igodwin
eda033ff9b
Addresses errcheck, gosec, revive, staticcheck, and unused findings
across the codebase (unchecked error returns, unsafe file inclusion
warnings on operator/test-controlled paths, missing package comments,
unused parameters, deprecated API usage). Also fixes two suppression
comments that were silently no-ops due to wrong syntax (#nosec needs
a leading '#', nolint reasons need '//' not '--').
With the backlog clear, drop continue-on-error from the CI lint job
per the plan left in b4b4806.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
113 lines
4.0 KiB
YAML
113 lines
4.0 KiB
YAML
name: CI
|
|
|
|
# Runner-native workflow: the self-hosted act_runner's job containers have no
|
|
# Node.js, so JavaScript actions (actions/checkout, actions/setup-go, ...)
|
|
# fail with "Cannot find: node in PATH". Every step here is a plain shell
|
|
# run-step inside a golang container instead.
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
pull_request:
|
|
|
|
# Cancel superseded runs for the same ref to save runner capacity.
|
|
concurrency:
|
|
group: ci-${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
lint:
|
|
name: Lint
|
|
runs-on: docker
|
|
container:
|
|
image: golang:1.25-alpine
|
|
steps:
|
|
- name: Checkout
|
|
run: |
|
|
apk add -q --no-cache git make protobuf protobuf-dev curl
|
|
git init -q .
|
|
git remote add origin https://gitea.ivangodwin.com/${{ gitea.repository }}.git
|
|
git fetch -q --depth 1 origin ${{ gitea.sha }}
|
|
git checkout -q FETCH_HEAD
|
|
|
|
# api/grpc/pb/ is gitignored and generated at build time, so anything
|
|
# that compiles this module - including the linter, which type-checks
|
|
# packages - needs the generated code in place first.
|
|
- name: Generate protobuf code
|
|
run: |
|
|
go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.36.10
|
|
go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.5.1
|
|
export PATH="$PATH:$(go env GOPATH)/bin"
|
|
make proto-gen
|
|
|
|
# Installed via `go install` (module proxy + sumdb verification): the
|
|
# official install.sh tarball download hit checksum mismatches on this
|
|
# runner.
|
|
- name: Run golangci-lint
|
|
run: |
|
|
go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2
|
|
"$(go env GOPATH)/bin/golangci-lint" run ./...
|
|
|
|
test:
|
|
name: Test
|
|
runs-on: docker
|
|
container:
|
|
image: golang:1.25-alpine
|
|
steps:
|
|
- name: Checkout
|
|
run: |
|
|
apk add -q --no-cache git make protobuf protobuf-dev gcc musl-dev
|
|
git init -q .
|
|
git remote add origin https://gitea.ivangodwin.com/${{ gitea.repository }}.git
|
|
git fetch -q --depth 1 origin ${{ gitea.sha }}
|
|
git checkout -q FETCH_HEAD
|
|
|
|
- name: Generate protobuf code
|
|
run: |
|
|
go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.36.10
|
|
go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.5.1
|
|
export PATH="$PATH:$(go env GOPATH)/bin"
|
|
make proto-gen
|
|
|
|
# -race needs cgo, hence gcc/musl-dev above. tests/e2e uses
|
|
# testcontainers-go (needs a Docker daemon) and is excluded; run it
|
|
# locally with: go test -race ./tests/e2e/...
|
|
# coverage.out is left in the workspace; artifact upload is omitted
|
|
# until the instance's artifact storage is confirmed working.
|
|
- name: Run tests (excluding e2e)
|
|
run: |
|
|
go test -race -covermode=atomic -coverprofile=coverage.out \
|
|
$(go list ./... | grep -v '/tests/e2e')
|
|
|
|
vuln:
|
|
name: Vulnerability scan
|
|
runs-on: docker
|
|
container:
|
|
image: golang:1.25-alpine
|
|
# Advisory: govulncheck also reports Go-stdlib findings that are only
|
|
# fixable by toolchain updates; flip to blocking once triaged.
|
|
continue-on-error: true
|
|
steps:
|
|
- name: Checkout
|
|
run: |
|
|
apk add -q --no-cache git make protobuf protobuf-dev
|
|
git init -q .
|
|
git remote add origin https://gitea.ivangodwin.com/${{ gitea.repository }}.git
|
|
git fetch -q --depth 1 origin ${{ gitea.sha }}
|
|
git checkout -q FETCH_HEAD
|
|
|
|
# govulncheck also loads and type-checks the module's packages, so the
|
|
# generated protobuf code has to exist first.
|
|
- name: Generate protobuf code
|
|
run: |
|
|
go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.36.10
|
|
go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.5.1
|
|
export PATH="$PATH:$(go env GOPATH)/bin"
|
|
make proto-gen
|
|
|
|
- name: Run govulncheck
|
|
run: |
|
|
go install golang.org/x/vuln/cmd/govulncheck@latest
|
|
"$(go env GOPATH)/bin/govulncheck" ./...
|