Skip to content
CI

Update dependency golangci-lint to v2.12.2 #620

Sign in to view logs

Update dependency golangci-lint to v2.12.2

Update dependency golangci-lint to v2.12.2 #620

Workflow file for this run

.github/workflows/ci.yml at 8568759
name: CI
on:
push:
branches: [main]
pull_request:
branches: [main]
permissions:
contents: read
jobs:
lint:
name: Lint
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
- name: Check formatting (dprint)
run: dprint check
- name: Run golangci-lint
run: golangci-lint run
test:
name: Test
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
- name: Run tests
run: go test -race -coverprofile=coverage.out -coverpkg=./... ./...
- name: Upload to Codecov
uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6
with:
token: ${{ secrets.CODECOV_TOKEN }}
files: coverage.out
build:
name: Build
runs-on: ubuntu-latest
strategy:
matrix:
goos: [linux, darwin, windows]
goarch: [amd64, arm64]
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
- name: Build
env:
GOOS: ${{ matrix.goos }}
GOARCH: ${{ matrix.goarch }}
run: go build -o bin/preflight-${{ matrix.goos }}-${{ matrix.goarch }} ./cmd/preflight || echo "Build skipped for ${{ matrix.goos }}/${{ matrix.goarch }}"
upx-test:
name: UPX Compression Test
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
- name: Install UPX
run: |
curl -sL https://github.com/upx/upx/releases/download/v4.2.4/upx-4.2.4-amd64_linux.tar.xz | tar -xJ --strip-components=1 -C /usr/local/bin upx-4.2.4-amd64_linux/upx
- name: Build and compress binaries
run: |
mkdir -p dist
# Build all UPX-supported targets
CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w" -trimpath -o dist/preflight-linux-amd64 ./cmd/preflight
CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -ldflags="-s -w" -trimpath -o dist/preflight-linux-arm64 ./cmd/preflight
CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -ldflags="-s -w" -trimpath -o dist/preflight-windows-amd64.exe ./cmd/preflight
# UPX supports: Linux (amd64, arm64), Windows (amd64 only)
upx --best \
dist/preflight-linux-amd64 \
dist/preflight-linux-arm64 \
dist/preflight-windows-amd64.exe
ls -lh dist/
security:
name: Security
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
- name: Run govulncheck
run: |
go install golang.org/x/vuln/cmd/govulncheck@latest
govulncheck ./...
container-test:
name: Container Test
runs-on: ubuntu-latest
strategy:
matrix:
include:
- image: alpine:3.21
cmd: apk
- image: debian:bookworm-slim
cmd: dpkg
- image: ubuntu:24.04
cmd: bash
- image: node:22-alpine
cmd: node
- image: python:3.13-slim
cmd: python
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
- name: Build static binary
run: CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w" -o preflight ./cmd/preflight
- name: Test in ${{ matrix.image }}
run: |
docker run --rm -v $PWD/preflight:/usr/local/bin/preflight ${{ matrix.image }} sh -c '
preflight cmd ${{ matrix.cmd }} &&
echo "Container test passed: ${{ matrix.image }}"
'
distroless-test:
name: Distroless Test
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
- name: Build static binary
run: CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w" -o preflight ./cmd/preflight
- name: Verify binary is static
run: |
file preflight
# Check that ldd reports it as not dynamic or statically linked
if ldd preflight 2>&1 | grep -qE "(not a dynamic executable|statically linked)"; then
echo "Binary is static"
else
echo "ERROR: Binary has dynamic dependencies"
ldd preflight
exit 1
fi
- name: Test in distroless (no shell)
run: |
echo 'FROM gcr.io/distroless/static-debian12
COPY preflight /preflight
ENTRYPOINT ["/preflight"]' > Dockerfile.distroless
docker build -f Dockerfile.distroless -t preflight-distroless .
# Test basic commands (no shell available)
docker run --rm preflight-distroless --version
docker run --rm preflight-distroless env PATH
# Test exec mode (the key feature for distroless - no shell needed)
# This runs a check, then execs into preflight --version
docker run --rm --entrypoint /preflight preflight-distroless env PATH -- /preflight --version
- name: Test in scratch
run: |
echo 'FROM scratch
COPY preflight /preflight
ENTRYPOINT ["/preflight"]' > Dockerfile.scratch
docker build -f Dockerfile.scratch -t preflight-scratch .
docker run --rm preflight-scratch --version
# Test exec mode in scratch too
docker run --rm --entrypoint /preflight preflight-scratch env PATH -- /preflight --version