zero/.github/workflows/ci.yml at main · Gitlawb/zero · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
name: CI

on:
  pull_request:
  push:
    branches:
      - main

jobs:
  smoke:
    name: Smoke (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-latest
          - macos-latest
          - windows-latest

    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false

      - name: Setup Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
        with:
          go-version-file: go.mod
          cache: true

      - name: Install Make on Windows
        if: matrix.os == 'windows-latest'
        shell: pwsh
        run: choco install make --no-progress -y

      - name: Validate quality targets with stock macOS Make
        if: matrix.os == 'macos-latest'
        env:
          GIT_CONFIG_COUNT: 1
          GIT_CONFIG_KEY_0: grep.patternType
          GIT_CONFIG_VALUE_0: fixed
        run: make -n vulncheck

      - name: Check vulnerabilities through native Windows Make
        if: matrix.os == 'windows-latest'
        shell: cmd
        run: make vulncheck

      - name: Check dead code through native Windows Make
        if: matrix.os == 'windows-latest'
        continue-on-error: true
        shell: cmd
        run: make deadcode

      - name: Run static lint through native Windows Make
        if: matrix.os == 'windows-latest'
        continue-on-error: true
        shell: cmd
        run: make lint-static

      - name: Check formatting
        if: matrix.os == 'ubuntu-latest'
        shell: bash
        run: |
          unformatted="$(gofmt -l .)"
          if [ -n "$unformatted" ]; then
            echo "gofmt needed on:" >&2
            echo "$unformatted" >&2
            exit 1
          fi

      - name: Vet
        if: matrix.os == 'ubuntu-latest'
        run: go vet ./...

      - name: Test
        run: go test ./...

      - name: Build binary
        run: go run ./cmd/zero-release build

      - name: Smoke binary
        run: go run ./cmd/zero-release smoke

  performance:
    name: Performance Smoke
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false

      - name: Setup Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
        with:
          go-version-file: go.mod
          cache: true

      - name: Build binary
        run: go run ./cmd/zero-release build

      - name: Performance smoke
        run: go run ./cmd/zero-perf-bench --output dist/perf/perf-bench.json --ci

      - name: Upload performance report
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: zero-performance-smoke
          path: dist/perf/perf-bench.json
          if-no-files-found: warn

  security:
    name: Security & code health
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false

      - name: Setup Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
        with:
          go-version-file: go.mod
          cache: true

      # Hard gate: fails the build when code reaches a known vulnerability. A stdlib
      # CVE is cleared by a toolchain bump (see go.mod). May also flag a newly
      # published advisory on an unrelated PR — intentional: do not ship known vulns.
      - name: govulncheck
        run: make vulncheck

      # Advisory: reports functions unreachable from any cmd/* main so dormant
      # code is visible in CI. Non-blocking while the dormant subsystems are
      # still being wired or removed.
      - name: deadcode (advisory)
        continue-on-error: true
        run: make deadcode

      # Advisory: catches what deadcode's whole-program reachability analysis
      # doesn't, unused private functions/assignments reachable within a
      # package but never actually called, plus staticcheck-style correctness
      # and readability issues. Scoped to a few linters rather than the full
      # default battery, and non-blocking, while the existing findings across
      # the repo are cleaned up incrementally (see #527).
      - name: golangci-lint (advisory)
        continue-on-error: true
        run: make lint-static