🧹 Make resolved policy execution use reporting queries #3325

Workflow file for this run

.github/workflows/pr-test-lint.yml at 07879d9

	name: Code Test

	## Only trigger tests if source is changing
	on:
	push:
	paths:
	- '**.go'
	- '**.mod'
	- '**.ct'
	- 'go.sum'
	- '.github/workflows/pr-test-lint.yml'

	jobs:
	# Check if there is any dirty change for go mod tidy
	go-mod:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@v4
	- name: Import environment variables from file
	run: cat ".github/env" >> $GITHUB_ENV
	- name: Install Go
	uses: actions/setup-go@v5
	with:
	go-version: ">=${{ env.golang-version }}"
	cache: false
	- name: Check go mod
	run: \|
	go mod tidy
	git diff --exit-code go.mod


	golangci-lint:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@v4
	- name: Import environment variables from file
	run: cat ".github/env" >> $GITHUB_ENV
	- name: Install Go
	uses: actions/setup-go@v5
	with:
	go-version: ">=${{ env.golang-version }}"
	cache: false
	- name: Run golangci-lint
	uses: golangci/[email protected]
	with:
	version: latest
	args: --timeout=30m

	go-test:
	runs-on: ubuntu-latest
	outputs:
	outcome: ${{ steps.tests.outcome }}
	steps:
	- name: Checkout code
	uses: actions/checkout@v4
	- name: Import environment variables from file
	run: cat ".github/env" >> $GITHUB_ENV

	- name: Install Go
	uses: actions/setup-go@v5
	with:
	go-version: ">=${{ env.golang-version }}"
	cache: false
	# https://github.com/actions/cache/blob/main/examples.md#go---modules
	- uses: actions/cache@v4
	with:
	path: \|
	~/.cache/go-build
	~/go/pkg/mod
	key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
	restore-keys: \|
	${{ runner.os }}-go-

	- name: Make provider dir
	run: mkdir -p ${PWD}/${GITHUB_JOB}/.providers
	- name: Set provider env
	run: echo "PROVIDERS_PATH=${PWD}/${GITHUB_JOB}/.providers" >> $GITHUB_ENV
	- name: Display Provider Path
	run: echo $PROVIDERS_PATH

	- run: make test/go/plain-ci
	id: tests
	- uses: actions/upload-artifact@v4 # upload test results
	if: success() \|\| failure() # run this step even if previous step failed
	with:
	name: test-results
	path: report.xml

	go-auto-approve-dependabot:
	runs-on: ubuntu-latest
	needs: [go-test, go-bench, golangci-lint, go-mod]
	# For now, we auto approve and merge:
	# - go dep PRs
	# - cnquery update PRs
	# because we have tests for this in place.
	# https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/evaluate-expressions-in-workflows-and-actions#startswith
	if: startsWith(github.ref, 'refs/heads/dependabot/go_modules') && github.actor == 'dependabot[bot]'
	permissions:
	contents: write
	pull-requests: write
	steps:
	# figure out the PR for this commit
	- uses: cloudposse-github-actions/[email protected]
	id: pr
	with:
	github-token: "${{ secrets.GITHUB_TOKEN }}"
	filterOutClosed: true
	filterOutDraft: true
	- name: Approve a PR
	uses: fastify/github-action-merge-dependabot@v3
	with:
	pr-number: ${{ steps.pr.outputs.number }}

	go-auto-approve-mondoo:
	runs-on: ubuntu-latest
	needs: [go-test, go-bench, golangci-lint, go-mod]
	# For now, we auto approve and merge:
	# - go dep PRs
	# - cnquery update PRs
	# because we have tests for this in place.
	# https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/evaluate-expressions-in-workflows-and-actions#startswith
	if: startsWith(github.ref, 'refs/heads/version/cnquery_update_v') && github.event.commits[0].author.username == 'mondoo-tools'
	permissions:
	contents: write
	pull-requests: write
	steps:
	- name: Checkout code
	uses: actions/checkout@v4
	# figure out the PR for this commit
	- uses: cloudposse-github-actions/[email protected]
	id: pr
	with:
	github-token: "${{ secrets.GITHUB_TOKEN }}"
	filterOutClosed: true
	filterOutDraft: true
	- name: Approve and merge a PR
	run: \|
	gh pr review ${{ steps.pr.outputs.number }} --approve
	gh pr merge ${{ steps.pr.outputs.number }} --squash --merge
	env:
	GH_TOKEN: ${{secrets.GITHUB_TOKEN}}

	event_file:
	name: "Store event file"
	runs-on: ubuntu-latest
	steps:
	- name: Upload
	uses: actions/upload-artifact@v4
	with:
	name: Event File
	path: ${{ github.event_path }}

	go-bench:
	runs-on: ubuntu-latest
	if: github.ref != 'refs/heads/main'
	steps:
	- name: Checkout code
	uses: actions/checkout@v4
	- name: Import environment variables from file
	run: cat ".github/env" >> $GITHUB_ENV
	- name: Install Go
	uses: actions/setup-go@v5
	with:
	go-version: ">=${{ env.golang-version }}"
	cache: false

	- name: Make provider dir
	run: mkdir -p ${PWD}/${GITHUB_JOB}/.providers
	- name: Set provider env
	run: echo "PROVIDERS_PATH=${PWD}/${GITHUB_JOB}/.providers" >> $GITHUB_ENV
	- name: Display Provider Path
	run: echo $PROVIDERS_PATH

	- name: Run benchmark
	run: make benchmark/go \| tee benchmark.txt

	# Remove log statements and leave just the benchmark results
	- name: Cleanup benchmark file
	run: sed -i -n '/goos:/,$p' benchmark.txt

	# Download previous benchmark result from cache (if exists)
	- name: Download previous benchmark data
	uses: actions/cache/restore@v4
	with:
	path: ./cache
	key: ${{ runner.os }}-benchmark-${{ github.run_id }}
	restore-keys: \|
	${{ runner.os }}-benchmark-
	# Run `github-action-benchmark` action
	- name: Store benchmark result
	uses: benchmark-action/github-action-benchmark@v1
	with:
	# What benchmark tool the output.txt came from
	tool: 'go'
	# Where the output from the benchmark tool is stored
	output-file-path: benchmark.txt
	# Where the previous data file is stored
	external-data-json-path: ./cache/benchmark-data.json
	github-token: ${{ secrets.GITHUB_TOKEN }}
	comment-on-alert: true
	summary-always: true
	fail-on-alert: true
	save-data-file: false
	alert-threshold: '150%'

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🧹 Make resolved policy execution use reporting queries #3325

Workflow file

🧹 Make resolved policy execution use reporting queries #3325

Jobs

Run details

Workflow file for this run