syft/.github/workflows/validations.yaml

name: "Validations"

# we should cancel any in-progress runs for the same workflow + PR/ref
# so that we can avoid redundant work / save on CI minutes
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

on:
  workflow_dispatch:
  pull_request:
  push:
    branches:
      - main

permissions: {}

jobs:
  Static-Analysis:
    # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
    name: "Static analysis"
    # runs-on.com: memory & general purpose instances for testing
    #   spot enabled: ok to interrupt non-production workloads
    #   tmpfs intentionally omitted -- it RAM-backs /home/runner, /tmp and /var/lib/docker at
    #   100% of instance memory, starving `make unit` of headroom to link with -race.
    #   volume: the caches and docker images tmpfs used to hold. gp3 baseline throughput is
    #   enough; a 4 vCPU instance can't pull much more than that anyway.
    #   note: s3-cache intentionally omitted -- PR runs are untrusted and must not write to the
    #   shared cache backend that the trusted release workflow reads from (cache poisoning).
    runs-on: &test-runner "runs-on=${{ github.run_id }}/cpu=4+8/ram=16+32/family=m6+m7+m8+c6+c7+c8/spot=price-capacity-optimized/volume=100gb"
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          persist-credentials: false

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap
        with:
          # the self-consistency tests for the output of the capabilities code generation depends on unit test
          # output from  ./syft/pkg/... packages. Therefore we need to download the test fixture cache here
          # so that running the few unit tests as part of static analysis works correctly.
          download-test-fixture-cache: true

      - name: Run static analysis
        run: make static-analysis

  Unit-Test:
    # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
    name: "Unit tests"
    runs-on: ubuntu-latest
    needs: [Unit-Test-Linux, Unit-Test-Windows]
    # a skipped job satisfies a required check, so this job must always run and fail explicitly
    # unless every dependency succeeded (otherwise a failing PR can still be auto-merged)
    if: ${{ always() }}
    steps:
      - name: Require all unit test jobs to succeed
        env:
          NEEDS: ${{ toJSON(needs) }}
        run: |
          echo "$NEEDS" | jq -e 'length > 0 and all(.[]; .result == "success")' > /dev/null || {
            echo "$NEEDS" | jq -r 'to_entries[] | "\(.key): \(.value.result)"'
            exit 1
          }
          echo All unit tests passed!

  Unit-Test-Linux:
    name: "Unit tests (Linux)"
    runs-on: *test-runner
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          persist-credentials: false

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap
        with:
          download-test-fixture-cache: true

      - name: Run unit tests
        run: make unit

      - name: Check for capability drift
        run: make check-capability-drift

  Unit-Test-Windows:
    name: "Unit tests (Windows)"
    runs-on: windows-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          persist-credentials: false

      # go-make's setup only (not ./.github/actions/bootstrap): binny ships no windows release, so binny tools
      # are unavailable here (`make unit` skips the fixture refresh on windows)
      - name: Setup go + go-make tooling
        uses: anchore/go-make/.github/actions/setup@fa5421b3bf24c9d18f11a736c5eb4172f2b7d683 # v0.8.1
        with:
          # keep in sync with the go-version default in ./.github/actions/bootstrap
          go-version: "1.26.2"

      # the binny-free version of `make download-test-fixture-cache` (keep the oras version in sync with .binny.yaml)
      - name: Download test fixture cache
        shell: bash
        run: |
          curl -sSfL https://github.com/oras-project/oras/releases/download/v1.3.4/oras_1.3.4_windows_amd64.zip -o "$RUNNER_TEMP/oras.zip"
          unzip -q "$RUNNER_TEMP/oras.zip" oras.exe -d "$RUNNER_TEMP"
          "$RUNNER_TEMP/oras.exe" pull ghcr.io/anchore/oss-cache/syft-test-fixture-cache:v2

      - name: Run unit tests
        run: make unit

  Integration-Test:
    # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
    name: "Integration tests"
    runs-on: *test-runner
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          persist-credentials: false

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap
        with:
          download-test-fixture-cache: true

      - name: Validate syft output against the CycloneDX schema
        run: make validate-cyclonedx-schema

      - name: Run integration tests
        run: make integration

  Build-Snapshot-Artifacts:
    name: "Build snapshot artifacts"
    # runs-on.com: compute instances for parallel builds
    #   spot disabled: reliability for build workflows (used for releases too)
    #   goreleaser uses parallelism of 12, so we need more CPUs
    #   tmpfs intentionally omitted -- a RAM-backed dist/ competes with the goreleaser
    #   build's memory peak (parallel binaries + multi-arch image assembly) and OOMs the
    #   instance; keep dist/ on disk.
    #   note: s3-cache intentionally omitted -- PR runs are untrusted and must not write to the
    #   shared cache backend that the trusted release workflow reads from (cache poisoning).
    #   volume: enlarge dist/ disk -- the default 40GB EBS root fills up during the multi-arch
    #   image + binary build and OOMs (runs out of disk); size it well above peak usage.
    #   provisioned throughput/iops above the gp3 free baseline (125mbs/3000iops) approximate
    #   the tmpfs IO speed on disk, for ~1c/run.
    runs-on: "runs-on=${{ github.run_id }}/cpu=16+32/ram=32+128/family=c5+c6+c7+c8/spot=false/volume=120gb:gp3:500mbs:4000iops"
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          persist-credentials: false

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap
        with:
          bootstrap-apt-packages: ""

      - name: Build snapshot artifacts
        run: make snapshot

      - name: Smoke test snapshot build
        run: make snapshot-smoke-test

      - name: Upload snapshot artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
        with:
          name: snapshot
          path: snapshot/
          retention-days: 30

  Acceptance-Linux:
    # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
    name: "Acceptance tests (Linux)"
    needs: [Build-Snapshot-Artifacts]
    runs-on: *test-runner
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          persist-credentials: false

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap
        with:
          download-test-fixture-cache: true

      - name: Download snapshot artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
        with:
          name: snapshot
          path: snapshot

      - name: Restore binary permissions
        run: chmod +x snapshot/*/syft snapshot/*/*.exe 2>/dev/null || true

      - name: Run comparison tests (Linux)
        run: make compare-linux

      - name: Load test image cache
        if: steps.install-test-image-cache.outputs.cache-hit == 'true'
        run: make install-test-cache-load

      - name: Run install.sh tests (Linux)
        run: make install-test

      - name: (cache-miss) Create test image cache
        if: steps.install-test-image-cache.outputs.cache-hit != 'true'
        run: make install-test-cache-save

  Acceptance-Mac:
    # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
    name: "Acceptance tests (Mac)"
    needs: [Build-Snapshot-Artifacts]
    # note: macos runners aren't supported yet for runs-on managed runners.
    runs-on: macos-latest
    permissions:
      contents: read
    steps:
      - name: Install Cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          persist-credentials: false

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap
        with:
          bootstrap-apt-packages: ""
          go-dependencies: false
          download-test-fixture-cache: true

      - name: Download snapshot artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
        with:
          name: snapshot
          path: snapshot

      - name: Restore binary permissions
        run: chmod +x snapshot/*/syft 2>/dev/null || true

      - name: Run comparison tests (Mac)
        run: make compare-mac

      - name: Run install.sh tests (Mac)
        run: make install-test-ci-mac

  Cli-Linux:
    # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
    name: "CLI tests (Linux)"
    needs: [Build-Snapshot-Artifacts]
    runs-on: *test-runner
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
        with:
          persist-credentials: false

      - name: Bootstrap environment
        uses: ./.github/actions/bootstrap
        with:
          download-test-fixture-cache: true

      - name: Download snapshot artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
        with:
          name: snapshot
          path: snapshot

      - name: Restore binary permissions
        run: chmod +x snapshot/*/syft snapshot/*/*.exe 2>/dev/null || true

      - name: Run CLI Tests (Linux)
        run: make cli