nightly.yaml

name: Nightly
on:
  workflow_dispatch: {}   # Allow for manual triggers
  schedule:
    - cron:  '0 8 * * *'  # Daily, at 8:00 UTC


jobs:
  race-detector:
    name: Go Race Detector
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@v3

      - name: Test with Race Detector
        run: CGO_ENABLED=1 make ci-go-race-detector

      - name: Slack Notification
        uses: 8398a7/action-slack@v3
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}
        if: ${{ failure() && env.SLACK_WEBHOOK_URL }}
        with:
          status: ${{ job.status }}
          fields: repo,workflow

  native-fuzzer:
    name: Go Fuzzer (native)
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@v3

      - id: go_version
        name: Read go version
        run: echo "::set-output name=go_version::$(cat .go-version)"

      - name: Install Go (${{ steps.go_version.outputs.go_version }})
        uses: actions/setup-go@v3
        with:
          go-version: ${{ steps.go_version.outputs.go_version }}

      - name: go test -fuzz
        run: go test ./ast -fuzz FuzzParseStatementsAndCompileModules -fuzztime 1h -v -run '^$'

      - name: Dump crashers
        if: ${{ failure() }}
        run: find ast/testdata/fuzz ! -name '*.stmt' ! -type d -print -exec cat {} \;

      - name: Slack Notification
        uses: 8398a7/action-slack@v3
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}
        if: ${{ failure() && env.SLACK_WEBHOOK_URL }}
        with:
          status: ${{ job.status }}
          fields: repo,workflow

  go-proxy-check:
    name: Go mod check
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@v3

      - name: Vendor without proxy
        run: make check-go-module
        timeout-minutes: 30

      - name: Slack Notification
        uses: 8398a7/action-slack@v3
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}
        if: ${{ failure() && env.SLACK_WEBHOOK_URL }}
        with:
          status: ${{ job.status }}
          fields: repo,workflow

  trivy-scan:
    name: Trivy security scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      # Equivalent to:
      # $ trivy fs .
      - name: Run Trivy scan on repo
        uses: aquasecurity/trivy-action@0.5.1
        with:
          scan-type: fs
          format: table
          exit-code: '1'
          ignore-unfixed: true
          severity: CRITICAL,HIGH

      # Equivalent to:
      # $ trivy image openpolicyagent/opa:edge
      - name: Run Trivy scan on image
        uses: aquasecurity/trivy-action@0.5.1
        with:
          image-ref: 'openpolicyagent/opa:edge'
          format: table
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: os,library
          severity: CRITICAL,HIGH