Add unit tests and CodeQL scanning in GitHub CI/CD

[FeynmanZhou]

In order to ensure the high quality of project delivery, I propose to improve the automated testing process for Notary v2. Currently, we need to add some basic e2e tests, unit tests, and integration tests for notation, notation-go, and notation-core-go.

As Notation CLI is used for end-users and it has multiple packages for different platforms (Linux amd64 & arm64 and Windows), it is also recommended to consider the basic usability test cases (e.g. install, build, push, sign, verify) in the automated testing script.

[dtzar]

I would like to scope this item to just the E2E testing for notation cli - this will inherently test at least parts of the API "pseudo integration".
notation-go already has unit tests.
notation-core-go I added notaryproject/notation-core-go#6
Full integration tests should be broken out in a separate work item, but it isn't priority for RC1.

[FeynmanZhou]

I would like to scope this item to just the E2E testing for notation cli - this will inherently test at least parts of the API "pseudo integration". notation-go already has unit tests. notation-core-go I added notaryproject/notation-core-go#6 Full integration tests should be broken out in a separate work item, but it isn't priority for RC1.

Agree, we could iterate it in the next release.

[Wwwsylvia]

FYI, I'm adding code scan, unit tests and coverage report to notation, notation-go, and notation-core-go.

Here are the PRs I currently have:

• notation

  • Add CodeQL Security Scanning #198
  • Run unit tests in Github workflow #199

• notation-go

  • Add CodeQL Security Scanning notation-go#56
  • Run unit tests in Github workflow notation-go#60

• notation-core-go

  • Setup Github workflow notation-core-go#8
  • Add CodeQL Security Scanning notation-core-go#9
  • Set up dependabot notation-core-go#10

[FeynmanZhou]

@Wwwsylvia Thanks for your updates. I see Shiwei is reviewing these PRs.

[dtzar]

All of these are merged, so closing out this issue.