fix(ci): ignore unwanted artifacts in releases

.craft

@@ -1,9 +1,12 @@
+ci:
+  name: github
+  options:
+    - codecov
+    - dependabot
+docker:
+  registry: ghcr.io
 license: mit
-ci: github
 maintainers:
-    - url: https://kilianpaquier.com
-      name: kilianpaquier
-codecov: true
-dependabot: true
-no_api: true
+  - url: https://kilianpaquier.com
+    name: kilianpaquier
 no_chart: true

.github/workflows/integration.yml

@@ -1,60 +1,21 @@
 # Code generated by craft; DO NOT EDIT.
 
-name: Go Integration
-run-name: Go Integration
+name: Integration
+run-name: Integration
 
 on:
-  - push
-  - workflow_dispatch
+  pull_request:
+  push:
+    branches:
+      - main
+      - staging
+      - develop
+      - v[0-9]+
+      - v[0-9]+.[0-9]+
+  workflow_dispatch:
 
 jobs:
 
-  version:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    outputs:
-      version: v${{ steps.semantic_release.outputs.new_release_version }}
-      release: ${{ steps.release.outputs.release }}
-    steps:
-      - uses: actions/checkout@v4
-      - id: sha
-        run: echo "sha=$(echo "${{ github.ref_name }}" | sha256sum | cut -c -8)" >> $GITHUB_OUTPUT
-      - id: semantic_release
-        uses: cycjimmy/semantic-release-action@v4
-        with:
-          extra_plugins: |
-            @semantic-release/changelog
-            @semantic-release/commit-analyzer
-            @semantic-release/exec
-            @semantic-release/git
-            @semantic-release/github
-            @semantic-release/release-notes-generator
-            conventional-changelog-conventionalcommits
-            semantic-release-license
-          ci: false
-          dry_run: true
-          tag_format: v${version}
-          branches: |
-            [
-              "(master|main)",
-              "v+([0-9])?(.{+([0-9]),x}).x",
-              { "name": "next", "prerelease": true },
-              { "name": "beta", "prerelease": true },
-              { "name": "alpha", "prerelease": true },
-              { "name": "staging", "prerelease": "beta" },
-              { "name": "develop", "prerelease": "alpha" },
-              { "name": "${{ github.ref_name }}", "prerelease": "${{ steps.sha.outputs.sha }}" }
-            ]
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - run: echo v${{ steps.semantic_release.outputs.new_release_version }}
-      - id: release
-        run: |
-          if [[ ${{ steps.semantic_release.outputs.new_release_version }} =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "release=true" >> $GITHUB_OUTPUT
-          fi
-
   go-lint:
     runs-on: ubuntu-latest
     steps:
@@ -98,4 +59,25 @@ jobs:
           fail_ci_if_error: true
           file: coverage.out
           slug: ${{ github.repository }}
-          token: ${{ secrets.CODECOV_TOKEN }}
+          token: ${{ secrets.CODECOV_TOKEN }}
+
+  docker-hadolint:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+      security-events: write
+    steps:
+      - uses: actions/checkout@v3
+      - uses: hadolint/[email protected]
+        continue-on-error: true # enforce scan upload to codeql
+        with:
+          format: sarif
+          output-file: hadolint-results.sarif
+      - uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: hadolint-results.sarif
+          category: docker-hadolint
+      - id: hadolint
+        uses: hadolint/[email protected]
+        with:
+          format: tty

.github/workflows/release.yml

@@ -5,6 +5,11 @@ run-name: Release
 
 on:
   workflow_dispatch:
+    inputs:
+      dry_run:
+        description: Dry run
+        type: boolean
+        default: false
 
 jobs:
 
@@ -72,30 +77,24 @@ jobs:
       - uses: actions/upload-artifact@v4
         with:
           name: executables
+          # order is important to filter unwanted globs after the filter or desired globs
           path: |
+            dist/*
             !dist/*.json
             !dist/*.yaml
             !dist/*/
-            checksums.txt
-            dist/*
           retention-days: 1
 
   docker-build:
     runs-on: ubuntu-latest
-    environment: release
-    permissions:
-      packages: write
     needs:
       - version
-    env:
-      REGISTRY: ghcr.io
-      IMAGE_NAME: ${{ github.repository }}
     steps:
       - uses: actions/checkout@v4
       - id: meta
         uses: docker/metadata-action@v5
         with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          images: ghcr.io/${{ github.repository }}
           labels: |
             org.opencontainers.image.created={{date 'YYYY-MM-DDTHH:mm:ssZ'}}
             org.opencontainers.image.ref.name="${{ github.ref_name }}"
@@ -109,25 +108,51 @@ jobs:
       - uses: docker/setup-buildx-action@v3
       - uses: docker/login-action@v3
         with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
       - uses: docker/build-push-action@v5
         with:
           context: .
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
 
+  docker-trivy:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    needs:
+      - version
+      - docker-build
+    steps:
+      - uses: actions/checkout@v4
+      - uses: aquasecurity/trivy-action@master
+        continue-on-error: true # enforce scan upload to codeql
+        with:
+          image-ref: "ghcr.io/${{ github.repository }}:${{ needs.version.outputs.version }}"
+          exit-code: "1"
+          format: sarif
+          output: trivy-results.sarif
+          ignore-unfixed: false
+          severity: MEDIUM,HIGH,CRITICAL
+        env:
+          TRIVY_USERNAME: ${{ github.repository_owner }}
+          TRIVY_PASSWORD: ${{ secrets.REGISTRY_TOKEN }}
+      - uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: trivy-results.sarif
+          category: docker-trivy
+
   release:
     runs-on: ubuntu-latest
-    environment: release
     if: github.ref_protected == true
     permissions:
       contents: write
       issues: write
     needs:
       - go-build
+      - docker-build
     env:
       GIT_AUTHOR_NAME: ${{ github.triggering_actor }}
       GIT_AUTHOR_EMAIL: ${{ github.triggering_actor }}@users.noreply.github.com
@@ -152,6 +177,7 @@ jobs:
             @semantic-release/release-notes-generator
             conventional-changelog-conventionalcommits
             semantic-release-license
+          dry_run: ${{ inputs.dry_run }}
           tag_format: v${version}
           branches: |
             [

.golangci.yml

@@ -185,7 +185,7 @@ linters-settings:
       - name: imports-blacklist
       - name: import-shadowing
       - name: max-public-structs
-        arguments: [6]
+        arguments: [8]
       - name: modifies-parameter
       - name: modifies-value-receiver
       - name: nested-structs

Dockerfile

@@ -3,7 +3,7 @@
 #############################
 #        STAGE BUILD        #
 #############################
-FROM golang:latest AS build
+FROM golang:1.22 AS build
 
 WORKDIR /app
 

codecov.yml

@@ -1,5 +1,29 @@
 # Code generated by craft; DO NOT EDIT.
 
+codecov:
+  require_ci_to_pass: true
+  notify:
+    wait_for_ci: true
+
+comment:
+  require_changes: true
+
+coverage:
+  status:
+    project:
+      default:
+        target: 85%
+        threshold: 10%
+        if_not_found: failure
+        informational: false
+        only_pulls: false
+    patch:
+      target: 85%
+      threshold: 10%
+      if_not_found: failure
+      informational: false
+      only_pulls: false
+
 ignore:
   - "cmd"
   - "examples"

go.mod

@@ -1,6 +1,6 @@
 module github.com/kilianpaquier/gitlab-storage-cleaner
 
-go 1.22.0
+go 1.22
 
 require (
 	github.com/ezian/pipe v0.1.0