build-test-distribute.yaml

name: "build-test-distribute"
on:
  push:
    branches: ["master", "release-*", "!*-merge-master"]
    tags: ["*"]
  pull_request:
    branches: ["master", "release-*"]
  workflow_dispatch: # Allows manual trigger from GitHub Actions UI or via REST call
permissions:
  contents: read
env:
  KUMA_DIR: "."
  # To keep CI tools out of the SBOM, we use a `.ci_tools` directory in the parent
  # of the code checkout path (typically /home/runner/work/<repo-name>/<repo-name>
  # on the runner).
  CI_TOOLS_DIR: "/home/runner/work/kuma/.ci_tools"
  # renovate: datasource=github-tags depName=golangci-lint packageName=golangci/golangci-lint versioning=semver
  GOLANGCI_LINT_VERSION: "v2.11.4"
  MISE_DISABLE_TOOLS: "golangci-lint,skaffold"
concurrency:
  group: ${{ format('{0}-{1}-{2}', github.workflow, github.event_name, github.event_name == 'push' && github.sha || github.event_name == 'pull_request' && github.event.pull_request.number || github.event_name == 'workflow_dispatch' && github.ref_name) }}
  cancel-in-progress: ${{ github.event_name == 'push' && false || true }}
jobs:
  check:
    permissions:
      contents: write # needed to upload SBOM assets to GitHub releases
      checks: write # needed for golangci/golangci-lint-action to add code annotations in PRs
      pull-requests: read # needed by paths-filter to access PR file list
    timeout-minutes: 40
    runs-on: ubuntu-24.04
    env:
      FULL_MATRIX: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' || contains(github.event.pull_request.labels.*.name, 'ci/run-full-matrix') }}
      ALLOW_PUSH: ${{ github.event_name == 'push' || contains(github.event.pull_request.labels.*.name, 'ci/force-publish') }}
      BUILD: ${{ github.event_name == 'push' || contains(github.event.pull_request.labels.*.name, 'ci/run-build') || contains(github.event.pull_request.labels.*.name, 'ci/force-publish') }}
      FORCE_PUBLISH_FROM_FORK: ${{ github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ci/force-publish') && github.event.pull_request.head.repo.full_name != github.repository }}
    outputs:
      FULL_MATRIX: ${{ env.FULL_MATRIX }}
      ALLOW_PUSH: ${{ env.ALLOW_PUSH }}
      BUILD: ${{ env.BUILD }}
      IMAGES: ${{ steps.metadata.outputs.images }}
      REGISTRY: ${{ steps.metadata.outputs.registry }}
      VERSION_NAME: ${{ steps.metadata.outputs.version }}
      NOTARY_REPOSITORY: ${{ (contains(steps.metadata.outputs.version, 'preview') && 'notary-internal') || 'notary' }}
      CLOUDSMITH_REPOSITORY: ${{ steps.metadata.outputs.distribution_repository }}
    steps:
      - name: "Fail when 'ci/force-publish' label is present on PRs from forks"
        if: ${{ fromJSON(env.FORCE_PUBLISH_FROM_FORK) }}
        run: |
          echo "::error title=Label 'ci/force-publish' cannot be used on PRs from forks::To prevent accidental exposure of secrets, CI won't use repository secrets on pull requests from forks"
          exit 1
      - name: "Free up disk space for the Runner"
        uses: endersonmenezes/free-disk-space@7901478139cff6e9d44df5972fd8ab8fcade4db1 # v3.2.2
        with:
          remove_android: true
          remove_dotnet: true
          remove_haskell: true
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
      - name: Detect changed files
        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
        id: changes
        with:
          filters: |
            code:
              - '**/*.go'
              - '**/*.proto'
              - 'go.mod'
              - 'go.sum'
              - 'pkg/**'
              - 'api/**'
              - 'tools/**'
              - 'app/**'
            helm:
              - 'deployments/charts/**'
            shell:
              - '**/*.sh'
            dockerfiles:
              - 'tools/releases/dockerfiles/**'
            workflows:
              - '.github/workflows/**'
      - name: Set GOMEMLIMIT dynamically based on available memory
        id: set-gomemlimit
        run: |
          # Get total memory in bytes
          set -e
          mem_total_kb=$(grep MemTotal /proc/meminfo | awk '{print $2}')
          mem_total_bytes=$((mem_total_kb * 1024))
          gomemlimit=$((mem_total_bytes * 8 / 10))
          echo "GOMEMLIMIT=${gomemlimit}" >> "$GITHUB_ENV"
          echo "Setting GOMEMLIMIT to $(numfmt --to=iec "$gomemlimit")"
      - name: Cache Go build
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
          key: go-build-${{ runner.os }}-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            go-build-${{ runner.os }}-
      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
        env:
          GITHUB_TOKEN: ${{ github.token }}
      - uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
        if: steps.changes.outputs.code == 'true'
        env:
          GOGC: "80" # run GC more aggressively
        with:
          args: --fix=false --verbose
          version: ${{ env.GOLANGCI_LINT_VERSION }}
          only-new-issues: false

      - run: |
          make clean
      - run: |
          make check
      - name: "Set metadata for downstream jobs"
        id: metadata
        run: |
          {
            echo "images=$(make images/info/release/json)"
            echo "registry=$(make docker/info/registry)"
            echo "version=$(make build/info/version)"
            echo "distribution_repository=$(make build/info/cloudsmith_repository)"
          } >> "$GITHUB_OUTPUT"
      # "make check" puts binaries in ./build/tools (see mk/generate.mk: $(POLICY_GEN)
      # and $(RESOURCE_GEN)), which are unnecessarily included in the SBOM.
      # Running the SCA step before "make check" might seem like a solution, but it
      # generates report files (e.g., sbom.spdx.json, cve-report.json) in the working
      # directory. These files cause "make check" to fail, as it checks if no files
      # in the repository were modified, deleted, or added after its process.
      # It doesn't recognize that the SBOM and CVE report files were added earlier
      # and should be ignored. Since we currently can't change the working directory
      # for the SCA step, it must run after "make check." Instead, we clean ./build
      # after "make check" to exclude tool binaries from the SBOM.
      - run: |
          make clean/build
      - name: "Generate SBOM and CVE report (Software Composition Analysis)"
        id: sca-project
        uses: Kong/public-shared-actions/security-actions/sca@4cb2f03c59d51085256a1405c81e0dd7e9a91fe9 # v6.0.2
        env:
          SYFT_SOURCE_NAME: ${{ github.repository }}
          SYFT_SOURCE_VERSION: ${{ steps.metadata.outputs.version }}
        with:
          dir: .
          config: .syft.yaml
          upload-sbom-release-assets: true
  test:
    needs: ["check"]
    uses: ./.github/workflows/_test.yaml
    with:
      FULL_MATRIX: ${{ needs.check.outputs.FULL_MATRIX }}
      RUNNERS_BY_ARCH: '{"amd64":"ubuntu-24.04","arm64":"ubuntu-24.04-arm"}'
    secrets: inherit
  build_publish:
    permissions:
      contents: write # needed to upload SBOM assets to GitHub releases
      id-token: write # Required for image signing
    needs: ["check", "test"]
    uses: ./.github/workflows/_build_publish.yaml
    if: ${{ fromJSON(needs.check.outputs.BUILD) }}
    with:
      FULL_MATRIX: ${{ needs.check.outputs.FULL_MATRIX }}
      ALLOW_PUSH: ${{ needs.check.outputs.ALLOW_PUSH }}
      IMAGE_ARTIFACT_NAME: "image_artifacts"
      BINARY_ARTIFACT_NAME: "binary_artifacts"
      IMAGES: ${{ needs.check.outputs.IMAGES }}
      REGISTRY: ${{ needs.check.outputs.REGISTRY }}
      NOTARY_REPOSITORY: ${{ needs.check.outputs.NOTARY_REPOSITORY }}
      VERSION_NAME: ${{ needs.check.outputs.VERSION_NAME }}
    secrets: inherit
  provenance:
    needs: ["check", "build_publish"]
    if: ${{ github.ref_type == 'tag' }}
    uses: ./.github/workflows/_provenance.yaml
    secrets: inherit
    permissions:
      actions: read # For getting workflow run info to build provenance
      contents: write # To add assets to a release
      id-token: write # For using token to sign images
      packages: write # Required for publishing provenance. Issue: https://github.com/slsa-framework/slsa-github-generator/tree/main/internal/builders/container#known-issues
    with:
      BINARY_ARTIFACTS_HASH_AS_FILE: ${{ needs.build_publish.outputs.BINARY_ARTIFACT_DIGEST_BASE64 }}
      IMAGES: ${{ needs.check.outputs.IMAGES }}
      REGISTRY: ${{ needs.check.outputs.REGISTRY }}
      NOTARY_REPOSITORY: ${{ needs.check.outputs.NOTARY_REPOSITORY }}
      IMAGE_DIGESTS: ${{ needs.build_publish.outputs.IMAGE_DIGESTS }}
  distributions:
    needs: ["build_publish", "check", "test", "provenance"]
    permissions:
      id-token: write
    timeout-minutes: 10
    if: ${{ always() }}
    runs-on: ubuntu-24.04
    env:
      SECURITY_ASSETS_DOWNLOAD_PATH: "${{ github.workspace }}/security-assets"
      SECURITY_ASSETS_PACKAGE_NAME: "security-assets" # Cloudsmith package for hosting security assets
    steps:
      - name: "Halt due to previous failures"
        run: |-
          echo "results: ${{ toJson(needs.*.result) }}"
          # for some reason, GH Action will always trigger a downstream job even if there are errors in an dependent job
          # so we manually check it here. An example could be found here: https://github.com/kumahq/kuma/actions/runs/7044980149
          [[ ${{ contains(needs.*.result, 'failure')|| contains(needs.*.result, 'cancelled') }} == "true" ]] && exit 1
          echo "All dependent jobs succeeded"
      - name: "Download all SBOM assets"
        id: collect_sbom
        if: ${{ needs.build_publish.result == 'success' }}
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: ${{ env.SECURITY_ASSETS_DOWNLOAD_PATH }}
          pattern: "*sbom.{cyclonedx,spdx}.json"
          merge-multiple: true
      - name: "Download binary artifact provenance"
        if: ${{ needs.provenance.result == 'success' && github.ref_type == 'tag' }}
        id: collect_provenance
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: ${{ env.SECURITY_ASSETS_DOWNLOAD_PATH }}
          pattern: ${{ github.event.repository.name }}.intoto.jsonl
          merge-multiple: true
      - name: "Generate security assets TAR"
        if: ${{ needs.build_publish.result == 'success' }}
        id: security_assets_metadata
        run: |
          cd ${{ env.SECURITY_ASSETS_DOWNLOAD_PATH }}
          find . -maxdepth 1 -type f \( -name '*sbom.*.json' -o -name '*.intoto.jsonl' \) -print | tar -cvzf ${{ env.SECURITY_ASSETS_PACKAGE_NAME }}.tar.gz -T -
          ls -alR .
        # Publish aggregated zip file of SBOMs and/or Binary Provenance to artifact regstry
      - name: Get Cloudsmith OIDC token
        id: cloudsmith_token
        if: ${{ needs.provenance.result == 'success' || needs.build_publish.result == 'success' }}
        uses: cloudsmith-io/cloudsmith-cli-action@18665afcce9f859312b61989671af9af7402e4fb # v2.0.2
        with:
          oidc-namespace: kong
          oidc-service-slug: ${{ contains(needs.check.outputs.VERSION_NAME, 'preview') && vars.CLOUDSMITH_PREVIEW_SERVICE_ACCOUNT || vars.CLOUDSMITH_PROD_SERVICE_ACCOUNT }}
          oidc-auth-only: true
      - name: Push security assets to cloudsmith
        id: push_security_assets
        if: ${{ needs.provenance.result == 'success' || needs.build_publish.result == 'success' }}
        uses: cloudsmith-io/action@7af394e0f8add4867bce109385962dafecad1b8d # v0.6.14
        with:
          api-key: ${{ steps.cloudsmith_token.outputs.oidc-token }}
          command: "push"
          format: "raw"
          owner: "kong"
          repo: "${{ needs.check.outputs.CLOUDSMITH_REPOSITORY }}"
          version: "${{ needs.check.outputs.VERSION_NAME }}"
          file: "${{ env.SECURITY_ASSETS_DOWNLOAD_PATH }}/${{ env.SECURITY_ASSETS_PACKAGE_NAME }}.tar.gz"
          name: "${{ env.SECURITY_ASSETS_PACKAGE_NAME }}"
          summary: "SLSA security artifacts for ${{ github.repository }}"
          description: "SBOM and Binary artifact Provenance for ${{ github.repository }}"
          use-executable: "false"