Reference Workflows

# .github/workflows/ci.yaml
name: CI

on:
  pull_request:
  push:
    branches: [main]

# No permissions by default. Each job asks only for what it needs.
permissions: {}

jobs:
  build-and-test:
    name: Build and test
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      # ... your build, lint and unprotected tests here ...

  prepare-scan-input:
    name: Prepare Lifecycle scan input
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # --- Ecosystem-specific: replace this block with your guide's steps ---
      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
      - name: Prepare scan input
        run: |
          mkdir scan-input
          go list -f '{{define "M"}}{{.Path}} {{.Version}}{{end}}{{with .Module}}
          {{if not .Main}}{{if .Replace}}{{template "M" .Replace}}
          {{else}}{{template "M" .}}{{end}}{{end}}{{end}}' -compiled -deps ./... | sort -u > scan-input/go.list
          cp go.mod scan-input/
      # --- End ecosystem-specific ---

      - name: Upload scan input
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: lifecycle-scan-input
          path: scan-input/
          if-no-files-found: error
          retention-days: 3

# .github/workflows/lifecycle-evaluate.yaml
name: Lifecycle Evaluate

on:
  workflow_run:
    workflows: [CI]
    types: [completed]

permissions: {}

jobs:
  evaluate:
    name: Evaluate scan input
    # Only for pull requests, and only when Tier 1 succeeded. Trusted refs are
    # handled by lifecycle-release.yaml instead.
    if: >-
      github.event.workflow_run.event == 'pull_request' &&
      github.event.workflow_run.conclusion == 'success'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      actions: read # download the artifact from another run
      checks: write # report the result on the pull request
    env:
      # Limits on the downloaded data. Override with repository variables.
      MAX_BYTES: ${{ vars.LIFECYCLE_SCAN_MAX_BYTES || 536870912 }}
      MAX_FILES: ${{ vars.LIFECYCLE_SCAN_MAX_FILES || 50000 }}
    steps:
      - name: Download scan input (as data)
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: lifecycle-scan-input
          path: scan-input
          run-id: ${{ github.event.workflow_run.id }}
          github-token: ${{ github.token }}

      - name: Validate scan input
        run: |
          set -euo pipefail
          bytes=$(du -sb scan-input | cut -f1)
          files=$(find scan-input -type f | wc -l)
          if [ "$bytes" -gt "$MAX_BYTES" ]; then
            echo "::error::Scan input is $bytes bytes; the limit is $MAX_BYTES"
            exit 1
          fi
          if [ "$files" -gt "$MAX_FILES" ]; then
            echo "::error::Scan input has $files files; the limit is $MAX_FILES"
            exit 1
          fi
          if [ -n "$(find scan-input ! -type f ! -type d -print -quit)" ]; then
            echo "::error::Scan input contains something other than regular files and directories"
            exit 1
          fi

      - name: Sonatype Lifecycle Evaluation
        id: evaluate
        # Do not fail here, so that the result is always reported below.
        continue-on-error: true
        uses: sonatype/actions/evaluate@b1c823a70e98d3c67478cd72c0128712623455b9 # v1.14.1
        with:
          iq-server-url: ${{ vars.SONATYPE_PLATFORM_URL }}
          username: ${{ secrets.SONATYPE_LIFECYCLE_USERNAME }}
          password: ${{ secrets.SONATYPE_LIFECYCLE_PASSWORD }}
          # Chosen here, from trusted values. Never read from the artifact.
          application-id: ${{ github.event.repository.name }}
          scan-targets: ${{ vars.LIFECYCLE_SCAN_TARGETS || 'scan-input' }}
          stage: develop # Pull Requests use the develop stage, see the standard

      - name: Report result on the pull request
        if: ${{ !cancelled() }}
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
          EVALUATE_OUTCOME: ${{ steps.evaluate.outcome }}
          REPORT_URL: ${{ steps.evaluate.outputs.report-url }}
        with:
          script: |
            const outcome = process.env.EVALUATE_OUTCOME;
            const passed = outcome === 'success';
            const summaries = {
              success: 'The evaluation passed.',
              skipped: 'The scan input was missing or was rejected by validation, so nothing was evaluated.',
            };
            await github.rest.checks.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
              name: 'Sonatype Lifecycle (pull request, advisory)',
              head_sha: process.env.HEAD_SHA,
              status: 'completed',
              conclusion: passed ? 'success' : 'failure',
              details_url: process.env.REPORT_URL || undefined,
              output: {
                title: passed ? 'Passed' : 'Needs attention',
                summary: summaries[outcome] ??
                  'The evaluation reported policy violations or did not complete. Open the report for details.',
              },
            });

# .github/workflows/lifecycle-release.yaml
name: Lifecycle Release Evaluation

on:
  push:
    branches: [main]
    tags: ['v*'] # adjust to your release convention

permissions: {}

jobs:
  evaluate:
    name: Evaluate (build on main, release on a tag)
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # ... build the project here if your ecosystem is scanned from build output ...

      - name: Sonatype Lifecycle Evaluation
        uses: sonatype/actions/evaluate@b1c823a70e98d3c67478cd72c0128712623455b9 # v1.14.1
        with:
          iq-server-url: ${{ vars.SONATYPE_PLATFORM_URL }}
          username: ${{ secrets.SONATYPE_LIFECYCLE_USERNAME }}
          password: ${{ secrets.SONATYPE_LIFECYCLE_PASSWORD }}
          application-id: ${{ github.event.repository.name }}
          scan-targets: '.' # or the build output, per the ecosystem guide
          # Tags are releases; a push to main is CI. See "Which Lifecycle stage to use".
          stage: ${{ startsWith(github.ref, 'refs/tags/') && 'release' || 'build' }}