cli/.github/workflows/ci.yml at main · Enkryptify/cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
name: CI

on:
    push:
        branches: [main]
    pull_request:
        branches: [main]

concurrency:
    group: ci-${{ github.ref }}
    cancel-in-progress: true

jobs:
    lint:
        name: Lint & Typecheck
        runs-on: ubuntu-latest
        steps:
            - uses: actions/checkout@v6

            - uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3
              with:
                  bun-version: "1.3.10"

            - uses: actions/cache@v4
              with:
                  path: ~/.bun/install/cache
                  key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
                  restore-keys: bun-${{ runner.os }}-

            - run: bun install --frozen-lockfile

            - name: oxlint
              run: bun run lint

            - name: oxfmt
              run: bun run format:check

            - name: TypeScript type check
              run: bun run typecheck

    betterleaks:
        name: Secret Scanning
        runs-on: ubuntu-latest
        steps:
            - uses: actions/checkout@v6
              with:
                  fetch-depth: 0

            - name: Install BetterLeaks
              run: |
                  set -euo pipefail
                  BETTERLEAKS_VERSION=$(curl -s https://api.github.com/repos/betterleaks/betterleaks/releases/latest | grep '"tag_name"' | sed -E 's/.*"v([^"]+)".*/\1/')
                  curl -sSfL "https://github.com/betterleaks/betterleaks/releases/download/v${BETTERLEAKS_VERSION}/betterleaks_${BETTERLEAKS_VERSION}_linux_x64.tar.gz" | tar xz -C /usr/local/bin betterleaks

            - name: Scan for secrets
              run: betterleaks git --report-format=sarif --report-path=betterleaks-results.sarif .

            - name: Upload SARIF results
              if: always()
              uses: actions/upload-artifact@v4
              with:
                  name: betterleaks-results
                  path: betterleaks-results.sarif
                  retention-days: 30

    dependency-audit:
        name: Dependency Audit
        runs-on: ubuntu-latest
        steps:
            - uses: actions/checkout@v6

            - uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3
              with:
                  bun-version: "1.3.10"

            - uses: actions/cache@v4
              with:
                  path: ~/.bun/install/cache
                  key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
                  restore-keys: bun-${{ runner.os }}-

            - run: bun install --frozen-lockfile

            - name: Audit dependencies
              run: bun audit --audit-level=high

            - name: Generate SBOM
              run: |
                  tmpdir=$(mktemp -d)
                  npm exec --prefix "$tmpdir" --yes --package @cyclonedx/cyclonedx-npm -- cyclonedx-npm --output-file sbom.json

            - name: Upload SBOM
              uses: actions/upload-artifact@v4
              with:
                  name: sbom
                  path: sbom.json
                  retention-days: 90

    test:
        name: Test
        runs-on: ubuntu-latest
        steps:
            - uses: actions/checkout@v6

            - uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3
              with:
                  bun-version: "1.3.10"

            - uses: actions/cache@v4
              with:
                  path: ~/.bun/install/cache
                  key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
                  restore-keys: bun-${{ runner.os }}-

            - run: bun install --frozen-lockfile

            - name: Run tests
              run: bun run test:run

    build-verify:
        name: Build (${{ matrix.label }})
        runs-on: ${{ matrix.runner }}
        strategy:
            fail-fast: false
            matrix:
                include:
                    - label: linux-x64
                      runner: ubuntu-latest
                      target: bun-linux-x64
                      binary: dist/ek
                    - label: linux-arm64
                      runner: ubuntu-24.04-arm
                      target: bun-linux-arm64
                      binary: dist/ek
                    - label: macos-arm64
                      runner: macos-latest
                      target: bun-darwin-arm64
                      binary: dist/ek
                    - label: windows-x64
                      runner: windows-latest
                      target: bun-windows-x64
                      binary: dist/ek.exe

        steps:
            - uses: actions/checkout@v6

            - uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3
              with:
                  bun-version: "1.3.10"

            - uses: actions/cache@v4
              if: runner.os != 'Windows'
              with:
                  path: ~/.bun/install/cache
                  key: bun-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('bun.lock') }}
                  restore-keys: bun-${{ runner.os }}-${{ runner.arch }}-

            - run: bun install --frozen-lockfile

            - name: Compile binary
              run: bun build src/cli.ts --compile --target=${{ matrix.target }} --outfile=${{ matrix.binary }}