igodwin
315027ab0d
- .gitea/workflows/ci.yml: lint, race tests (e2e excluded), and govulncheck on push to main and PRs; shared composite action installs protoc + pinned protoc-gen-go/protoc-gen-go-grpc and generates the (gitignored) protobuf code before each Go job. - .golangci.yml (v2 schema): govet, staticcheck, errcheck, ineffassign, unused, misspell, gosec, revive; generated api/grpc/pb excluded. - Makefile: vuln target (govulncheck) added and chained into qa. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
114 lines
3.9 KiB
YAML
114 lines
3.9 KiB
YAML
name: CI
|
|
|
|
# Gitea Actions reads workflows from .gitea/workflows/ and executes them with
|
|
# a GitHub-Actions-compatible engine (act_runner). Standard actions/* steps
|
|
# work as long as the runner can resolve github.com (either directly or via a
|
|
# configured actions mirror on the Gitea instance) - see notes at the bottom
|
|
# of this file for offline/mirrored setups.
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
pull_request:
|
|
|
|
# Cancel superseded runs for the same ref to save runner capacity.
|
|
# Gitea Actions accepts both the `gitea.*` and `github.*` context aliases;
|
|
# `github.*` is used here since it's the more portable spelling.
|
|
concurrency:
|
|
group: ci-${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
lint:
|
|
name: Lint
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: true
|
|
|
|
# api/grpc/pb/ is gitignored and generated at build time (see
|
|
# .gitignore and the Dockerfile), so anything that compiles this
|
|
# module - including the linter, which type-checks packages - needs
|
|
# the generated code in place first.
|
|
- name: Generate protobuf code
|
|
uses: ./.gitea/actions/generate-proto
|
|
|
|
# Installing the pinned binary via the official install script is more
|
|
# portable across Gitea Actions runner images than golangci-lint-action,
|
|
# which assumes a GitHub-hosted runner environment (it works, but the
|
|
# install script approach has fewer surprises on self-hosted runners
|
|
# and lets us pin an exact version without depending on the action's
|
|
# own release cadence).
|
|
- name: Install golangci-lint
|
|
run: |
|
|
curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | \
|
|
sh -s -- -b "$(go env GOPATH)/bin" v2.12.2
|
|
echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
|
|
|
|
- name: Run golangci-lint
|
|
run: golangci-lint run ./...
|
|
|
|
test:
|
|
name: Test
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: true
|
|
|
|
# api/grpc/pb/ is gitignored and generated at build time; without this
|
|
# the module won't compile (pkg/client, internal/service, etc. import
|
|
# the generated package).
|
|
- name: Generate protobuf code
|
|
uses: ./.gitea/actions/generate-proto
|
|
|
|
# tests/e2e uses testcontainers-go and requires a Docker daemon that
|
|
# isn't guaranteed to be available/usable on Gitea Actions runners, so
|
|
# it is excluded from CI here via `go list ... | grep -v`. Run it
|
|
# locally (or on a runner with Docker-in-Docker configured) with:
|
|
# go test -race ./tests/e2e/...
|
|
- name: Run tests (excluding e2e)
|
|
run: |
|
|
go test -race -covermode=atomic -coverprofile=coverage.out \
|
|
$(go list ./... | grep -v '/tests/e2e')
|
|
# coverage.out is left in the workspace for inspection; artifact
|
|
# upload is intentionally omitted since actions/upload-artifact
|
|
# support varies by Gitea version/configuration - add it back once
|
|
# your instance's artifact storage is confirmed working.
|
|
|
|
vuln:
|
|
name: Vulnerability scan
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: true
|
|
|
|
# govulncheck also loads and type-checks the module's packages, so the
|
|
# generated protobuf code has to exist first.
|
|
- name: Generate protobuf code
|
|
uses: ./.gitea/actions/generate-proto
|
|
|
|
- name: Install govulncheck
|
|
run: go install golang.org/x/vuln/cmd/govulncheck@latest
|
|
|
|
- name: Run govulncheck
|
|
run: govulncheck ./...
|