actions: Adds TICS nightly job (#80)

Co-authored-by: Maciej Golaszewski <[email protected]>

.github/workflows/cron-jobs.yaml

@@ -0,0 +1,58 @@
+name: Security and quality nightly scan
+
+on:
+  schedule:
+    # At 00:00 every day
+    - cron: '0 0 * * *'
+
+permissions:
+  contents: read
+
+jobs:
+  TICS:
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - name: Checking out repo
+        uses: actions/checkout@v4
+
+      - name: Install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.22"
+
+      - name: go mod download
+        run: |
+          go mod download
+
+      - name: TICS scan
+        run: |
+          export TICSAUTHTOKEN=${{ secrets.TICSAUTHTOKEN }}
+
+          set -x
+
+          # TICS requires us to have the test results in cobertura xml format under the
+          # directory use below
+          sudo make test-unit
+          go install github.com/boumenot/gocover-cobertura@latest
+          gocover-cobertura < cover_all.out > coverage.xml
+          mkdir .coverage
+          mv ./coverage.xml ./.coverage/
+
+          # Install the TICS and staticcheck
+          go install honnef.co/go/tools/cmd/[email protected]
+          . <(curl --silent --show-error 'https://canonical.tiobe.com/tiobeweb/TICS/api/public/v1/fapi/installtics/Script?cfg=default&platform=linux&url=https://canonical.tiobe.com/tiobeweb/TICS/')
+
+          # We need to have our project built
+          # We load the dqlite libs here instead of doing through make because TICS
+          # will try to build parts of the project itself
+          go build -a ./...
+
+          TICSQServer -project  ${{ github.event.repository.name }} -tmpdir /tmp/tics -branchdir $HOME/work/cluster-api-k8s/cluster-api-k8s/

Makefile

@@ -185,16 +185,21 @@ go-vet:
 go-fmt:
 	go fmt ./...
 
-test-unit: test-common test-bootstrap test-controlplane
+test-unit: clear-cover_all test-common test-bootstrap test-controlplane
+
+clear-cover_all:
+	rm -f cover_all.out
 
 test-common:
 	go test $(shell pwd)/pkg/... -coverprofile cover.out
+	cat cover.out >> cover_all.out
 
 all-bootstrap: manager-bootstrap
 
 # Run tests
 test-bootstrap: envtest generate-bootstrap generate-bootstrap-conversions manifests-bootstrap
 	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(TOOLS_BIN_DIR) -p path)" go test $(shell pwd)/bootstrap/... -coverprofile cover.out
+	cat cover.out >>  cover_all.out
 
 # Build manager binary
 manager-bootstrap: generate-bootstrap
@@ -265,6 +270,7 @@ all-controlplane: manager-controlplane
 # Run tests
 test-controlplane: envtest generate-controlplane generate-controlplane-conversions manifests-controlplane
 	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(TOOLS_BIN_DIR) -p path)" go test $(shell pwd)/controlplane/... -coverprofile cover.out
+	cat cover.out >>  cover_all.out
 
 .PHONY: docker-build-e2e
 docker-build-e2e: ## Run docker-build-* targets for all the images with settings to be used for the e2e tests