initial commit

.circleci/config.yml

@@ -0,0 +1,109 @@
+version: 2.1
+orbs:
+  go: circleci/go@1
+  slack: circleci/slack@4
+  snyk: snyk/snyk@1
+
+commands:
+  gcr_auth:
+    description: Auth GCR
+    steps:
+      - setup_remote_docker:
+          docker_layer_caching: true
+          version: 20.10.14
+      - run:
+          name: GCR auth
+          command: echo $GCLOUD_GCR_BUILDER | docker login -u _json_key --password-stdin https://gcr.io/snyk-main
+  save-build-cache:
+    steps:
+      - save_cache:
+          name: Saving Go build cache
+          key: go-build-cache-{{ .Branch }}-{{ .Revision }}
+          paths:
+            - /home/circleci/.cache/go-build
+  restore-build-cache:
+    steps:
+      - restore_cache:
+          name: Restoring Go build cache
+          keys: 
+            - go-build-cache-{{ .Branch }}-{{ .Revision }}
+            - go-build-cache-{{ .Branch }}-
+            - go-build-cache-
+
+jobs:
+  scan:
+    resource_class: small
+    docker:
+      - image: "cimg/go:1.20"
+    steps: 
+      - checkout
+      - snyk/scan:
+          fail-on-issues: true
+          monitor-on-build: false # ?
+          organization: snyk-apps
+
+  test:
+    resource_class: medium
+    executor:
+      name: go/default
+      tag: "1.20"
+    steps:
+      - checkout
+      # saving & restoring the module cache takes almost 6x longer than simply fetching the modules...
+      #- go/mod-download-cached
+      - restore-build-cache 
+      - run:
+          command: |
+            golangci-lint run ./...
+          environment:
+            # we re-use the Go build cache as our lint-cache too.
+            GOLANGCI_LINT_CACHE: /home/circleci/.cache/go-build
+      # we're not using the go/test command from the Go orb because that uses `-count=1` as an argument.
+      # That means all tests are run every time, instead of honoring the cache.
+      - run:
+          command: go test -race ./... 
+      - save-build-cache
+
+  release:
+    resource_class: small
+    docker: [image: "cimg/go:1.20"]
+    steps:
+      - checkout
+      - gcr_auth
+      - run:
+          name: build docker image
+          command: make image
+      #- run:
+          #name: push docker image
+          #command: make image-push
+
+
+workflows:
+  "Test":
+    jobs:
+      - test:
+          filters:
+            branches:
+              ignore: [main]
+      - scan:
+          name: scan
+          context: ["snyk-apps"]
+          filters:
+            branches:
+              ignore: [main]
+  "Release":
+    jobs:
+      - test:
+          filters:
+            branches:
+              only: main
+            tags:
+              only: /^v.*/
+      - release:
+          requires: ["test"]
+          context: [snyk-docker-build, snyk-bot-slack] 
+          filters:
+            branches:
+              ignore: /.*/
+            tags:
+              only: /^v.*/

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @snyk/taskforce-insights-k8s-integration

Dockerfile

@@ -0,0 +1,21 @@
+FROM golang:1.20 as build
+
+WORKDIR /go/src/app
+COPY . .
+
+ARG COMMIT_SHA
+ARG GIT_TAG
+
+RUN go mod download
+RUN CGO_ENABLED=0 go build \
+    -ldflags="-s -w \
+        -X github.com/snyk/kubernetes-scanner/build.commitSHA=$COMMIT_SHA \
+        -X github.com/snyk/kubernetes-scanner/build.tag=$GIT_TAG\
+    " \
+    -trimpath \
+    -o /go/bin/kubernetes-scanner
+
+FROM gcr.io/distroless/static
+
+COPY --from=build /go/bin/kubernetes-scanner /
+CMD ["/kubernetes-scanner"]

Makefile

@@ -0,0 +1,43 @@
+SHELL := /bin/bash
+
+ifeq ($(CIRCLE_SHA1),)
+	GIT_COMMIT := $(shell git rev-parse --verify HEAD)
+else 
+	GIT_COMMIT := $(CIRCLE_SHA1)
+endif
+
+ifeq ($(CIRCLE_TAG),)
+	TAG := $(GIT_COMMIT)
+else
+	TAG := $(CIRCLE_TAG)
+endif
+
+
+GOCMD=go
+GOMOD=$(GOCMD) mod
+GOBUILD=$(GOCMD) build
+GOTEST=$(GOCMD) test
+GOGENERATE=$(GOCMD) generate
+DOCKER=docker
+
+all: fmt lint tidy generate test build
+	$(info  "completed running make file for golang project")
+fmt:
+	@go fmt ./...
+lint:
+	env GOROOT=$$(go env GOROOT) golangci-lint run ./...
+tidy:
+	$(GOMOD) tidy -v
+generate:
+	$(GOGENERATE) ./...
+test:
+	$(GOTEST) ./... 
+build:
+	$(GOBUILD) -v
+image:
+	$(DOCKER) build -t gcr.io/snyk-main/kubernetes-scanner:$(TAG) \
+		--build-arg COMMIT_SHA='$(GIT_COMMIT)' \
+		--build-arg GIT_TAG="${CIRCLE_TAG}" \
+		.
+push-image:
+	$(DOCKER) push gcr.io/snyk-main/kubernetes-scanner:$(GIT_COMMIT)

build/version.go

@@ -0,0 +1,18 @@
+package build
+
+var (
+	// these variables are set at build time to their respective values.
+	commitSHA string
+	tag       string
+)
+
+func Version() string {
+	if tag == "" {
+		tag = "v0.0.0"
+	}
+
+	if commitSHA != "" {
+		return tag + "-" + commitSHA
+	}
+	return "unknown"
+}

go.mod

@@ -0,0 +1,3 @@
+module github.com/snyk/kubernetes-scanner
+
+go 1.19

main.go

@@ -0,0 +1,11 @@
+package main
+
+import (
+	"fmt"
+
+	"github.com/snyk/kubernetes-scanner/build"
+)
+
+func main() {
+	fmt.Println(build.Version())
+}