cloudkit/.github/workflows/ci.yml at main · simtabi/cloudkit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
name: CI

on:
  pull_request:
    branches: [main]
    # Drafts skip every job, so marking a PR ready must start a run; without
    # ready_for_review the required checks stay "skipped", which a ruleset
    # counts as passing.
    types: [opened, synchronize, reopened, ready_for_review]
  # Re-run by hand, from the Actions tab or `gh workflow run ci.yml --repo simtabi/cloudkit`.
  workflow_dispatch:
  # Nothing re-runs after a merge, so this weekly run on main is what catches
  # drift there (a toolchain release, two green PRs that interact).
  schedule:
    - cron: '0 6 * * 1'

permissions:
  contents: read

# Our own modules are fetched from git, never through proxy.golang.org or
# sum.golang.org, so a CI build can never feed a version into the public cache.
env:
  GOPRIVATE: github.com/simtabi/*
  GONOSUMDB: github.com/simtabi/*

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  test:
    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/setup-go@v7
        with:
          # The module is src/; its go.mod names the toolchain.
          go-version-file: src/go.mod
          # No third-party dependency yet, so there is no go.sum to key a cache on.
          cache: false
      # One gate, defined once, in the Makefile: fmt, vet, test (policy included).
      - name: Gate
        run: make ci
      # Installed with the runner's Go 1.27, so the linter understands the
      # stdlib it analyses; a release binary built with an older Go can panic on it.
      - name: Lint
        run: make lint

  # dbpantry and mesobia ship binaries for macOS and Windows, so cloudkit must
  # build and pass there too. Pull requests test on Linux only; the other OSes
  # run weekly and by hand.
  cross-os:
    if: github.event_name != 'pull_request'
    runs-on: ${{ matrix.os }}
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        os: [macos-latest, windows-latest]
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: actions/setup-go@v7
        with:
          go-version-file: src/go.mod
          cache: false
      - name: Gate
        shell: bash
        run: make ci

  gitleaks:
    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false
      # The binary directly: gitleaks-action needs a paid licence for organisation repositories.
      - name: Install gitleaks
        run: |
          VERSION=8.30.1
          # From the release's gitleaks_8.30.1_checksums.txt; bump both together.
          SHA256=551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
          curl -fsSL -o gitleaks.tar.gz \
            "https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_linux_x64.tar.gz"
          echo "${SHA256}  gitleaks.tar.gz" | sha256sum -c -
          tar -xzf gitleaks.tar.gz gitleaks
          sudo install -m 0755 gitleaks /usr/local/bin/gitleaks
      - name: Scan for secrets
        run: gitleaks detect --source . --redact --no-banner --exit-code 1

  scripts:
    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - name: shellcheck
        run: shellcheck --severity=warning src/scripts/extract-changelog.sh
      # The release body comes from this script; prove it finds a real section.
      - name: The changelog extractor reads a section
        run: |
          printf '## [Unreleased]\n\n## [9.9.9] - 2026-01-01\n\n### Added\n\n- A line.\n' > "$RUNNER_TEMP/CHANGELOG.md"
          CHANGELOG_FILE="$RUNNER_TEMP/CHANGELOG.md" src/scripts/extract-changelog.sh v9.9.9 | grep -q 'A line.'
          if CHANGELOG_FILE="$RUNNER_TEMP/CHANGELOG.md" src/scripts/extract-changelog.sh v1.0.0; then
            echo "a missing section must fail"; exit 1
          fi