Repository navigation
feat: run, listen, apply and status #7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| schedule: | |
| # Every Monday: find vulnerabilities that became known since the last push. | |
| - cron: "17 5 * * 1" | |
| permissions: | |
| contents: read | |
| concurrency: | |
| # A new push to a pull request cancels the older run for it. | |
| # Each push to main gets its own group, so those runs are never cancelled. | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }} | |
| cancel-in-progress: true | |
| jobs: | |
| test: | |
| name: test (${{ matrix.go }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # go.mod: the oldest Go we support (the go line in go.mod). | |
| # stable: the newest Go release. | |
| go: [go.mod, stable] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: ${{ matrix.go == 'go.mod' && 'go.mod' || '' }} | |
| go-version: ${{ matrix.go == 'stable' && 'stable' || '' }} | |
| - name: Check formatting | |
| run: | | |
| unformatted="$(gofmt -l .)" | |
| if [ -n "$unformatted" ]; then | |
| echo "These files are not formatted with gofmt:" | |
| echo "$unformatted" | |
| exit 1 | |
| fi | |
| - run: go vet ./... | |
| # The tests need git. GitHub sets CI=true, and then a test fails | |
| # instead of skips when git is missing. | |
| - run: git --version | |
| - run: go test -race ./... | |
| - name: Build static binaries | |
| run: | | |
| for arch in amd64 arm64; do | |
| CGO_ENABLED=0 GOOS=linux GOARCH="$arch" go build -trimpath -o "/tmp/pullgate-$arch" ./cmd/pullgate | |
| done | |
| e2e: | |
| name: end-to-end test | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: go.mod | |
| - run: git --version | |
| - run: go vet -tags e2e ./test/e2e/... | |
| - name: End-to-end test | |
| # A local bare repo with two commits, the real binary, the listener | |
| # against a fake Telegram server, a tap, and the apply of the | |
| # second commit (DESIGN.md section 14). | |
| run: go test -race -tags e2e ./test/e2e/... | |
| units: | |
| name: example units | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Check the example scripts and units | |
| run: | | |
| set -eu | |
| for f in contrib/examples/*/*.sh; do sh -n "$f"; done | |
| # The binary is not installed here; every other message fails. | |
| out="$(systemd-analyze verify --man=no contrib/systemd/* 2>&1 || true)" | |
| echo "$out" | |
| if echo "$out" | grep -v "Command /usr/local/bin/pullgate is not executable" | grep -q .; then | |
| exit 1 | |
| fi | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: go.mod | |
| - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 | |
| with: | |
| # Dependabot does not update this version. Update it by hand. | |
| version: v2.14.0 | |
| # With the tag e2e, the files of the end-to-end test are checked too. | |
| args: --build-tags e2e | |
| vuln: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| # Release binaries are built with the newest Go, so check the | |
| # standard library of that version. | |
| go-version: stable | |
| - name: govulncheck | |
| # Dependabot does not update this version. Update it by hand. | |
| run: go run golang.org/x/vuln/cmd/govulncheck@v1.9.0 ./... |