feat: Add GitHub Actions CI/CD workflow

.github/workflows/build-binaries.yml

@@ -0,0 +1,106 @@
+name: Build Binaries
+
+on:
+  workflow_run:
+    workflows: ["build"]
+    types: [completed]
+    branches: [main, develop]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  actions: read
+  checks: read
+
+env:
+  GO_VERSION: "1.25.1"
+
+jobs:
+  build-binaries:
+    name: Build Multi-Platform Binaries
+    runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'workflow_dispatch' || (github.event.workflow_run.conclusion == 'success' && (github.event.workflow_run.event == 'push' || github.event.workflow_run.event == 'workflow_dispatch')) }}
+    strategy:
+      matrix:
+        include:
+          - os: linux
+            arch: amd64
+            output: github-repo-linux-amd64
+          - os: linux
+            arch: arm64
+            output: github-repo-linux-arm64
+          - os: darwin
+            arch: amd64
+            output: github-repo-darwin-amd64
+          - os: darwin
+            arch: arm64
+            output: github-repo-darwin-arm64
+          - os: windows
+            arch: amd64
+            output: github-repo-windows-amd64.exe
+    steps:
+      - name: Validate workflow_run security
+        if: github.event_name == 'workflow_run'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const workflowRun = context.payload.workflow_run;
+
+            // Validate workflow_run is from the same repository (not a fork)
+            if (!workflowRun || workflowRun.repository.full_name !== context.repo.owner + '/' + context.repo.repo) {
+              core.setFailed('Security: workflow_run must be from the same repository');
+              return;
+            }
+
+            // Validate head SHA format
+            const headSha = workflowRun.head_sha;
+            if (!headSha || !/^[a-f0-9]{40}$/i.test(headSha)) {
+              core.setFailed('Invalid head SHA format');
+              return;
+            }
+
+            // Validate branch is allowed
+            const allowedBranches = ['main', 'develop'];
+            if (!allowedBranches.includes(workflowRun.head_branch)) {
+              core.setFailed(`Security: workflow_run from branch '${workflowRun.head_branch}' is not allowed. Allowed branches: ${allowedBranches.join(', ')}`);
+              return;
+            }
+
+            // Check if lint workflow passed
+            const { data: runs } = await github.rest.actions.listWorkflowRuns({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                workflow_id: 'lint.yaml',
+                head_sha: headSha,
+                per_page: 1
+            });
+            if (runs.workflow_runs.length > 0 && runs.workflow_runs[0].conclusion !== 'success') {
+                core.setFailed('Lint workflow did not pass');
+            }
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      - name: Build binary for ${{ matrix.os }}/${{ matrix.arch }}
+        env:
+          GOOS: ${{ matrix.os }}
+          GOARCH: ${{ matrix.arch }}
+          CGO_ENABLED: 0
+          VERSION: ${{ github.event_name == 'workflow_dispatch' && github.ref_name || github.event.workflow_run.head_branch || 'unknown' }}
+          COMMIT_HASH: ${{ github.event_name == 'workflow_dispatch' && github.sha || github.event.workflow_run.head_sha || github.sha }}
+          OUTPUT_NAME: ${{ matrix.output }}
+        run: |
+          go build -ldflags="-s -w -X 'main.Version=${VERSION}' -X 'main.GitCommitHash=${COMMIT_HASH}' -X 'main.BuiltAt=$(date -u +%Y-%m-%dT%H:%M:%SZ)'" -o "${OUTPUT_NAME}"
+
+      - name: Upload binary artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.output }}
+          path: ${{ matrix.output }}
+          retention-days: 30

.github/workflows/docker-push.yml

@@ -0,0 +1,139 @@
+name: Docker Build and Push
+
+on:
+  workflow_run:
+    workflows: ["build"]
+    types: [completed]
+    branches: [main, develop]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+  id-token: write
+  attestations: write
+  actions: read
+  checks: read
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  docker-build-push:
+    name: Build and Push Docker Image
+    runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'workflow_dispatch' || (github.event.workflow_run.conclusion == 'success' && (github.event.workflow_run.head_branch == 'main' || github.event.workflow_run.head_branch == 'develop')) }}
+    steps:
+      - name: Validate workflow_run security
+        if: github.event_name == 'workflow_run'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const workflowRun = context.payload.workflow_run;
+
+            // Validate workflow_run is from the same repository (not a fork)
+            if (!workflowRun || workflowRun.repository.full_name !== context.repo.owner + '/' + context.repo.repo) {
+              core.setFailed('Security: workflow_run must be from the same repository');
+              return;
+            }
+
+            // Validate head SHA format
+            const headSha = workflowRun.head_sha;
+            if (!headSha || !/^[a-f0-9]{40}$/i.test(headSha)) {
+              core.setFailed('Invalid head SHA format');
+              return;
+            }
+
+            // Validate branch is allowed
+            const allowedBranches = ['main', 'develop'];
+            if (!allowedBranches.includes(workflowRun.head_branch)) {
+              core.setFailed(`Security: workflow_run from branch '${workflowRun.head_branch}' is not allowed. Allowed branches: ${allowedBranches.join(', ')}`);
+              return;
+            }
+
+            // Check if lint workflow passed
+            const { data: runs } = await github.rest.actions.listWorkflowRuns({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              workflow_id: 'lint.yaml',
+              head_sha: headSha,
+              per_page: 1
+            });
+            if (runs.workflow_runs.length > 0 && runs.workflow_runs[0].conclusion !== 'success') {
+              core.setFailed('Lint workflow did not pass');
+            }
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+          ref: ${{ github.event_name == 'workflow_dispatch' && github.sha || github.event.workflow_run.head_sha }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Prepare Docker Hub image name
+        id: dockerhub
+        run: |
+          if [ -n "${{ secrets.DOCKERHUB_TOKEN }}" ] && [ -n "${{ secrets.DOCKERHUB_USERNAME }}" ]; then
+            echo "image=${{ secrets.DOCKERHUB_USERNAME }}/pvtr-github-repo" >> $GITHUB_OUTPUT
+            echo "has_credentials=true" >> $GITHUB_OUTPUT
+          else
+            echo "has_credentials=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        if: steps.dockerhub.outputs.has_credentials == 'true'
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Prepare images list for metadata
+        id: prepare-images
+        run: |
+          echo "images<<EOF" >> $GITHUB_OUTPUT
+          echo "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}" >> $GITHUB_OUTPUT
+          if [ "${{ steps.dockerhub.outputs.has_credentials }}" = "true" ]; then
+            echo "${{ steps.dockerhub.outputs.image }}" >> $GITHUB_OUTPUT
+          fi
+          echo "EOF" >> $GITHUB_OUTPUT
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ steps.prepare-images.outputs.images }}
+          tags: |
+            type=raw,value=latest,enable=${{ github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main' || github.event.workflow_run.head_branch == 'main' }}
+            type=ref,event=branch
+            type=sha,prefix=${{ github.event_name == 'workflow_dispatch' && github.ref_name || github.event.workflow_run.head_branch }}-
+
+      - name: Build and push Docker image
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          provenance: true
+          sbom: true
+
+      - name: Attest Build Provenance
+        uses: actions/attest-build-provenance@v2
+        if: ${{ github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main' || github.event.workflow_run.head_branch == 'main' }}
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          subject-digest: ${{ steps.build.outputs.digest }}
+          push-to-registry: true

.github/workflows/integration-test.yml

@@ -0,0 +1,93 @@
+name: Integration Test
+
+on:
+    workflow_run:
+        workflows: ["Docker Build and Push"]
+        types: [completed]
+        branches: [main]
+    workflow_dispatch:
+
+permissions:
+    contents: read
+    packages: read
+
+env:
+    REGISTRY: ghcr.io
+    IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+    integration-test:
+        name: Integration Test
+        runs-on: ubuntu-latest
+        if: ${{ github.event_name == 'workflow_dispatch' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'main') }}
+        steps:
+            - name: Validate workflow_run security
+              if: github.event_name == 'workflow_run'
+              uses: actions/github-script@v7
+              with:
+                  script: |
+                      const workflowRun = context.payload.workflow_run;
+
+                      // Validate workflow_run is from the same repository (not a fork)
+                      if (!workflowRun || workflowRun.repository.full_name !== context.repo.owner + '/' + context.repo.repo) {
+                        core.setFailed('Security: workflow_run must be from the same repository');
+                        return;
+                      }
+
+                      // Validate head SHA format
+                      const headSha = workflowRun.head_sha;
+                      if (!headSha || !/^[a-f0-9]{40}$/i.test(headSha)) {
+                        core.setFailed('Invalid head SHA format');
+                        return;
+                      }
+
+                      // Validate branch is allowed
+                      const allowedBranches = ['main'];
+                      if (!allowedBranches.includes(workflowRun.head_branch)) {
+                        core.setFailed(`Security: workflow_run from branch '${workflowRun.head_branch}' is not allowed. Allowed branches: ${allowedBranches.join(', ')}`);
+                        return;
+                      }
+            - name: Checkout code
+              uses: actions/checkout@v5
+              with:
+                  persist-credentials: false
+                  ref: ${{ github.event_name == 'workflow_dispatch' && github.sha || github.event.workflow_run.head_sha }}
+
+            - name: Create test config
+              env:
+                  REPO_OWNER: ${{ github.repository_owner }}
+                  REPO_NAME: ${{ github.event.repository.name }}
+              run: |
+                  cat > test-config.yml << EOF
+                  loglevel: info
+                  write-directory: evaluation_results
+                  write: true
+                  output: yaml
+                  services:
+                    self-test:
+                      plugin: github-repo
+                      policy:
+                        catalogs:
+                          - OSPS_B
+                        applicability:
+                          - Maturity Level 1
+                      vars:
+                        owner: ${REPO_OWNER}
+                        repo: ${REPO_NAME}
+                        token: \${{ secrets.GITHUB_TOKEN }}
+                  EOF
+
+            - name: Run self-assessment using Docker image
+              run: |
+                  docker run --rm \
+                    -v $(pwd)/test-config.yml:/.privateer/config.yml \
+                    -v $(pwd)/evaluation_results:/evaluation_results \
+                    ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+
+            - name: Upload evaluation results
+              uses: actions/upload-artifact@v4
+              if: always()
+              with:
+                  name: evaluation-results
+                  path: evaluation_results/
+                  retention-days: 30