Duc-Tam Nguyen
d59b7e1dff
The GitHub Ubuntu runner disables unprivileged user namespaces with AppArmor, so Chrome's sandbox cannot initialize and the new secure default (sandbox on) makes Chrome refuse to start. IN_DOCKER is the documented escape hatch for that case, so set it on the Ubuntu leg of the test job. It also exercises the container code path. macOS does not need the flag, so it stays empty there.
128 lines
4.1 KiB
YAML
128 lines
4.1 KiB
YAML
name: ci
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
# Cancel an in-flight run when a branch is pushed again.
|
|
concurrency:
|
|
group: ci-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
# Build and test on Linux and macOS with the race detector on. gofmt and vet
|
|
# run here too so a formatting slip fails fast on both platforms. The full
|
|
# suite includes Chrome-driven end-to-end tests, so the runners install a
|
|
# browser first; tests that find none skip themselves, so the job still passes
|
|
# if a future runner image drops Chrome.
|
|
test:
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
os: [ubuntu-latest, macos-latest]
|
|
runs-on: ${{ matrix.os }}
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
- uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: go.mod
|
|
check-latest: true
|
|
cache: true
|
|
- name: install chromium (linux)
|
|
if: matrix.os == 'ubuntu-latest'
|
|
uses: browser-actions/setup-chrome@v1
|
|
id: chrome
|
|
- name: gofmt
|
|
run: |
|
|
unformatted=$(gofmt -s -l .)
|
|
if [ -n "$unformatted" ]; then
|
|
echo "These files need gofmt -s -w:"
|
|
echo "$unformatted"
|
|
exit 1
|
|
fi
|
|
- name: go vet
|
|
run: go vet ./...
|
|
- name: build
|
|
run: go build ./...
|
|
# The GitHub Ubuntu runner disables unprivileged user namespaces (AppArmor),
|
|
# so Chrome's sandbox cannot initialize there and the secure default would
|
|
# make it refuse to start. IN_DOCKER is kage's documented escape hatch for
|
|
# exactly that case, and setting it here also exercises the container path.
|
|
# macOS does not need it, so it stays empty on that leg.
|
|
- name: test
|
|
env:
|
|
KAGE_CHROME: ${{ steps.chrome.outputs.chrome-path }}
|
|
IN_DOCKER: ${{ matrix.os == 'ubuntu-latest' && '1' || '' }}
|
|
run: go test -race -count=1 -coverprofile=coverage.out ./...
|
|
- name: coverage summary
|
|
if: matrix.os == 'ubuntu-latest'
|
|
run: go tool cover -func=coverage.out | tail -1
|
|
|
|
# golangci-lint bundles staticcheck, govet, ineffassign, errcheck, unused and
|
|
# more, so it is the main quality gate.
|
|
lint:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
- uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: go.mod
|
|
check-latest: true
|
|
cache: true
|
|
- uses: golangci/golangci-lint-action@v8
|
|
with:
|
|
version: latest
|
|
|
|
# Scan the module and its dependencies for known vulnerabilities.
|
|
govulncheck:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
- uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: go.mod
|
|
check-latest: true
|
|
cache: true
|
|
- name: govulncheck
|
|
run: |
|
|
go install golang.org/x/vuln/cmd/govulncheck@latest
|
|
govulncheck ./...
|
|
|
|
# Confirm go.mod and go.sum are tidy: a PR that adds an import without running
|
|
# go mod tidy fails here instead of breaking a later release.
|
|
tidy:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
- uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: go.mod
|
|
check-latest: true
|
|
cache: true
|
|
- name: go mod tidy is clean
|
|
run: |
|
|
go mod tidy
|
|
git diff --exit-code -- go.mod go.sum
|
|
|
|
# Compile the optional native-window viewer (-tags webview, cgo) so that path
|
|
# keeps building. The default CI build is pure Go and never touches it. The
|
|
# viewer code is the same Go on every OS, only the system WebView library
|
|
# differs, so a macOS compile (WebKit ships in the SDK) catches our
|
|
# regressions without the WebKitGTK version juggling Linux runners need. It is
|
|
# build-only: actually opening a window needs a display.
|
|
webview:
|
|
runs-on: macos-latest
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
- uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: go.mod
|
|
check-latest: true
|
|
cache: true
|
|
- name: build webview viewer
|
|
run: CGO_ENABLED=1 go build -tags webview ./cmd/kage
|