snowcat-cockpit/.github/workflows/test.yml at main · frostyard/snowcat-cockpit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
name: Tests

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  merge_group:

permissions: {}

jobs:
  check:
    name: Repository gate
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod

      - name: Install system test tools
        run: sudo apt-get update && sudo apt-get install --yes tmux

      # mise.toml and mise.lock are the single source of every tool pin
      # (core ADR-0043): this installs exactly the locked golangci-lint and
      # actionlint, checksum-verified, the same way a developer's
      # `mise install` and a Snowcat worker's target preparation do, so the
      # three cannot drift.
      - name: Install pinned tools
        uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5
        with:
          install: true
          install_args: actionlint golangci-lint
          cache: true

      - name: Check pinned golangci-lint
        run: make lint-version-check

      - name: Run canonical gate
        run: make ci

  security:
    name: Security scan
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod

      - name: Install pinned govulncheck
        run: go install golang.org/x/vuln/cmd/govulncheck@v1.6.0

      - name: Run govulncheck
        run: govulncheck ./...

  build:
    name: Build (${{ matrix.goarch }})
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    strategy:
      matrix:
        goarch: [amd64, arm64]
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod

      - name: Build
        env:
          GOOS: linux
          GOARCH: ${{ matrix.goarch }}
        run: make build

  docs-gate:
    name: Docs integrity
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Check docs, links, and aliases
        run: node scripts/check-docs.mjs

  oci-build:
    name: OCI build (${{ matrix.provider }}, ${{ matrix.arch }})
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        provider: [codex, claude, copilot]
        arch: [amd64, arm64]
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up QEMU
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

      # Non-publishing build signal (no registry login, no push): exercises
      # the same Containerfile target and TARGETARCH-selected, checksum-
      # verified downloads the tag-triggered publish job in
      # worker-images.yml uses, so a broken build fails here first.
      - name: Build worker image
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          file: oci/Containerfile
          target: ${{ matrix.provider }}
          platforms: linux/${{ matrix.arch }}
          push: false