trufflehog/.github/workflows/test.yml

name: Test

on:
  push:
    tags:
      - v*
    branches:
      - main
  pull_request:

jobs:
  test:
    if: ${{ github.repository == 'trufflesecurity/trufflehog' && !github.event.pull_request.head.repo.fork }}
    runs-on: ubuntu-latest
    permissions:
      actions: "read"
      contents: "read"
      id-token: "write"
    steps:
      - name: Checkout code
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
      - name: Install Go
        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
        with:
          go-version: "1.27"
      - id: "auth"
        uses: "google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093" # v3
        with:
          workload_identity_provider: "projects/811013774421/locations/global/workloadIdentityPools/github-pool/providers/github-provider"
          service_account: "[email protected]"
      - name: Set up gotestsum
        run: |
          go install gotest.tools/gotestsum@latest
          mkdir -p tmp/test-results
      - name: Test
        run: |
          CGO_ENABLED=1 gotestsum --junitfile tmp/test-results/test.xml --raw-command -- go test -json -tags=sources $(go list ./... | grep -v /vendor/ | grep -v pkg/analyzer/analyzers)
        if: ${{ success() || failure() }} # always run this step, even if there were previous errors
      - name: Upload test results to BuildPulse for flaky test detection
        if: ${{ !cancelled() }} # Run this step even when the tests fail. Skip if the workflow is cancelled.
        uses: buildpulse/buildpulse-action@0b048a4942e59de0796568d1035946e283be6b3a # main
        with:
          account: 79229934
          repository: 77726177
          path: |
            tmp/test-results/*.xml
          key: ${{ secrets.BUILDPULSE_ACCESS_KEY_ID }}
          secret: ${{ secrets.BUILDPULSE_SECRET_ACCESS_KEY }}
          tags: integration
      - name: Annotate test results
        uses: mikepenz/action-junit-report@a9170d5795813c01ab4901ffb045b52bab4ab09d # v6
        if: success() || failure() # always run even if the previous step fails
        with:
          report_paths: "tmp/test-results/*.xml"
  test-community:
    if: ${{ github.event.pull_request.head.repo.fork }}
    runs-on: ubuntu-latest
    permissions:
      actions: "read"
      contents: "read"
    steps:
      - name: Checkout code
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
      - name: Install Go
        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
        with:
          go-version: "1.27"
      - name: Test
        run: make test-community