Merge pull request #30 from DahuK/sec-enhance

Add dependbot and security enhancement

.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: /
+    open-pull-requests-limit: 10
+    schedule:
+      interval: weekly
+  - package-ecosystem: github-actions
+    directory: /
+    open-pull-requests-limit: 5
+    schedule:
+      interval: weekly
+  - package-ecosystem: docker
+    directory: /
+    open-pull-requests-limit: 5
+    schedule:
+      interval: weekly

.github/workflows/test.yml

@@ -0,0 +1,51 @@
+name: Test
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  golangci:
+    name: lint
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+    - name: Set up Go
+      uses: actions/setup-go@v4
+      with:
+        go-version: 1.19
+        check-latest: true
+        cache: true
+    - name: golangci-lint
+      uses: golangci/[email protected]
+      with:
+        version: latest
+        skip-pkg-cache: true
+        args: --verbose
+  go-security-scan:
+    runs-on: ubuntu-latest
+    env:
+      GO111MODULE: on
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Run Gosec Security Scanner
+        uses: securego/gosec@master
+        with:
+          args: '-no-fail -exclude-dir=pkg/apis -exclude-dir=ack-secret-manager-cli ./...'
+
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+
+    - name: Set up Go
+      uses: actions/setup-go@v4
+      with:
+        go-version: 1.19
+      env:
+        GOPATH: ${{ env.HOME }}
+
+    - name: Build
+      run: make build