chore(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 in the actions-minor-patch group #349
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| # The required checks (Go Tests, Notify Tests) are cheap ubuntu jobs and ALWAYS | |
| # run, so branch-protection PRs never hang on a never-reported status — the trap | |
| # a bare top-level `paths-ignore:` creates once a job is a required check (a | |
| # path-filtered *workflow* stays "Expected" forever, blocking the PR). Instead | |
| # the only thing gated is the ~10x-priced macOS "Build & Test" job, on whether | |
| # any non-docs file changed, detected here. | |
| changes: | |
| name: Detect changes | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| permissions: | |
| contents: read | |
| pull-requests: read # dorny lists PR files via the API on pull_request events | |
| outputs: | |
| code: ${{ steps.filter.outputs.code }} | |
| steps: | |
| # Required for push events (e.g. merge to main): with no PR to query, dorny | |
| # falls back to a local git diff and needs a working copy. On pull_request | |
| # it uses the API, but the checkout is harmless there. | |
| - uses: actions/checkout@v7 | |
| - uses: dorny/paths-filter@v4 | |
| id: filter | |
| with: | |
| # "code" = anything that can affect the Go bridge or the iOS build. | |
| # Docs-only changes (**/*.md, docs/**, LICENSE, …) match nothing here, | |
| # so the macOS build is skipped. Add new top-level code trees here if | |
| # the repo layout grows. (Per-pattern OR semantics make a "!docs/**" | |
| # negation list unreliable, hence the positive allow-list.) | |
| filters: | | |
| code: | |
| - 'go/**' | |
| - 'ios/**' | |
| - 'notify/**' | |
| - '.github/**' | |
| go-tests: | |
| name: Go Tests | |
| runs-on: ubuntu-latest # pure-Go bridge suite; needs no macOS/Xcode | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go/go.mod | |
| cache-dependency-path: go/go.sum | |
| - name: Patch vendored dependencies | |
| working-directory: go | |
| run: make patch | |
| - name: Run Go tests | |
| working-directory: go | |
| # The status/event schema regression tests (Phase 1/3 fields, folder | |
| # error details) live in ./bridge and run as part of this package — no | |
| # separate runner needed. | |
| run: go test -tags noassets ./bridge -count=1 | |
| notify-tests: | |
| name: Notify Tests | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Verify notify publication safety policy | |
| run: ruby .github/scripts/notify-publish-safety.rb | |
| - uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: notify/go.mod | |
| - name: Run notify smoke tests | |
| working-directory: notify | |
| run: go test ./... -count=1 | |
| m4-docker-confinement: | |
| name: M4 Docker Confinement | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| - name: Prove exact host-bind namespace confinement | |
| run: notify/tests/m4-docker/run.sh | |
| helper-runtime-packaging: | |
| name: Helper Runtime Packaging | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 25 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Prove real rootful-Linux install, upgrade, downgrade, and recovery | |
| run: sudo notify/tests/runtime-packaging/run-linux-host.sh | |
| m5-syncthing-upload-e2e: | |
| name: M5/M6 Syncthing Transfer E2E | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: go/go.mod | |
| cache-dependency-path: go/go.sum | |
| - name: Patch vendored dependencies | |
| working-directory: go | |
| run: make patch | |
| - name: Build local-only Syncthing test binary | |
| working-directory: go/_syncthing_patched | |
| env: | |
| CGO_ENABLED: "0" | |
| run: go build -tags noassets -o /tmp/vaultsync-m5-syncthing ./cmd/syncthing | |
| - name: Materialize checksum-verified notify test modules | |
| working-directory: notify | |
| env: | |
| GOMODCACHE: /tmp/vaultsync-m5-notify-mod | |
| run: go mod download | |
| - name: Prove upload and response transfer through two isolated ephemeral instances | |
| run: | | |
| # The image uses GOTOOLCHAIN=local, so its Go patch version must stay | |
| # aligned with notify/go.mod or this test fails before it can start. | |
| docker run --rm --network none --read-only --cap-drop ALL \ | |
| --security-opt no-new-privileges \ | |
| --tmpfs /tmp:rw,exec,nosuid,nodev,mode=1777 \ | |
| -v "$GITHUB_WORKSPACE:/src:ro" \ | |
| -v /tmp/vaultsync-m5-syncthing:/opt/vaultsync-m5-syncthing:ro \ | |
| -v /tmp/vaultsync-m5-notify-mod:/opt/vaultsync-m5-notify-mod:ro \ | |
| -w /src/notify \ | |
| -e GOCACHE=/tmp/go-cache \ | |
| -e GOMODCACHE=/opt/vaultsync-m5-notify-mod \ | |
| -e VAULTSYNC_M5_SYNCTHING_BIN=/opt/vaultsync-m5-syncthing \ | |
| golang:1.26@sha256:26326682769ca980f8f1d3b1f52be2dd1c1d25270e3de3fe0c97d6bb65df3556 \ | |
| go test -tags diagnostics_m5_syncthing_e2e \ | |
| -run '^TestDiagnostics(Upload|Download)ThroughTwoEphemeralSyncthingInstances$' \ | |
| -count=1 -v | |
| install-script: | |
| name: Install Script | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| # Pinned (not the runner's preinstalled build): a shellcheck upgrade must | |
| # never turn this job red without a repo change. Bump deliberately. | |
| - name: Install shellcheck v0.10.0 | |
| run: | | |
| curl -fsSL -o /tmp/shellcheck.tar.xz \ | |
| https://github.com/koalaman/shellcheck/releases/download/v0.10.0/shellcheck-v0.10.0.linux.x86_64.tar.xz | |
| echo "6c881ab0698e4e6ea235245f22832860544f17ba386442fe7e9d629f8cbedf87 /tmp/shellcheck.tar.xz" | sha256sum -c - | |
| tar -xJf /tmp/shellcheck.tar.xz -C /tmp | |
| sudo mv /tmp/shellcheck-v0.10.0/shellcheck /usr/local/bin/shellcheck | |
| - name: shellcheck | |
| # install.sh is the conversion-critical curl|sh entry point — freeze its | |
| # current zero-findings state (#82). bootstrap.sh only trips SC1007 | |
| # false positives on the POSIX `CDPATH= cd` idiom, hence the exclude. | |
| run: | | |
| shellcheck --version | |
| shellcheck -s sh notify/scripts/install.sh notify/scripts/tests/install-dry-run-test.sh | |
| shellcheck -s sh --exclude=SC1007 notify/scripts/bootstrap.sh | |
| shellcheck -s sh notify/tests/m4-docker/run.sh | |
| shellcheck -s sh notify/scripts/diagnostics-docker.sh | |
| shellcheck -s sh notify/tests/runtime-packaging/run.sh | |
| shellcheck -s sh notify/tests/runtime-packaging/run-linux-host.sh | |
| - name: install.sh --dry-run smoke test | |
| # Hermetic: fixture config.xml + PATH shims; asserts dry-run changes | |
| # nothing, prints the config owner's uid:gid, and that install.sh and | |
| # docker.yml still agree on the release asset naming. | |
| run: notify/scripts/tests/install-dry-run-test.sh | |
| - name: install.ps1 parse check | |
| # A syntax error in the Windows installer (#90) would otherwise only | |
| # surface on a user's machine. pwsh ships on ubuntu-latest runners. | |
| shell: pwsh | |
| run: | | |
| $errors = $null | |
| $tokens = $null | |
| [void][System.Management.Automation.Language.Parser]::ParseFile( | |
| "$env:GITHUB_WORKSPACE/notify/scripts/install.ps1", [ref]$tokens, [ref]$errors) | |
| if ($errors.Count -gt 0) { | |
| $errors | ForEach-Object { Write-Host "PARSE ERROR: $($_.Message) at line $($_.Extent.StartLineNumber)" } | |
| exit 1 | |
| } | |
| Write-Host 'install.ps1: parse clean' | |
| design-lint: | |
| name: Design Token Lint | |
| runs-on: ubuntu-latest # pure bash/grep guardrail; no Xcode needed | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Check design tokens | |
| # Fails if views reintroduce raw status colors instead of Theme.swift | |
| # tokens — keeps the redesign's single source of truth from eroding. | |
| run: ios/scripts/design-token-lint.sh | |
| strings-parity: | |
| name: Strings Key Parity | |
| runs-on: ubuntu-latest # pure bash/sed guardrail; no Xcode needed | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Check Localizable.strings key parity | |
| # A key missing from one .lproj silently falls back to English at | |
| # runtime — invisible in review, deterministic to catch here (#83). | |
| run: ios/scripts/strings-key-parity.sh | |
| build: | |
| name: Build & Test | |
| runs-on: macos-26 # Xcode 26.2 default, iOS 26 SDK required for BGContinuedProcessingTask | |
| timeout-minutes: 45 # guard against a hung simulator/xcodebuild burning 10x macOS minutes | |
| needs: | |
| - changes | |
| - go-tests | |
| - notify-tests | |
| - m4-docker-confinement | |
| - helper-runtime-packaging | |
| - m5-syncthing-upload-e2e | |
| - design-lint | |
| # Skip the expensive macOS build on docs-only changes. It is not a required | |
| # status check, so skipping never blocks a PR. The plain expression (no | |
| # always()/status function) keeps the implicit "all needs succeeded" gate, | |
| # so a failed test job still skips the build exactly as before. | |
| if: needs.changes.outputs.code == 'true' | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go/go.mod | |
| cache-dependency-path: go/go.sum | |
| - name: Cache gomobile toolchain | |
| uses: actions/cache@v6 | |
| with: | |
| path: | | |
| ~/go/bin/gomobile | |
| ~/go/bin/gobind | |
| key: gomobile-${{ runner.os }}-3a7bc9f8a4de | |
| - name: Install gomobile | |
| run: | | |
| command -v gomobile >/dev/null || go install golang.org/x/mobile/cmd/gomobile@v0.0.0-20250305212854-3a7bc9f8a4de | |
| command -v gobind >/dev/null || go install golang.org/x/mobile/cmd/gobind@v0.0.0-20250305212854-3a7bc9f8a4de | |
| gomobile init | |
| - name: Patch vendored dependencies | |
| working-directory: go | |
| run: make patch | |
| - name: Build xcframework | |
| working-directory: go | |
| run: make xcframework | |
| - name: Install XcodeGen | |
| run: brew install xcodegen | |
| - name: Generate Xcode project | |
| working-directory: ios | |
| run: xcodegen generate | |
| - name: List available simulators | |
| run: xcrun simctl list devices available | |
| - name: Build & Test | |
| working-directory: ios | |
| run: | | |
| xcodebuild build test \ | |
| -project VaultSync.xcodeproj \ | |
| -scheme VaultSync \ | |
| -destination 'platform=iOS Simulator,name=iPhone 17 Pro,OS=latest' \ | |
| -resultBundlePath TestResults.xcresult \ | |
| -quiet | |
| # A red macOS run used to force a blind re-run — the failure details | |
| # live in the xcresult bundle. Short retention: the bundle is large and | |
| # only needed to diagnose the failing run (#85). | |
| - name: Upload xcresult bundle | |
| if: failure() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: xcresult-${{ github.run_id }} | |
| path: ios/TestResults.xcresult | |
| retention-days: 7 | |
| if-no-files-found: ignore # failures before xcodebuild leave no bundle |