pr.yml

name: Build Test and Scan

on:
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  build-and-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Build the image
        uses: docker/build-push-action@v5
        with:
          tags: device-opcua:${{ github.sha }}
          load: true
      - name: Scan with Trivy
        uses: aquasecurity/trivy-action@0.26.0
        env:
          GITHUB_TOKEN: ${{ secrets.GHCR_TOKEN }}
          TRIVY_DISABLE_VEX_NOTICE: "true"
        with:
          image-ref: device-opcua:${{ github.sha }}
          format: table
          exit-code: 1
          ignore-unfixed: true
          hide-progress: true
          severity: CRITICAL,HIGH,MEDIUM
          output: trivy.txt
      - name: Publish Trivy Output to Summary
        if: always()
        run: |
          if [[ -s trivy.txt ]]; then
            {
              echo "### Trivy Scan Results"
              echo ""
              echo '```terraform'
              cat trivy.txt
              echo '```'
            } >> $GITHUB_STEP_SUMMARY
          fi

  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          check-latest: true
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.10"
      - name: Install dependencies
        run: |
          python3 -m pip install opcua cryptography
      - name: Run unit tests
        run: |
          make test >> test-results.txt
      - name: Publish results to summary
        if: always()
        run: |
          if [[ -s test-results.txt ]]; then
            {
              echo "### Test Results"
              echo ""
              echo '```sh'
              cat test-results.txt
              echo '```'
            } >> $GITHUB_STEP_SUMMARY
          fi