chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 #12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| changes: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| outputs: | |
| code: ${{ steps.classify.outputs.code }} | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - id: classify | |
| name: Classify changed paths | |
| shell: bash | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| PUSH_BASE: ${{ github.event.before }} | |
| PR_BASE: ${{ github.event.pull_request.base.sha }} | |
| run: | | |
| if [[ "$EVENT_NAME" == "workflow_dispatch" ]]; then | |
| echo "code=true" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| base="$PUSH_BASE" | |
| if [[ "$EVENT_NAME" == "pull_request" ]]; then | |
| base="$PR_BASE" | |
| fi | |
| if [[ -z "$base" || "$base" =~ ^0+$ ]] || ! git cat-file -e "$base^{commit}"; then | |
| echo "code=true" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| code=false | |
| while IFS= read -r path; do | |
| case "$path" in | |
| *.md|LICENSE|NOTICE|.github/ISSUE_TEMPLATE/*) | |
| ;; | |
| *) | |
| code=true | |
| break | |
| ;; | |
| esac | |
| done < <(git diff --name-only "$base" "$GITHUB_SHA") | |
| echo "code=$code" >> "$GITHUB_OUTPUT" | |
| test: | |
| needs: changes | |
| if: needs.changes.outputs.code == 'true' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest] | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: go.mod | |
| - run: go mod verify | |
| - name: Check formatting | |
| shell: bash | |
| run: | | |
| unformatted="$(find . -name '*.go' -type f -exec gofmt -l {} +)" | |
| test -z "$unformatted" | |
| - name: Test with coverage | |
| if: runner.os == 'Linux' | |
| run: go test -race -shuffle=on -coverprofile=coverage.out ./... | |
| - name: Enforce coverage floor | |
| if: runner.os == 'Linux' | |
| shell: bash | |
| run: | | |
| coverage="$(go tool cover -func=coverage.out | awk '/^total:/ {gsub(/%/, "", $3); print $3}')" | |
| echo "total statement coverage: ${coverage}%" | |
| awk -v coverage="$coverage" 'BEGIN { exit !(coverage + 0 >= 70) }' | |
| - name: Test | |
| if: runner.os != 'Linux' | |
| run: go test -race -shuffle=on ./... | |
| - run: go vet ./... | |
| - run: git diff --check | |
| lint: | |
| needs: changes | |
| if: needs.changes.outputs.code == 'true' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: go.mod | |
| - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 | |
| with: | |
| version: v2.12.2 | |
| security: | |
| needs: changes | |
| if: needs.changes.outputs.code == 'true' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - run: go install golang.org/x/vuln/cmd/govulncheck@v1.6.0 | |
| - run: govulncheck ./... | |
| - name: Verify Windows build | |
| env: | |
| GOOS: windows | |
| GOARCH: amd64 | |
| run: go build ./cmd/coned | |
| required: | |
| needs: [changes, test, lint, security] | |
| if: always() | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Verify required jobs | |
| shell: bash | |
| env: | |
| CHANGE_RESULT: ${{ needs.changes.result }} | |
| CODE_CHANGED: ${{ needs.changes.outputs.code }} | |
| TEST_RESULT: ${{ needs.test.result }} | |
| LINT_RESULT: ${{ needs.lint.result }} | |
| SECURITY_RESULT: ${{ needs.security.result }} | |
| run: | | |
| test "$CHANGE_RESULT" = "success" | |
| if [[ "$CODE_CHANGED" == "true" ]]; then | |
| test "$TEST_RESULT" = "success" | |
| test "$LINT_RESULT" = "success" | |
| test "$SECURITY_RESULT" = "success" | |
| fi |