Migrate from CircleCI to Github Actions (#3)

* Added stage workflow
Added preflight, go-dependencies-check and ginkgo jobs
Changed version and changelog

* Changed preflight job

* Changed go-dependencies-check job

* Changed ginkgo job

* Changed ginkgo version

* Added production workflow

* Removed CircleCI pipeline

.circleci/config.yml

@@ -1,26 +0,0 @@
-version: 2.1
-
-orbs:
-  guardian: bishopfox/guardian@0
-
-workflows:
-  ci:
-    jobs:
-      - guardian/preflight:
-          filters:
-            branches:
-              ignore: ["master", "staging"]
-      - guardian/ginkgo:
-          requires:
-            - guardian/preflight
-
-  release:
-    jobs:
-      - guardian/publish:
-          docker: false
-          candidate: false
-          release_name: "aws-signing"
-          filters:
-            branches:
-              only:
-                - master

.github/CODEOWNERS

@@ -0,0 +1 @@
+*       @BishopFox/engineers

.github/workflows/production.yml

@@ -0,0 +1,110 @@
+name: production
+
+on:
+  push:
+    branches:
+      - 'master'
+
+env:
+  SERVICE: 'aws-signing'
+  ENV_NAME: "stage"
+  GO_VERSION: 'v1.16.5'
+  DOCKER: 'false'
+  AWS_ROLE_TO_ASSUME: ''
+  AWS_REGION: 'us-east-1'
+  AWS_ACCOUNT_ID: ''
+  NEEDS_AWS_CREDENTIALS: 'false'
+  PLATFORMS: ''
+  DOCKER_PATH: ''
+  BUILDX: 'false'
+  REPO: ''
+  ARTIFACT_PATHS: ''
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+
+      - name: Copy Changelog
+        run: |
+          if [[ ! -d dist ]]; then
+            mkdir dist
+          fi
+
+          if [[ -f CHANGELOG.md ]]; then
+            cp CHANGELOG.md dist/CHANGELOG.md
+          fi
+        shell: bash
+
+      - name: Extract Version
+        if: env.DOCKER == 'true'
+        run: echo "VERSION=$(cat VERSION)" >> $GITHUB_ENV
+        shell: bash
+
+      - name: Set Tag Based on Branch
+        if: env.DOCKER == 'true'
+        run: |
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+          BRANCH_NAME="${{ github.head_ref }}"
+          else
+          BRANCH_NAME="${GITHUB_REF#refs/heads/}"
+          fi
+
+          if [[ "$BRANCH_NAME" == "main" || "$BRANCH_NAME" == "master" ]]; then
+          echo "TAG=${VERSION}" >> $GITHUB_ENV
+          else
+          echo "TAG=${VERSION}-${GITHUB_SHA:0:7}" >> $GITHUB_ENV
+          fi
+        shell: bash
+
+      - name: Set up Docker Buildx
+        if: env.DOCKER == 'true'
+        uses: docker/setup-buildx-action@v2
+
+      - name: Configure AWS Credentials
+        if: env.DOCKER == 'true'
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ env.AWS_ROLE_TO_ASSUME }}
+          role-session-name: GitHubActionsPlan
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Login to Amazon ECR
+        if: env.DOCKER == 'true'
+        uses: aws-actions/amazon-ecr-login@v1
+        with:
+          registries: "${{ env.AWS_ACCOUNT_ID }}"
+          mask-password: 'true'
+
+      - name: Build, tag, and push image to Amazon ECR
+        if: env.DOCKER == 'true'
+        run: |
+          if [ "${{ env.NEEDS_AWS_CREDENTIALS }}" = "true" ]; then
+            echo "Using Docker Buildx with AWS credentials"
+            docker buildx build --platform ${{ env.PLATFORMS }} -t ${{ env.TAG }} ${{ env.DOCKER_PATH }} --load \
+            --build-arg AWS_ACCESS_KEY_ID=${{ secret.AWS_ACCESS_KEY_ID }} \
+            --build-arg AWS_SECRET_ACCESS_KEY=${{ secret.AWS_SECRET_ACCESS_KEY }} \
+            --build-arg AWS_REGION=${{ env.AWS_REGION }} \
+            --load
+          elif [ "${{ env.BUILDX }}" = "true" ]; then
+            echo "Using Docker Buildx without AWS credentials"
+            docker buildx build --platform ${{ env.PLATFORMS }} -t ${{ env.TAG }} ${{ env.DOCKER_PATH }} --load
+          else
+            echo "Using standard Docker build"
+            docker build -t ${{ env.TAG }} ${{ env.DOCKER_PATH }}
+          fi
+
+          docker tag ${{ env.TAG }} ${{ env.AWS_ACCOUNT_ID }}.dkr.ecr.${{ env.AWS_REGION }}.amazonaws.com/${{ env.REPO }}:${{ env.TAG }}
+          docker push ${{ env.AWS_ACCOUNT_ID }}.dkr.ecr.${{ env.AWS_REGION }}.amazonaws.com/${{ env.REPO }}:${{ env.TAG }}
+        shell: bash
+
+      - name: Persist build artifacts
+        uses: actions/upload-artifact@v3
+        with:
+          name: build-artifacts
+          path: ${{ env.ARTIFACT_PATHS }}

.github/workflows/stage.yml

@@ -0,0 +1,200 @@
+name: stage
+
+on:
+  push:
+    branches-ignore:
+      - 'master'
+  pull_request:
+    branches-ignore:
+      - 'master'
+
+env:
+  SERVICE: 'aws-signing'
+  ENV_NAME: "stage"
+  GO_VERSION: 'v1.16.5'
+  GO_MOD_DIRECTORY: '.'
+  DIFF_PATTERN: '*\.(md|tf|js|py|svg|png)$|VERSION'
+  GINKGO_PARAMS: '-r --randomizeAllSpecs --randomizeSuites --failOnPending --cover --trace --race --progress'
+  SKIP_PACKAGES: ''
+  GOLANGCI_LINT: 'false'
+  GOIMPORTS: 'false'
+
+jobs:
+  preflight:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout tools repo
+        uses: actions/checkout@v4
+
+      - name: Check PR status
+        run: |
+          PR_DATA=$(curl -H "Authorization: token ${{ secrets.ENGINEERING_GITHUB_TOKEN }}" -H "Accept: application/vnd.github.v3+json" \
+          "https://api.github.com/repos/${{ github.repository }}/pulls?head=${{ github.repository_owner }}:${{ github.ref_name }}")
+          PR_COUNT=$(echo "$PR_DATA" | jq '. | length')
+
+          # No PR found
+          if [[ "$PR_COUNT" == "0" ]]; then
+            echo "No PR found. Exiting..."
+            exit 1
+          fi
+
+          # Check if any PR is a draft
+          PR_DRAFT=$(echo "$PR_DATA" | jq '.[] | select(.draft == true)')
+
+          if [[ -n "$PR_DRAFT" ]]; then
+            echo "Associated PR is a draft. Exiting..."
+            exit 1
+          fi
+
+          echo "Associated PR is open and not a draft. Continuing..."
+        shell: bash
+        env:
+          GITHUB_TOKEN: ${{ secrets.ENGINEERING_GITHUB_TOKEN }}
+
+      - name: Fetch all history for all tags and branches
+        run: git fetch --no-tags --prune --depth=1 origin +refs/heads/*:refs/remotes/origin/*
+        shell: bash
+
+      - name: Ensure version number is changed
+        run: |
+          set -o pipefail
+
+          # Reading diff output to array
+          readarray -t diff < <(
+            git diff "origin/${{ github.event.repository.default_branch }}" VERSION
+          )
+
+          # Checking if array length is 0 - VERSION wasn't changed
+          if [[ ${#diff[@]} -eq 0 ]]; then
+            echo "VERSION - matches origin/${{ github.event.repository.default_branch }}, needs bumped"
+            exit 1
+          fi
+        shell: bash
+
+      - name: Ensure changelog matches the version number
+        run: |
+          awk -v "version=$(cat VERSION)" 'NR == 1 && $0 !~ version {print "CHANGELOG.md - version does not match VERSION" | "cat 1>&2"; err=1} END {exit err}' CHANGELOG.md
+        shell: bash
+
+  go-dependencies-check:
+    runs-on: ubuntu-latest
+    needs: preflight
+    steps:
+      - name: Checkout repository code
+        uses: actions/checkout@v4
+
+      - name: Set up Git credentials for private module access
+        run: |
+          git config --global url."https://${{ secrets.ENGINEERING_GITHUB_TOKEN }}:[email protected]/".insteadOf "https://github.com/"
+          echo "GOPRIVATE=github.com/BishopFox/*" >> $GITHUB_ENV
+        shell: bash
+
+      - name: Check Go module dependencies
+        run: |
+          set -o pipefail
+          cd ${{ env.GO_MOD_DIRECTORY }}
+          go mod graph | awk '{print $2}' > dependencies.txt
+          matches=$(grep 'github.com/BishopFox' dependencies.txt | grep -E -v 'v[0-9]+.[0-9]+.[0-9]+$' | grep -v groot || true)
+          if [[ -n "$matches" ]]; then
+            printf "\nfailing build as go.mod references unreleased library versions: \n%s\n" "$matches" >&2
+            exit 1
+          fi
+        shell: bash
+
+      - name: Check for replace statements in go.mod
+        run: |
+          cd ${{ env.GO_MOD_DIRECTORY }}
+          matches=$(grep '^replace' go.mod || true)
+          if [[ -n "$matches" ]]; then
+            printf "\nfailing build as go.mod contains replace statements: \n%s\n" "$matches" >&2
+            exit 1
+          fi
+        shell: bash
+
+  ginkgo:
+    runs-on: ubuntu-latest
+    needs: preflight
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Fetch the main branch
+        run: git fetch origin master:master
+
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      - name: Set up Git credentials for private module access
+        run: |
+          git config --global url."https://${{ secrets.ENGINEERING_GITHUB_TOKEN }}:[email protected]/".insteadOf "https://github.com/"
+          echo "GOPRIVATE=github.com/BishopFox/*" >> $GITHUB_ENV
+        shell: bash
+
+      - name: Install Ginkgo
+        run: go install github.com/onsi/ginkgo/ginkgo@${{ env.GO_VERSION }}
+        shell: bash
+
+      - name: Run Ginkgo unit tests
+        run: |
+          set -euo pipefail
+
+          if ! (git diff --name-only HEAD "${{ github.event.repository.default_branch }}" | grep -vE "${{ env.DIFF_PATTERN }}" > /dev/null ); then
+            echo "Nothing to test"
+            exit 0
+          fi
+
+          ginkgo ${{ env.GINKGO_PARAMS }} --skipPackage "${{ env.SKIP_PACKAGES }}" .
+        shell: bash
+        working-directory: ${{ github.workspace }}
+
+
+      - name: Install and Run golangci-lint
+        if: env.GOLANGCI_LINT == 'true'
+        run: |
+          # Install golangci-lint if not already present
+          if ! command -v golangci-lint &> /dev/null; then
+            curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $HOME/bin v1.40.1
+            export PATH=$HOME/bin:$PATH  # Add golangci-lint to PATH
+          fi
+          golangci-lint --version
+
+          # Create .golangci.yml if it does not exist
+          if [[ ! -f .golangci.yml ]]; then
+            cat <<EOF >.golangci.yml
+            linters:
+              enable:
+                - gci
+                - gosimple
+                - gocritic
+                - staticcheck
+                - misspell
+                - unconvert
+                - stylecheck
+                - bodyclose
+                - rowserrcheck
+                - revive
+            linters-settings:
+              gci:
+                sections:
+                  - standard
+                  - default
+                  - prefix(github.com/BishopFox)
+          EOF
+          fi
+
+          # Run golangci-lint
+          golangci-lint run --fix
+
+          # Output the diff of changes made
+              echo "Changes made by golangci-lint:"
+              git diff
+        shell: bash
+        working-directory: ${{ github.workspace }}
+
+      - name: Run goimports
+        if: env.GOIMPORTS == 'true'
+        run: goimports -w .
+        shell: bash
+        working-directory: ${{ github.workspace }}

CHANGELOG.md

@@ -1,3 +1,7 @@
+## 1.0.2 (Mar 14, 2024)
+
+* Replaced CircleCI with Github Actions
+
 ## 1.0.1 (Mar 07, 2021)
 
 * Fix a bug calculating payload hashes

VERSION

@@ -1 +1 @@
-1.0.1
+1.0.2