Skip to content
CI

refactor(sight): split static rules by domain and document memory bridge #143

Sign in to view logs

refactor(sight): split static rules by domain and document memory bridge

refactor(sight): split static rules by domain and document memory bridge #143

Workflow file for this run

.github/workflows/ci.yml at 0c2bd09
# Canonical CI workflow for hawk-eco Go repos.
# Source of truth: https://github.com/GrayCodeAI/hawk/blob/main/.shared-templates/workflows/go-ci.yml.tmpl
#
# Two deployment models:
#
# 1. NOW — render this template inline into each repo's
# .github/workflows/ci.yml. Every repo has identical content.
#
# 2. LATER — once GrayCodeAI/.github exists as a central repo, move this
# file to GrayCodeAI/.github/.github/workflows/go-ci.yml with
# `on: workflow_call:`. Each repo's ci.yml becomes a 5-line caller:
#
# name: CI
# on: { push: { branches: [main] }, pull_request: }
# jobs:
# ci:
# uses: GrayCodeAI/.github/.github/workflows/go-ci.yml@main
name: CI
on:
push:
branches: [main, dev]
pull_request:
branches: [main, dev]
permissions:
contents: read
concurrency:
group: ci-${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
env:
GO_VERSION: "1.26.5"
GOPROXY: "https://proxy.golang.org,direct"
GOPRIVATE: "github.com/GrayCodeAI/*"
GONOSUMDB: "github.com/GrayCodeAI/*"
GONOSUMCHECK: "1"
jobs:
# -------------------------------------------------------------------------
# Format + vet — fastest, fail fast.
# -------------------------------------------------------------------------
fmt-vet:
name: fmt + vet
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: ${{ env.GO_VERSION }}
cache: true
- name: Boundary guard
run: bash ./scripts/check-ecosystem-boundaries.sh
- name: gofumpt diff
run: |
go install mvdan.cc/gofumpt@v0.10.0
out=$(gofumpt -l .)
if [ -n "$out" ]; then
echo "::error::gofumpt would reformat the following files:"
echo "$out"
exit 1
fi
- name: go vet
run: go vet ./...
# -------------------------------------------------------------------------
# Lint — golangci-lint covers most static checks.
# -------------------------------------------------------------------------
lint:
name: lint
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: ${{ env.GO_VERSION }}
cache: true
- name: Boundary guard
run: bash ./scripts/check-ecosystem-boundaries.sh
- uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v7.0.0
with:
version: v2.1.0
install-mode: goinstall
verify: false
args: --timeout=5m
# -------------------------------------------------------------------------
# Tests with race detector + coverage upload.
# -------------------------------------------------------------------------
test:
name: test (race + cover)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: ${{ env.GO_VERSION }}
cache: true
- name: Boundary guard
run: bash ./scripts/check-ecosystem-boundaries.sh
- name: Tidy check
run: |
go mod tidy
if ! git diff --quiet; then
echo "::error::go.mod / go.sum out of date — run 'go mod tidy' and commit"
git diff
exit 1
fi
- name: Test
run: go test ./... -race -count=1 -shuffle=on -coverprofile=coverage.out -covermode=atomic -timeout=180s
- name: Coverage summary
run: go tool cover -func=coverage.out | tail -1
- name: Coverage threshold
run: |
COVERAGE=$(go tool cover -func=coverage.out | tail -1 | grep -oE '[0-9]+\.[0-9]+' || echo "0")
THRESHOLD=74
if [ "$(echo "$COVERAGE < $THRESHOLD" | bc -l)" -eq 1 ]; then
echo "::error::Coverage ${COVERAGE}% is below threshold ${THRESHOLD}%"
exit 1
fi
echo "Coverage ${COVERAGE}% meets threshold ${THRESHOLD}%"
- name: Upload coverage
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: coverage
path: coverage.out
# -------------------------------------------------------------------------
# Security scan — vulnerability database + (optional) gosec.
# -------------------------------------------------------------------------
security:
name: security
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: ${{ env.GO_VERSION }}
cache: true
- name: govulncheck
run: |
go install golang.org/x/vuln/cmd/govulncheck@v1.1.4
govulncheck ./...
- name: gosec (advisory)
run: |
go install github.com/securego/gosec/v2/cmd/gosec@v2.22.4
gosec -exclude=G104,G301,G302,G304,G306 ./...
# -------------------------------------------------------------------------
# Dead code detection.
# -------------------------------------------------------------------------
deadcode:
name: deadcode
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: ${{ env.GO_VERSION }}
cache: true
- name: deadcode
run: |
go install golang.org/x/tools/cmd/deadcode@latest
deadcode ./...
# -------------------------------------------------------------------------
# Duplication detection — jscpd.
# -------------------------------------------------------------------------
jscpd:
name: duplication
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: '20'
- name: jscpd
run: |
npx --yes jscpd@5.0.12 --min-lines 5 --min-tokens 50 --reporters console --blame .
# -------------------------------------------------------------------------
# Fuzz the diff parser, which consumes untrusted/adversarial unified-diff
# text from arbitrary git repos being reviewed.
# -------------------------------------------------------------------------
fuzz:
name: fuzz (60s)
runs-on: ubuntu-latest
needs: [test]
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: ${{ env.GO_VERSION }}
cache: true
- name: Run fuzz targets
run: |
go test -fuzz=FuzzParseDiff -fuzztime=55s ./internal/diff
go test -fuzz=FuzzParseHunkHeader -fuzztime=55s ./internal/diff
go test -fuzz=FuzzParseUnifiedDiff -fuzztime=55s ./internal/diff
# -------------------------------------------------------------------------
# Cross-platform build matrix — only for repos that produce a binary.
# Repos that are pure libraries can keep this job (it'll just `go build ./...`)
# or remove it locally.
# -------------------------------------------------------------------------
build:
name: build (${{ matrix.goos }}/${{ matrix.goarch }})
runs-on: ubuntu-latest
needs: [fmt-vet, lint, test]
strategy:
fail-fast: false
matrix:
goos: [linux, darwin, windows]
goarch: [amd64, arm64]
exclude:
- goos: windows
goarch: arm64
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: ${{ env.GO_VERSION }}
cache: true
- name: Build
env:
GOOS: ${{ matrix.goos }}
GOARCH: ${{ matrix.goarch }}
CGO_ENABLED: "0"
run: go build ./...