mirror of https://github.com/vernonkeenan/lib
63 lines
2.0 KiB
YAML
63 lines
2.0 KiB
YAML
name: CI (lib)
|
|
|
|
# First-ever CI for go/lib (ADR-KV-014). lib is publicly mirrored on
|
|
# code.tnxs.net, so every push and PR gets a build/vet/test job plus a
|
|
# gitleaks secret-scan job. lib is a Go library — no Dockerfile, no deploy.
|
|
#
|
|
# push trigger is scoped to main + release tags (not every branch): with
|
|
# `branches: ['**']` *and* `pull_request` both set, every PR ran CI twice —
|
|
# once for the pull_request event, once for the push to the PR's source
|
|
# branch. main+tags replaced branch-per-version (ADR-KV-014, DT-KV-004), so
|
|
# there's no longer a fleet of long-lived version branches that need their
|
|
# own push-triggered runs independent of a PR.
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
tags: ['v*']
|
|
pull_request:
|
|
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
|
|
# Serialize per ref. PR runs cancel superseded validations; branch pushes never cancel.
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
|
|
|
|
jobs:
|
|
test:
|
|
runs-on: [self-hosted, Linux]
|
|
permissions: { contents: read }
|
|
steps:
|
|
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
|
|
|
|
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
|
|
with:
|
|
go-version: stable
|
|
# DT-KV-018: remote actions-cache round-trip (~287MB) vs the
|
|
# persistent runner-local GOMODCACHE — disable, don't fetch it.
|
|
cache: false
|
|
|
|
- name: go build ./...
|
|
run: go build ./...
|
|
|
|
- name: go vet ./...
|
|
run: go vet ./...
|
|
|
|
- name: go test ./...
|
|
run: go test ./...
|
|
|
|
gitleaks:
|
|
runs-on: [self-hosted, Linux]
|
|
permissions: { contents: read }
|
|
steps:
|
|
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: gitleaks detect (git history)
|
|
run: |
|
|
docker run --rm -v "$PWD:/repo" -w /repo zricethezav/gitleaks:latest \
|
|
detect --source /repo --redact -v
|