main-build.yml

name: main-build
on:
  push:
    branches:
      - main
permissions:
  contents: read

jobs:
  build:
    name: build
    runs-on: ARM64
    permissions:
      contents: read
      packages: write
      id-token: write # needed for signing the images with GitHub OIDC Token **not production ready**

    # keda-tools is built from github.com/test-tools/tools/Dockerfile
    container: ghcr.io/kedacore/keda-tools:1.23.3
    steps:
      - name: Check out code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          fetch-depth: 1

      - name: Register workspace path
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

      - id: go-paths
        run: |
          echo "mod_cache=$(go env GOMODCACHE)" >> $GITHUB_OUTPUT
          echo "build_cache=$(go env GOCACHE)" >> $GITHUB_OUTPUT

      - name: Go modules cache
        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          path: ${{ steps.go-paths.outputs.mod_cache }}
          key: ${{ runner.os }}-go-mod-${{ hashFiles('**/go.sum') }}

      - name: Go build cache
        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          path: ${{ steps.go-paths.outputs.build_cache }}
          key: ${{ runner.os }}-go-build-cache-${{ hashFiles('**/go.sum') }}

      - name: Go modules sync
        run: go mod tidy -compat=1.23

      - name: Test
        run: make test

      - name: Login to GitHub Container Registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          # Username used to log in to a Docker registry. If not set then no login will occur
          username: ${{ github.repository_owner }}
          # Password or personal access token used to log in to a Docker registry. If not set then no login will occur
          password: ${{ secrets.GH_AUTOMATION_PAT }}
          # Server address of Docker registry. If not set then will default to Docker Hub
          registry: ghcr.io

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1

      - name: Publish on GitHub Container Registry
        run: make publish-multiarch

      # https://github.com/sigstore/cosign-installer
      - name: Install Cosign
        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0

      - name: Check Cosign install!
        run: cosign version

      - name: Sign KEDA images published on GitHub Container Registry
        # This step uses the identity token to provision an ephemeral certificate
        # against the sigstore community Fulcio instance.
        run: make sign-images

  validate:
    needs: build
    uses: kedacore/keda/.github/workflows/template-main-e2e-test.yml@main
    secrets: inherit

  validate-arm64:
    needs: build
    uses: kedacore/keda/.github/workflows/template-arm64-smoke-tests.yml@main

  validate-k8s-versions:
    needs: build
    uses: kedacore/keda/.github/workflows/template-versions-smoke-tests.yml@main

  trivy-scan:
    needs: build
    permissions:
      contents: read
      security-events: write
    uses: kedacore/keda/.github/workflows/template-trivy-scan.yml@main
    with:
      runs-on: ubuntu-latest
      scan-type: "fs"
      format: "sarif"
      exit-code: 0
      publish: true

  trivy-scan-metrics-server:
    needs: build
    permissions:
      contents: read
      security-events: write
    strategy:
      matrix:
        runner: [ARM64, ubuntu-latest]
    uses: kedacore/keda/.github/workflows/template-trivy-scan.yml@main
    with:
      runs-on: ${{ matrix.runner }}
      scan-type: "image"
      image-ref: ghcr.io/kedacore/keda-metrics-apiserver:main
      format: "sarif"
      exit-code: 0
      publish: true

  trivy-scan-keda:
    needs: build
    permissions:
      contents: read
      security-events: write
    strategy:
      matrix:
        runner: [ARM64, ubuntu-latest]
    uses: kedacore/keda/.github/workflows/template-trivy-scan.yml@main
    with:
      runs-on: ${{ matrix.runner }}
      scan-type: "image"
      image-ref: ghcr.io/kedacore/keda:main
      format: "sarif"
      exit-code: 0
      publish: true