Security hardening 2026 07 #18

	name: CI

	on:
	push:
	branches: [main]
	tags: ["v*"]
	pull_request:

	jobs:
	build:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-go@v5
	with:
	go-version: "1.23"
	cache: true
	- run: go vet ./...
	- run: go build ./...

	test:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-go@v5
	with:
	go-version: "1.23"
	cache: true
	- name: Install setup-envtest
	run: go install sigs.k8s.io/controller-runtime/tools/setup-envtest@release-0.19
	- name: Run controller tests (envtest)
	run: \|
	export KUBEBUILDER_ASSETS=$(setup-envtest use 1.30 -p path)
	go test ./... -count=1 -timeout=120s

	publish:
	# Build and push the image to ghcr.io only on version tags (v*),
	# after build and tests pass. Tags with the version (v stripped).
	needs: [build, test]
	if: startsWith(github.ref, 'refs/tags/v')
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- name: Log in to GitHub Container Registry
	run: echo "${{ secrets.GHCR_PAT }}" \| docker login ghcr.io -u ${{ github.actor }} --password-stdin
	- name: Build and push image
	run: \|
	IMAGE=ghcr.io/${{ github.repository }}
	VERSION=${GITHUB_REF_NAME#v}
	docker build -t "$IMAGE:$VERSION" .
	docker push "$IMAGE:$VERSION"

Navigation Menu