wehub-resource-sync
284 lines
7.6 KiB
YAML
284 lines
7.6 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main-v2]
|
|
pull_request:
|
|
branches: [main-v2]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: ci-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
test:
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
os: [ubuntu-latest, macos-latest, windows-latest]
|
|
runs-on: ${{ matrix.os }}
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: true
|
|
|
|
# Skipped on Windows: the runner checks out CRLF, so gofmt -l flags every
|
|
# file. gofmt output is OS-independent, so the Unix legs already cover it.
|
|
- name: gofmt
|
|
if: runner.os != 'Windows'
|
|
run: |
|
|
# Root module only — desktop/ is a separate module with its own tooling.
|
|
unformatted=$(gofmt -l . | grep -v '^desktop/' || true)
|
|
if [ -n "$unformatted" ]; then
|
|
echo "These files are not gofmt-clean:"
|
|
echo "$unformatted"
|
|
exit 1
|
|
fi
|
|
|
|
- name: vet
|
|
run: go vet ./...
|
|
|
|
- name: build
|
|
run: go build ./...
|
|
|
|
- name: test
|
|
if: runner.os != 'Windows'
|
|
env:
|
|
# Run the prompt-cache prefix-stability guard (TestCacheHit*) in CI: a
|
|
# regression there silently tanks the cache hit rate the project is
|
|
# built around.
|
|
REASONIX_RELEASE_CACHE_GUARD: "1"
|
|
run: go test ./...
|
|
|
|
- name: test
|
|
if: runner.os == 'Windows'
|
|
timeout-minutes: 10
|
|
env:
|
|
# Run the prompt-cache prefix-stability guard (TestCacheHit*) in CI: a
|
|
# regression there silently tanks the cache hit rate the project is
|
|
# built around.
|
|
REASONIX_RELEASE_CACHE_GUARD: "1"
|
|
# Bound sandbox helper children in Windows tests so a failed OS-level
|
|
# launch cannot pin the Actions step after Go's package timeout fires.
|
|
WINDOWS_SANDBOX_WAIT_MS: "20000"
|
|
run: go test -p 4 -timeout=3m ./...
|
|
|
|
race:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: true
|
|
|
|
# The matrix never runs -race (it needs cgo); the project's concurrency
|
|
# (plugin fan-out, background phase B, jobs Kill/Wait) would otherwise
|
|
# ship without race coverage.
|
|
- name: test -race
|
|
env:
|
|
REASONIX_RELEASE_CACHE_GUARD: "1"
|
|
run: go test -race ./...
|
|
|
|
desktop:
|
|
runs-on: ubuntu-22.04
|
|
defaults:
|
|
run:
|
|
working-directory: desktop
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: desktop/go.mod
|
|
cache: true
|
|
cache-dependency-path: desktop/go.sum
|
|
|
|
- uses: pnpm/action-setup@v6
|
|
with:
|
|
version: 10
|
|
run_install: false
|
|
|
|
- uses: actions/setup-node@v6
|
|
with:
|
|
node-version: "24"
|
|
cache: pnpm
|
|
cache-dependency-path: desktop/frontend/pnpm-lock.yaml
|
|
|
|
- name: Install Wails CLI
|
|
run: |
|
|
echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
|
|
go install github.com/wailsapp/wails/v2/cmd/wails@v2.12.0
|
|
|
|
- name: gofmt
|
|
run: |
|
|
unformatted=$(gofmt -l .)
|
|
if [ -n "$unformatted" ]; then
|
|
echo "These files are not gofmt-clean:"
|
|
echo "$unformatted"
|
|
exit 1
|
|
fi
|
|
|
|
- name: go.mod tidy
|
|
run: |
|
|
go mod tidy
|
|
if ! git diff --quiet -- go.mod go.sum; then
|
|
echo "desktop/go.mod or go.sum is stale - run 'cd desktop && go mod tidy' and commit."
|
|
git diff -- go.mod go.sum
|
|
exit 1
|
|
fi
|
|
|
|
# WebKitGTK 4.0 toolchain (pinned to ubuntu-22.04; no webkit2_41 tag).
|
|
- name: Install Linux build deps
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y gcc libgtk-3-dev libwebkit2gtk-4.0-dev
|
|
|
|
- name: Build frontend
|
|
run: |
|
|
wails generate module
|
|
pnpm --dir frontend install --frozen-lockfile
|
|
pnpm --dir frontend build
|
|
|
|
- name: vet
|
|
run: go vet ./...
|
|
|
|
- name: golangci-lint
|
|
uses: golangci/golangci-lint-action@v9
|
|
with:
|
|
version: v2.12.2
|
|
working-directory: desktop
|
|
args: --timeout=5m
|
|
|
|
- name: build
|
|
run: go build ./...
|
|
|
|
- name: test
|
|
run: go test ./...
|
|
|
|
# Desktop project-root matching is case-insensitive only on Windows
|
|
# (sameDesktopPath folds case when os.PathSeparator is '\'), so the
|
|
# regression tests for that contract are named *OnWindows and can never
|
|
# run on the ubuntu leg above.
|
|
desktop-windows:
|
|
runs-on: windows-latest
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
working-directory: desktop
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: desktop/go.mod
|
|
cache: true
|
|
cache-dependency-path: desktop/go.sum
|
|
|
|
- uses: pnpm/action-setup@v6
|
|
with:
|
|
version: 10
|
|
run_install: false
|
|
|
|
- uses: actions/setup-node@v6
|
|
with:
|
|
node-version: "24"
|
|
cache: pnpm
|
|
cache-dependency-path: desktop/frontend/pnpm-lock.yaml
|
|
|
|
- name: Install Wails CLI
|
|
run: |
|
|
echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
|
|
go install github.com/wailsapp/wails/v2/cmd/wails@v2.12.0
|
|
|
|
# go:embed of frontend/dist needs a built frontend before the package
|
|
# compiles, same as the ubuntu desktop leg.
|
|
- name: Build frontend
|
|
run: |
|
|
wails generate module
|
|
pnpm --dir frontend install --frozen-lockfile
|
|
pnpm --dir frontend build
|
|
|
|
- name: test (Windows-only path semantics)
|
|
timeout-minutes: 10
|
|
run: go test . -run 'OnWindows$' -v
|
|
|
|
lint:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: true
|
|
|
|
- name: golangci-lint
|
|
uses: golangci/golangci-lint-action@v9
|
|
with:
|
|
version: v2.12.2
|
|
args: --timeout=5m
|
|
|
|
# The site/ auth client has security-sensitive redirect-validation logic
|
|
# (safeNext) covered by node:test unit tests. Those tests use only Node
|
|
# builtins, so no `npm install` is needed — run them directly on every PR so
|
|
# a regression in redirect validation fails the build instead of shipping.
|
|
site:
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
working-directory: site
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- uses: actions/setup-node@v6
|
|
with:
|
|
node-version: "24"
|
|
|
|
- name: test
|
|
run: npm test
|
|
|
|
govulncheck:
|
|
runs-on: ubuntu-latest
|
|
continue-on-error: true # informational — stdlib vulns need a Go patch release
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: true
|
|
|
|
- name: install govulncheck
|
|
run: go install golang.org/x/vuln/cmd/govulncheck@latest
|
|
|
|
- name: govulncheck
|
|
run: govulncheck ./...
|
|
|
|
coverage:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: true
|
|
|
|
- name: test with coverage
|
|
run: go test -coverprofile=coverage.out -covermode=atomic ./...
|
|
|
|
- name: upload coverage
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: coverage-report
|
|
path: coverage.out
|
|
retention-days: 7
|