igodwin
f38a2a689c
actions/checkout and actions/setup-go are JavaScript actions and fail on the runner's node-less job containers (Cannot find: node in PATH). All jobs now run plain shell steps in a golang:1.25-alpine container: fetch by sha, apk deps, pinned protoc plugins, then lint/test/govulncheck. The generate-proto composite action is inlined and removed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
114 lines
4.1 KiB
YAML
114 lines
4.1 KiB
YAML
name: CI
|
|
|
|
# Runner-native workflow: the self-hosted act_runner's job containers have no
|
|
# Node.js, so JavaScript actions (actions/checkout, actions/setup-go, ...)
|
|
# fail with "Cannot find: node in PATH". Every step here is a plain shell
|
|
# run-step inside a golang container instead.
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
pull_request:
|
|
|
|
# Cancel superseded runs for the same ref to save runner capacity.
|
|
concurrency:
|
|
group: ci-${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
lint:
|
|
name: Lint
|
|
runs-on: docker
|
|
container:
|
|
image: golang:1.25-alpine
|
|
# Advisory while the pre-existing lint backlog (~95 findings) is worked
|
|
# off; flip to blocking by removing continue-on-error once clean.
|
|
continue-on-error: true
|
|
steps:
|
|
- name: Checkout
|
|
run: |
|
|
apk add -q --no-cache git make protobuf protobuf-dev curl
|
|
git init -q .
|
|
git remote add origin https://gitea.ivangodwin.com/${{ gitea.repository }}.git
|
|
git fetch -q --depth 1 origin ${{ gitea.sha }}
|
|
git checkout -q FETCH_HEAD
|
|
|
|
# api/grpc/pb/ is gitignored and generated at build time, so anything
|
|
# that compiles this module - including the linter, which type-checks
|
|
# packages - needs the generated code in place first.
|
|
- name: Generate protobuf code
|
|
run: |
|
|
go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.36.10
|
|
go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.5.1
|
|
export PATH="$PATH:$(go env GOPATH)/bin"
|
|
make proto-gen
|
|
|
|
- name: Run golangci-lint
|
|
run: |
|
|
curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | \
|
|
sh -s -- -b "$(go env GOPATH)/bin" v2.12.2
|
|
"$(go env GOPATH)/bin/golangci-lint" run ./...
|
|
|
|
test:
|
|
name: Test
|
|
runs-on: docker
|
|
container:
|
|
image: golang:1.25-alpine
|
|
steps:
|
|
- name: Checkout
|
|
run: |
|
|
apk add -q --no-cache git make protobuf protobuf-dev gcc musl-dev
|
|
git init -q .
|
|
git remote add origin https://gitea.ivangodwin.com/${{ gitea.repository }}.git
|
|
git fetch -q --depth 1 origin ${{ gitea.sha }}
|
|
git checkout -q FETCH_HEAD
|
|
|
|
- name: Generate protobuf code
|
|
run: |
|
|
go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.36.10
|
|
go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.5.1
|
|
export PATH="$PATH:$(go env GOPATH)/bin"
|
|
make proto-gen
|
|
|
|
# -race needs cgo, hence gcc/musl-dev above. tests/e2e uses
|
|
# testcontainers-go (needs a Docker daemon) and is excluded; run it
|
|
# locally with: go test -race ./tests/e2e/...
|
|
# coverage.out is left in the workspace; artifact upload is omitted
|
|
# until the instance's artifact storage is confirmed working.
|
|
- name: Run tests (excluding e2e)
|
|
run: |
|
|
go test -race -covermode=atomic -coverprofile=coverage.out \
|
|
$(go list ./... | grep -v '/tests/e2e')
|
|
|
|
vuln:
|
|
name: Vulnerability scan
|
|
runs-on: docker
|
|
container:
|
|
image: golang:1.25-alpine
|
|
# Advisory: govulncheck also reports Go-stdlib findings that are only
|
|
# fixable by toolchain updates; flip to blocking once triaged.
|
|
continue-on-error: true
|
|
steps:
|
|
- name: Checkout
|
|
run: |
|
|
apk add -q --no-cache git make protobuf protobuf-dev
|
|
git init -q .
|
|
git remote add origin https://gitea.ivangodwin.com/${{ gitea.repository }}.git
|
|
git fetch -q --depth 1 origin ${{ gitea.sha }}
|
|
git checkout -q FETCH_HEAD
|
|
|
|
# govulncheck also loads and type-checks the module's packages, so the
|
|
# generated protobuf code has to exist first.
|
|
- name: Generate protobuf code
|
|
run: |
|
|
go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.36.10
|
|
go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.5.1
|
|
export PATH="$PATH:$(go env GOPATH)/bin"
|
|
make proto-gen
|
|
|
|
- name: Run govulncheck
|
|
run: |
|
|
go install golang.org/x/vuln/cmd/govulncheck@latest
|
|
"$(go env GOPATH)/bin/govulncheck" ./...
|