main.yml

# Copyright 2021 OpenSSF Scorecard Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: build

permissions:
  contents: read

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

env:
  PROTOC_VERSION: 3.17.3
  GO_VERSION: 1.19

jobs:
  unit-test:
    name: unit-test
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
     - name: Harden Runner
       uses: step-security/harden-runner@1f99358870fe1c846a3ccba386cc2b2246836776 # v1
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

     - name: Cache builds
       # https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
       uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 #v3.3.1
       with:
         path: |
           ~/go/pkg/mod
           ~/.cache/go-build
           ~/Library/Caches/go-build
           %LocalAppData%\go-build
         key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
         restore-keys: |
           ${{ runner.os }}-go-
     - name: Clone the code
       uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2.3.4
       with:
          fetch-depth: 0
     - name: Setup Go
       uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v2.2.0
       with:
         go-version: ${{ env.GO_VERSION }}
         check-latest: true
         cache: true
     - name: Run unit-tests
       run: make unit-test
     - name: Upload codecoverage
       uses: codecov/codecov-action@81cd2dc8148241f03f5839d295e000b8f761e378 # 2.1.0
       with:
         files: ./unit-coverage.out
         verbose: true
  generate-mocks:
    name: generate-mocks
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
     - name: Harden Runner
       uses: step-security/harden-runner@1f99358870fe1c846a3ccba386cc2b2246836776 # v1
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

     - name: Install Protoc
       uses: arduino/setup-protoc@64c0c85d18e984422218383b81c52f8b077404d3 # v1.1.2
       with:
        version: ${{ env.PROTOC_VERSION }}
        repo-token: ${{ secrets.GITHUB_TOKEN }}
     - name: Cache builds
       # https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
       uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
       with:
         path: |
           ~/go/pkg/mod
           ~/.cache/go-build
           ~/Library/Caches/go-build
           %LocalAppData%\go-build
         key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
         restore-keys: |
           ${{ runner.os }}-go-
     - name: Clone the code
       uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2.3.4
       with:
          fetch-depth: 0
     - name: Setup Go
       uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v2.2.0
       with:
         go-version: ${{ env.GO_VERSION }}
         check-latest: true
         cache: true
     - name: generate mocks
       uses: nick-invision/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd
       with:
          max_attempts: 3
          retry_on: error
          timeout_minutes: 30
          command: |
            go env -w GOFLAGS=-mod=mod
            make install
            make generate-mocks
  generate-docs:
    name: generate-docs
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
     - name: Harden Runner
       uses: step-security/harden-runner@1f99358870fe1c846a3ccba386cc2b2246836776 # v1
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

     - name: Install Protoc
       uses: arduino/setup-protoc@64c0c85d18e984422218383b81c52f8b077404d3 # v1.1.2
       with:
        version: ${{ env.PROTOC_VERSION }}
        repo-token: ${{ secrets.GITHUB_TOKEN }}
     - name: Cache builds
       # https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
       uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
       with:
         path: |
           ~/go/pkg/mod
           ~/.cache/go-build
           ~/Library/Caches/go-build
           %LocalAppData%\go-build
         key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
         restore-keys: |
           ${{ runner.os }}-go-
     - name: Clone the code
       uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2.3.4
       with:
          fetch-depth: 0
     - name: Setup Go
       uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v2.2.0
       with:
         go-version: ${{ env.GO_VERSION }}
         check-latest: true
         cache: true
     - name: generate docs
       uses: nick-invision/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd
       with:
          max_attempts: 3
          retry_on: error
          timeout_minutes: 30
          command: |
            go env -w GOFLAGS=-mod=mod
            make generate-docs
  build-proto:
    name: build-proto
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
     - name: Harden Runner
       uses: step-security/harden-runner@1f99358870fe1c846a3ccba386cc2b2246836776 # v1
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

     - name: Install Protoc
       uses: arduino/setup-protoc@64c0c85d18e984422218383b81c52f8b077404d3 # v1.1.2
       with:
        version: ${{ env.PROTOC_VERSION }}
        repo-token: ${{ secrets.GITHUB_TOKEN }}
     - name: Clone the code
       uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2.3.4
       with:
          fetch-depth: 0
     - name: Setup Go
       uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v2.2.0
       with:
         go-version: ${{ env.GO_VERSION }}
         check-latest: true
         cache: true
     - name: build-proto
       uses: nick-invision/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd
       with:
          max_attempts: 3
          retry_on: error
          timeout_minutes: 30
          command: |
            go env -w GOFLAGS=-mod=mod
            make build-proto
  build-scorecard:
    name: build-scorecard
    runs-on: ubuntu-latest
    needs: build-proto
    permissions:
      contents: read
    steps:
     - name: Harden Runner
       uses: step-security/harden-runner@1f99358870fe1c846a3ccba386cc2b2246836776 # v1
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

     - name: Install Protoc
       uses: arduino/setup-protoc@64c0c85d18e984422218383b81c52f8b077404d3 # v1.1.2
       with:
        version: ${{ env.PROTOC_VERSION }}
        repo-token: ${{ secrets.GITHUB_TOKEN }}
     - name: Cache builds
       # https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
       uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
       with:
         path: |
           ~/go/pkg/mod
           ~/.cache/go-build
           ~/Library/Caches/go-build
           %LocalAppData%\go-build
         key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
         restore-keys: |
           ${{ runner.os }}-go-
     - name: Clone the code
       uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2.3.4
       with:
          fetch-depth: 0
     - name: Setup Go
       uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v2.2.0
       with:
         go-version: ${{ env.GO_VERSION }}
         check-latest: true
         cache: true
     - name: Run build
       uses: nick-invision/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd
       with:
          max_attempts: 3
          retry_on: error
          timeout_minutes: 30
          command: |
            go env -w GOFLAGS=-mod=mod
            make build-scorecard
  build-controller:
    name: build-controller
    runs-on: ubuntu-latest
    needs: build-proto
    permissions:
      contents: read
    steps:
     - name: Harden Runner
       uses: step-security/harden-runner@1f99358870fe1c846a3ccba386cc2b2246836776 # v1
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

     - name: Install Protoc
       uses: arduino/setup-protoc@64c0c85d18e984422218383b81c52f8b077404d3 # v1.1.2
       with:
        version: ${{ env.PROTOC_VERSION }}
        repo-token: ${{ secrets.GITHUB_TOKEN }}
     - name: Cache builds
       # https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
       uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
       with:
         path: |
           ~/go/pkg/mod
           ~/.cache/go-build
           ~/Library/Caches/go-build
           %LocalAppData%\go-build
         key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
         restore-keys: |
           ${{ runner.os }}-go-
     - name: Clone the code
       uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2.3.4
       with:
          fetch-depth: 0
     - name: Setup Go
       uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v2.2.0
       with:
         go-version: ${{ env.GO_VERSION }}
         check-latest: true
         cache: true
     - name: build cron
       uses: nick-invision/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd
       with:
          max_attempts: 3
          retry_on: error
          timeout_minutes: 30
          command: |
            go env -w GOFLAGS=-mod=mod
            make build-controller
  build-worker:
    name: build-worker
    runs-on: ubuntu-latest
    needs: build-proto
    permissions:
      contents: read
    steps:
     - name: Harden Runner
       uses: step-security/harden-runner@1f99358870fe1c846a3ccba386cc2b2246836776 # v1
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

     - name: Install Protoc
       uses: arduino/setup-protoc@64c0c85d18e984422218383b81c52f8b077404d3 # v1.1.2
       with:
        version: ${{ env.PROTOC_VERSION }}
        repo-token: ${{ secrets.GITHUB_TOKEN }}
     - name: Cache builds
       # https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
       uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
       with:
         path: |
           ~/go/pkg/mod
           ~/.cache/go-build
           ~/Library/Caches/go-build
           %LocalAppData%\go-build
         key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
         restore-keys: |
           ${{ runner.os }}-go-
     - name: Clone the code
       uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2.3.4
       with:
          fetch-depth: 0
     - name: Setup Go
       uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v2.2.0
       with:
         go-version: ${{ env.GO_VERSION }}
         check-latest: true
         cache: true
     - name: build worker
       uses: nick-invision/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd
       with:
          max_attempts: 3
          retry_on: error
          timeout_minutes: 30
          command: |
            go env -w GOFLAGS=-mod=mod
            make build-worker
  build-cii-worker:
    name: build-cii-worker
    runs-on: ubuntu-latest
    needs: build-proto
    permissions:
      contents: read
    steps:
     - name: Harden Runner
       uses: step-security/harden-runner@1f99358870fe1c846a3ccba386cc2b2246836776 # v1
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

     - name: Install Protoc
       uses: arduino/setup-protoc@64c0c85d18e984422218383b81c52f8b077404d3 # v1.1.2
       with:
        version: ${{ env.PROTOC_VERSION }}
        repo-token: ${{ secrets.GITHUB_TOKEN }}
     - name: Cache builds
       # https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
       uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
       with:
         path: |
           ~/go/pkg/mod
           ~/.cache/go-build
           ~/Library/Caches/go-build
           %LocalAppData%\go-build
         key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
         restore-keys: |
           ${{ runner.os }}-go-
     - name: Clone the code
       uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2.3.4
       with:
          fetch-depth: 0
     - name: Setup Go
       uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v2.2.0
       with:
         go-version: ${{ env.GO_VERSION }}
         check-latest: true
         cache: true
     - name: build cii-worker
       uses: nick-invision/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd
       with:
          max_attempts: 3
          retry_on: error
          timeout_minutes: 30
          command: |
            go env -w GOFLAGS=-mod=mod
            make build-cii-worker
  build-shuffler:
    name: build-shuffler
    runs-on: ubuntu-latest
    needs: build-proto
    permissions:
      contents: read
    steps:
     - name: Harden Runner
       uses: step-security/harden-runner@1f99358870fe1c846a3ccba386cc2b2246836776 # v1
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

     - name: Install Protoc
       uses: arduino/setup-protoc@64c0c85d18e984422218383b81c52f8b077404d3 # v1.1.2
       with:
        version: ${{ env.PROTOC_VERSION }}
        repo-token: ${{ secrets.GITHUB_TOKEN }}
     - name: Cache builds
       # https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
       uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
       with:
         path: |
           ~/go/pkg/mod
           ~/.cache/go-build
           ~/Library/Caches/go-build
           %LocalAppData%\go-build
         key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
         restore-keys: |
           ${{ runner.os }}-go-
     - name: Clone the code
       uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2.3.4
       with:
          fetch-depth: 0
     - name: Setup Go
       uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v2.2.0
       with:
         go-version: ${{ env.GO_VERSION }}
         check-latest: true
         cache: true
     - name: build shuffler
       uses: nick-invision/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd
       with:
          max_attempts: 3
          retry_on: error
          timeout_minutes: 30
          command: |
            go env -w GOFLAGS=-mod=mod
            make build-shuffler
  build-bq-transfer:
    name: build-bq-transfer
    runs-on: ubuntu-latest
    needs: build-proto
    permissions:
      contents: read
    steps:
     - name: Harden Runner
       uses: step-security/harden-runner@1f99358870fe1c846a3ccba386cc2b2246836776 # v1
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

     - name: Install Protoc
       uses: arduino/setup-protoc@64c0c85d18e984422218383b81c52f8b077404d3 # v1.1.2
       with:
        version: ${{ env.PROTOC_VERSION }}
        repo-token: ${{ secrets.GITHUB_TOKEN }}
     - name: Cache builds
       # https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
       uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
       with:
         path: |
           ~/go/pkg/mod
           ~/.cache/go-build
           ~/Library/Caches/go-build
           %LocalAppData%\go-build
         key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
         restore-keys: |
           ${{ runner.os }}-go-
     - name: Clone the code
       uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2.3.4
       with:
          fetch-depth: 0
     - name: Setup Go
       uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v2.2.0
       with:
         go-version: ${{ env.GO_VERSION }}
         check-latest: true
         cache: true
     - name: build bq transfer
       uses: nick-invision/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd
       with:
          max_attempts: 3
          retry_on: error
          timeout_minutes: 30
          command: |
            go env -w GOFLAGS=-mod=mod
            make build-bq-transfer
  build-github-server:
    name: build-github-server
    runs-on: ubuntu-latest
    needs: build-proto
    permissions:
      contents: read
    steps:
     - name: Harden Runner
       uses: step-security/harden-runner@1f99358870fe1c846a3ccba386cc2b2246836776 # v1
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

     - name: Install Protoc
       uses: arduino/setup-protoc@64c0c85d18e984422218383b81c52f8b077404d3 # v1.1.2
       with:
        version: ${{ env.PROTOC_VERSION }}
        repo-token: ${{ secrets.GITHUB_TOKEN }}
     - name: Cache builds
       # https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
       uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
       with:
         path: |
           ~/go/pkg/mod
           ~/.cache/go-build
           ~/Library/Caches/go-build
           %LocalAppData%\go-build
         key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
         restore-keys: |
           ${{ runner.os }}-go-
     - name: Clone the code
       uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2.3.4
       with:
          fetch-depth: 0
     - name: Setup Go
       uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v2.2.0
       with:
         go-version: ${{ env.GO_VERSION }}
         check-latest: true
         cache: true
     - name: build bq transfer
       uses: nick-invision/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd
       with:
          max_attempts: 3
          retry_on: error
          timeout_minutes: 30
          command: |
            go env -w GOFLAGS=-mod=mod
            make build-github-server
  build-webhook:
    name: build-webhook
    runs-on: ubuntu-latest
    needs: build-proto
    permissions:
      contents: read
    steps:
     - name: Harden Runner
       uses: step-security/harden-runner@1f99358870fe1c846a3ccba386cc2b2246836776 # v1
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

     - name: Install Protoc
       uses: arduino/setup-protoc@64c0c85d18e984422218383b81c52f8b077404d3 # v1.1.2
       with:
        version: ${{ env.PROTOC_VERSION }}
        repo-token: ${{ secrets.GITHUB_TOKEN }}
     - name: Cache builds
       # https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
       uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
       with:
         path: |
           ~/go/pkg/mod
           ~/.cache/go-build
           ~/Library/Caches/go-build
           %LocalAppData%\go-build
         key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
         restore-keys: |
           ${{ runner.os }}-go-
     - name: Clone the code
       uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2.3.4
       with:
          fetch-depth: 0
     - name: Setup Go
       uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v2.2.0
       with:
         go-version: ${{ env.GO_VERSION }}
         check-latest: true
         cache: true
     - name: build webhook
       uses: nick-invision/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd
       with:
          max_attempts: 3
          retry_on: error
          timeout_minutes: 30
          command: |
            go env -w GOFLAGS=-mod=mod
            make build-webhook
  build-add-script:
    name: build-add-script
    runs-on: ubuntu-latest
    needs: build-proto
    permissions:
      contents: read
    steps:
     - name: Harden Runner
       uses: step-security/harden-runner@1f99358870fe1c846a3ccba386cc2b2246836776 # v1
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

     - name: Install Protoc
       uses: arduino/setup-protoc@64c0c85d18e984422218383b81c52f8b077404d3 # v1.1.2
       with:
        version: ${{ env.PROTOC_VERSION }}
        repo-token: ${{ secrets.GITHUB_TOKEN }}
     - name: Cache builds
       # https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
       uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
       with:
         path: |
           ~/go/pkg/mod
           ~/.cache/go-build
           ~/Library/Caches/go-build
           %LocalAppData%\go-build
         key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
         restore-keys: |
           ${{ runner.os }}-go-
     - name: Clone the code
       uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2.3.4
       with:
          fetch-depth: 0
     - name: Setup Go
       uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v2.2.0
       with:
         go-version: ${{ env.GO_VERSION }}
         check-latest: true
         cache: true
     - name: build-add-script
       uses: nick-invision/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd
       with:
          max_attempts: 3
          retry_on: error
          timeout_minutes: 30
          command: |
            go env -w GOFLAGS=-mod=mod
            make build-add-script
  build-validate-script:
    name: build-validate-script
    runs-on: ubuntu-latest
    needs: build-proto
    permissions:
      contents: read
    steps:
     - name: Harden Runner
       uses: step-security/harden-runner@1f99358870fe1c846a3ccba386cc2b2246836776 # v1
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

     - name: Install Protoc
       uses: arduino/setup-protoc@64c0c85d18e984422218383b81c52f8b077404d3 # v1.1.2
       with:
        version: ${{ env.PROTOC_VERSION }}
        repo-token: ${{ secrets.GITHUB_TOKEN }}
     - name: Cache builds
       # https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
       uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
       with:
         path: |
           ~/go/pkg/mod
           ~/.cache/go-build
           ~/Library/Caches/go-build
           %LocalAppData%\go-build
         key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
         restore-keys: |
           ${{ runner.os }}-go-
     - name: Clone the code
       uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2.3.4
       with:
          fetch-depth: 0
     - name: Setup Go
       uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v2.2.0
       with:
         go-version: ${{ env.GO_VERSION }}
         check-latest: true
         cache: true
     - name: build-validate-script
       uses: nick-invision/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd
       with:
          max_attempts: 3
          retry_on: error
          timeout_minutes: 30
          command: |
            go env -w GOFLAGS=-mod=mod
            make build-validate-script
  build-update-script:
    name: build-update-script
    runs-on: ubuntu-latest
    needs: build-proto
    permissions:
      contents: read
    steps:
     - name: Harden Runner
       uses: step-security/harden-runner@1f99358870fe1c846a3ccba386cc2b2246836776 # v1
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

     - name: Install Protoc
       uses: arduino/setup-protoc@64c0c85d18e984422218383b81c52f8b077404d3 # v1.1.2
       with:
        version: ${{ env.PROTOC_VERSION }}
        repo-token: ${{ secrets.GITHUB_TOKEN }}
     - name: Cache builds
       # https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
       uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
       with:
         path: |
           ~/go/pkg/mod
           ~/.cache/go-build
           ~/Library/Caches/go-build
           %LocalAppData%\go-build
         key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
         restore-keys: |
           ${{ runner.os }}-go-
     - name: Clone the code
       uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2.3.4
       with:
          fetch-depth: 0
     - name: Setup Go
       uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v2.2.0
       with:
         go-version: ${{ env.GO_VERSION }}
         check-latest: true
         cache: true
     - name: build-validate-script
       uses: nick-invision/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd
       with:
          max_attempts: 3
          retry_on: error
          timeout_minutes: 30
          command: |
            go env -w GOFLAGS=-mod=mod
            make build-update-script
  check-linter:
    name: check-linter
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
     - name: Harden Runner
       uses: step-security/harden-runner@1f99358870fe1c846a3ccba386cc2b2246836776 # v1
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

     - name: Install Protoc
       uses: arduino/setup-protoc@64c0c85d18e984422218383b81c52f8b077404d3 # v1.1.2
       with:
        version: ${{ env.PROTOC_VERSION }}
        repo-token: ${{ secrets.GITHUB_TOKEN }}
     - name: Clone the code
       uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2.3.4
       with:
          fetch-depth: 0
     - name: Setup Go
       uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v2.2.0
       with:
         go-version: ${{ env.GO_VERSION }}
         check-latest: true
         cache: true
     - name: Run build
       run: |
            go env -w GOFLAGS=-mod=mod
            make check-linter
  validate-docs:
    name: validate-docs
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
     - name: Harden Runner
       uses: step-security/harden-runner@1f99358870fe1c846a3ccba386cc2b2246836776 # v1
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

     - name: Cache builds
       # https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
       uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
       with:
         path: |
           ~/go/pkg/mod
           ~/.cache/go-build
           ~/Library/Caches/go-build
           %LocalAppData%\go-build
         key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
         restore-keys: |
           ${{ runner.os }}-go-
     - name: Clone the code
       uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2.3.4
       with:
          fetch-depth: 0
     - name: Setup Go
       uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v2.2.0
       with:
         go-version: ${{ env.GO_VERSION }}
         check-latest: true
         cache: true
     - name: Run build
       uses: nick-invision/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd
       with:
          max_attempts: 3
          retry_on: error
          timeout_minutes: 30
          command: |
            go env -w GOFLAGS=-mod=mod
            make validate-docs
  add-projects:
    name: add-projects
    runs-on: ubuntu-latest
    needs: build-proto
    permissions:
      contents: read
    steps:
     - name: Harden Runner
       uses: step-security/harden-runner@1f99358870fe1c846a3ccba386cc2b2246836776 # v1
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
     - name: Install Protoc
       uses: arduino/setup-protoc@64c0c85d18e984422218383b81c52f8b077404d3 # v1.1.2
       with:
        version: ${{ env.PROTOC_VERSION }}
        repo-token: ${{ secrets.GITHUB_TOKEN }}
     - name: Cache builds
       # https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
       uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
       with:
         path: |
           ~/go/pkg/mod
           ~/.cache/go-build
           ~/Library/Caches/go-build
           %LocalAppData%\go-build
         key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
         restore-keys: |
           ${{ runner.os }}-go-
     - name: Clone the code
       uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2.3.4
       with:
          fetch-depth: 0
     - name: Setup Go
       uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v2.2.0
       with:
         go-version: ${{ env.GO_VERSION }}
         check-latest: true
         cache: true
     - name: Run build
       uses: nick-invision/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd
       with:
          max_attempts: 3
          retry_on: error
          timeout_minutes: 30
          command: |
            go env -w GOFLAGS=-mod=mod
            make add-projects
  validate-projects:
    name: validate-projects
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
     - name: Harden Runner
       uses: step-security/harden-runner@1f99358870fe1c846a3ccba386cc2b2246836776 # v1
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

     - name: Install Protoc
       uses: arduino/setup-protoc@64c0c85d18e984422218383b81c52f8b077404d3 # v1.1.2
       with:
        version: ${{ env.PROTOC_VERSION }}
        repo-token: ${{ secrets.GITHUB_TOKEN }}
     - name: Clone the code
       uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2.3.4
       with:
          fetch-depth: 0
     - name: Setup Go
       uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v2.2.0
       with:
         go-version: ${{ env.GO_VERSION }}
         check-latest: true
         cache: true
     - name: Run build
       uses: nick-invision/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd
       with:
          max_attempts: 3
          retry_on: error
          timeout_minutes: 30
          command: |
            go env -w GOFLAGS=-mod=mod
            make validate-projects
  license-check:
    name: license boilerplate check
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@1f99358870fe1c846a3ccba386cc2b2246836776 # v1
        with:
          egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v2.3.4
      - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v2.2.0
        with:
          go-version: ${{ env.GO_VERSION }}
          check-latest: true
          cache: true
      - name: Check license headers
        run: |
          go env -w GOFLAGS=-mod=mod
          go install github.com/google/addlicense@2fe3ee94479d08be985a84861de4e6b06a1c7208
          addlicense -ignore "**/script-empty.sh" -ignore "testdata/**" -ignore "**/testdata/**" -l apache -c 'OpenSSF Scorecard Authors' -v *
          git diff --exit-code