test.yml

name: Test

on:
  workflow_call:
    inputs:
      AWS_ACCOUNT_ID:
        required: true
        type: string
      AWS_REGION:
        required: true
        type: string
      FLOW_NAME:
        required: true
        type: string
      TRAIL_NAME:
        required: true
        type: string
      KOSLI_ORG:
        required: true
        type: string
      run_lint:
        required: false
        type: boolean
        default: true
      run_snyk:
        required: false
        type: boolean
        default: true
      report_to_kosli:
        required: false
        type: string
        default: 'none'
      checkout_ref:
        required: false
        type: string
        default: ''
    secrets:
      slack_channel:
        required: true
      slack_webhook:
        required: true
      github_access_token:
        required: true
      gitlab_access_token:
        required: true
      azure_access_token:
        required: true
      azure_client_id:
        required: true
      azure_client_secret:
        required: true
      bitbucket_access_token:
        required: true
      jira_api_token:
        required: true
      snyk_token:
        required: true
      kosli_reporting_api_token:
        required: true
      kosli_querying_api_token:
        required: true
      sonarqube_token:
        required: true


jobs:
  lint:
    if: ${{ inputs.run_lint }}
    name: Lint
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: write
    steps:

    - name: Harden Runner
      uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
      with:
        egress-policy: audit

    - uses: actions/checkout@v6
      with:
        ref: ${{ inputs.checkout_ref || github.sha }}

    - uses: actions/setup-go@v6
      with:
        go-version-file: '.go-version'
        check-latest: true

    - name: setup-kosli-cli
      uses: kosli-dev/setup-cli-action@v5
      with:
        version:
          ${{ vars.KOSLI_CLI_VERSION }}

    - name: Run golangci-lint
      id: lint
      uses: golangci/golangci-lint-action@v9
      with:
        version: latest
        args: --timeout=5m -v

    - name: Report lint to Kosli
      if:  ${{ (success() || failure()) && inputs.report_to_kosli != 'none' }}
      env:
        KOSLI_API_TOKEN: ${{ secrets.kosli_reporting_api_token }}
      run: kosli attest generic
           --name lint
           --flow ${{ inputs.FLOW_NAME }}
           --trail ${{ inputs.TRAIL_NAME }}
           --org ${{ inputs.KOSLI_ORG }}
           --compliant=${{ steps.lint.outcome == 'success' }}

  test:
    name: Test
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: write
    steps:

    - name: Harden Runner
      uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
      with:
        egress-policy: audit

    - uses: actions/checkout@v6
      with:
        fetch-depth: 0 # needed for some tests referencing older commits
        ref: ${{ inputs.checkout_ref || github.sha }}

    - uses: actions/setup-go@v6
      with:
        go-version-file: '.go-version'
        check-latest: true

    - name: setup-kosli-cli
      uses: kosli-dev/setup-cli-action@v5
      with:
        version:
          ${{ vars.KOSLI_CLI_VERSION }}

    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@v6
      with:
        role-to-assume: arn:aws:iam::${{ inputs.AWS_ACCOUNT_ID }}:role/cli
        aws-region: ${{ inputs.AWS_REGION }}
        role-duration-seconds: 2400
        role-session-name: ${{ github.event.repository.name }}

    - name: Login to Amazon ECR private
      id: login-ecr-private
      uses: aws-actions/amazon-ecr-login@v2

    - name: Run tests
      env:
        KOSLI_GITHUB_TOKEN: ${{ secrets.github_access_token }}
        KOSLI_GITLAB_TOKEN: ${{ secrets.gitlab_access_token }}
        KOSLI_AZURE_TOKEN: ${{ secrets.azure_access_token }}
        KOSLI_BITBUCKET_ACCESS_TOKEN: ${{ secrets.bitbucket_access_token }}
        KOSLI_JIRA_API_TOKEN: ${{ secrets.jira_api_token }}
        KOSLI_JIRA_USERNAME: ${{ vars.KOSLI_JIRA_USERNAME }}
        INTEGRATION_TEST_AZURE_CLIENT_SECRET: ${{ secrets.azure_client_secret }}
        INTEGRATION_TEST_AZURE_CLIENT_ID: ${{ secrets.azure_client_id }}
        KOSLI_SONAR_API_TOKEN: ${{ secrets.sonarqube_token }}
        KOSLI_API_TOKEN_PROD: ${{ secrets.kosli_querying_api_token }}
        GH_TOKEN: ${{ secrets.github_access_token }}  # sonar tests download artifacts from cyber-dojo/differ
      run: |
        # some tests use git operations, therefore the git author on the CI VM needs to be set
        git config --global user.name "John Doe"
        git config --global user.email johndoe@example.com
        make test_integration_full

    - name: Report test to Kosli
      if:  ${{ (success() || failure()) && inputs.report_to_kosli != 'none' }}
      env:
        KOSLI_API_TOKEN: ${{ secrets.kosli_reporting_api_token }}
      run: kosli attest junit
           --name test
           --flow ${{ inputs.FLOW_NAME }}
           --trail ${{ inputs.TRAIL_NAME }}
           --results-dir junit-test-results
           --org ${{ inputs.KOSLI_ORG }}

    - name: Upload coverage reports to Codecov
      if: ${{ inputs.report_to_kosli != 'none' }}
      uses: codecov/codecov-action@v6

  snyk-code-test:
    if: ${{ inputs.run_snyk }}
    name: Snyk Code Test
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: write
    steps:

    - name: Harden Runner
      uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
      with:
        egress-policy: audit

    - uses: actions/checkout@v6
      with:
        ref: ${{ inputs.checkout_ref || github.sha }}

    - name: setup Snyk
      uses: snyk/actions/setup@master

    - name: setup-kosli-cli
      uses: kosli-dev/setup-cli-action@v5
      with:
        version:
          ${{ vars.KOSLI_CLI_VERSION }}

    - name: Run Snyk to check source code for vulnerabilities
      env:
        SNYK_TOKEN: ${{ secrets.snyk_token }}
      run:
          snyk code test --sarif --policy-path=.snyk  --sarif-file-output=snyk-code.json --prune-repeated-subdependencies

    - name: Report Snyk Code to Kosli
      if:  ${{ (success() || failure()) && inputs.report_to_kosli != 'none' }}
      env:
        KOSLI_API_TOKEN: ${{ secrets.kosli_reporting_api_token }}
      run: kosli attest snyk
           --name snyk-code-test
           --flow ${{ inputs.FLOW_NAME }}
           --trail ${{ inputs.TRAIL_NAME }}
           --scan-results  snyk-code.json
           --org ${{ inputs.KOSLI_ORG }}

  snyk-dependency-test:
    if: ${{ inputs.run_snyk }}
    name: Snyk Dependency Test
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: write
    steps:

    - name: Harden Runner
      uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
      with:
        egress-policy: audit

    - uses: actions/checkout@v6
      with:
        ref: ${{ inputs.checkout_ref || github.sha }}

    - name: setup Snyk
      uses: snyk/actions/setup@master

    - name: setup-kosli-cli
      uses: kosli-dev/setup-cli-action@v5
      with:
        version:
          ${{ vars.KOSLI_CLI_VERSION }}

    - name: Run Snyk to check dependencies for vulnerabilities
      env:
        SNYK_TOKEN: ${{ secrets.snyk_token }}
      run:
          snyk test --sarif --policy-path=.snyk  --sarif-file-output=snyk-dependency.json --prune-repeated-subdependencies

    - name: Report Snyk Test to Kosli
      if:  ${{ (success() || failure()) && inputs.report_to_kosli != 'none' }}
      env:
        KOSLI_API_TOKEN: ${{ secrets.kosli_reporting_api_token }}
      run: kosli attest snyk
           --name snyk-dependency-test
           --flow ${{ inputs.FLOW_NAME }}
           --trail ${{ inputs.TRAIL_NAME }}
           --scan-results  snyk-dependency.json
           --org ${{ inputs.KOSLI_ORG }}