET_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          docker compose build
          docker compose up --detach
          printf 'Waiting for cluster'
          timeout 60 bash -c -- 'until curl --output /dev/null --silent --insecure --fail https://localhost:2113/-/readiness; do printf '.'; sleep 2; done'
          docker compose down