Merge pull request #28 from AppsGanin/release-please--branches--main-… #24
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| # Quality gate for every push to main and every pull request: build the SPA, | |
| # vet + build + race-test the Go code, lint changed code, and scan for known | |
| # vulnerabilities. release-please.yml only runs on release; this is what stops a | |
| # broken change from ever reaching main. | |
| on: | |
| push: | |
| branches: [main] | |
| # release-please opens its PR as github-actions[bot], which GitHub treats as an | |
| # outside contributor: the run lands in "action required" and waits for a manual | |
| # click. Its PR only ever touches these three files, and that code already passed | |
| # ci on the push to main, so skipping it here keeps releases hands-off without | |
| # loosening the fork-PR approval policy that gates strangers. A PR touching any | |
| # other file still runs the full gate. | |
| pull_request: | |
| paths-ignore: | |
| - .release-please-manifest.json | |
| - CHANGELOG.md | |
| - internal/version/version.go | |
| permissions: | |
| contents: read | |
| # A newer push to the same ref cancels the in-flight run (saves CI minutes). | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # Build the SPA once and share web/dist with the Go jobs — the Go binary embeds | |
| # it via //go:embed, so every Go package fails to compile without dist present. | |
| frontend: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24 | |
| cache: npm | |
| cache-dependency-path: web/package-lock.json | |
| - name: Install deps | |
| working-directory: web | |
| run: npm ci | |
| - name: Build SPA | |
| working-directory: web | |
| run: npm run build | |
| - name: Upload dist (consumed by the Go jobs' go:embed) | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: web-dist | |
| path: web/dist | |
| retention-days: 1 | |
| go: | |
| needs: frontend | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Restore embedded SPA | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: web-dist | |
| path: web/dist | |
| - name: go vet | |
| run: go vet ./... | |
| - name: go build | |
| run: go build ./... | |
| # -race needs the default (CGO-enabled) toolchain; ubuntu-latest ships gcc. | |
| - name: go test (race) | |
| run: go test -race ./... | |
| lint: | |
| needs: frontend | |
| # Only-new-issues diffs against the PR base, so run on pull_request where that | |
| # base exists. The existing lint baseline never blocks; only debt a PR adds does. | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Restore embedded SPA | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: web-dist | |
| path: web/dist | |
| - uses: golangci/golangci-lint-action@v7 | |
| with: | |
| version: v2.12.2 | |
| only-new-issues: true | |
| govulncheck: | |
| needs: frontend | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Restore embedded SPA | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: web-dist | |
| path: web/dist | |
| # Scans against the live vuln DB, so it catches a newly-disclosed CVE even | |
| # with no code change — the guard that keeps the Go toolchain from silently | |
| # rotting (which is exactly how the pre-1.26.5 CVEs slipped in). | |
| - name: govulncheck | |
| run: go run golang.org/x/vuln/cmd/govulncheck@latest ./... |