Harden GitHub Actions execution and improve workflows #470
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| paths-ignore: | |
| - 'docs/**' | |
| - '*.md' | |
| - '.github/workflows/docs.yml' | |
| pull_request: | |
| branches: [main] | |
| paths-ignore: | |
| - 'docs/**' | |
| - '*.md' | |
| - '.github/workflows/docs.yml' | |
| # Required checks must also run for commits synthesized by Merge Queue. | |
| merge_group: | |
| # Keep the default gate small and cancel only superseded pull-request work. | |
| # Expensive engine, sandbox, Windows and release checks live in extended-ci.yml. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| permissions: {} | |
| jobs: | |
| build: | |
| name: Build & Test | |
| # Pull requests can contain untrusted code. Use an ephemeral GitHub-hosted | |
| # runner instead of a persistent self-hosted machine. | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout source | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Go | |
| uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 | |
| with: | |
| go-version: "1.25.x" | |
| cache: true | |
| - name: Verify dependencies | |
| run: go mod verify | |
| - name: Build | |
| run: go build ./... | |
| - name: Test | |
| run: go test -race -timeout 120s -covermode=atomic -coverpkg=./... -coverprofile=coverage.out ./... | |
| - name: Report coverage | |
| run: | | |
| set -euo pipefail | |
| pct=$(go tool cover -func=coverage.out | awk '/^total:/ {gsub("%","",$3); print $3}') | |
| if [ -z "$pct" ]; then | |
| echo "could not parse total coverage" >&2 | |
| exit 1 | |
| fi | |
| echo "::notice::Total coverage: ${pct}%" | |
| e2e-smoke: | |
| name: E2E Smoke | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout source | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Go | |
| uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 | |
| with: | |
| go-version: "1.25.x" | |
| cache: true | |
| - name: Run quick e2e smoke | |
| run: go test -tags e2e -timeout 1200s -count=1 -v -run 'Test(Pipeline|CLI|Contract|NoneRuntime)_' ./e2e | |
| env: | |
| SKILL_UP_E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts | |
| - name: Upload e2e workspace artifacts | |
| if: always() && hashFiles('e2e-artifacts/**') != '' | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: e2e-smoke-workspaces | |
| path: e2e-artifacts/ | |
| if-no-files-found: ignore | |
| retention-days: 14 | |
| lint: | |
| name: Lint | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout source | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Go | |
| uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 | |
| with: | |
| go-version: "1.25.x" | |
| cache: true | |
| - name: Check formatting | |
| run: | | |
| set -euo pipefail | |
| files=$(gofmt -l .) | |
| if [ -n "$files" ]; then | |
| echo "Following files are not formatted:" | |
| echo "$files" | |
| exit 1 | |
| fi | |
| - name: Run golangci-lint | |
| uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9 | |
| with: | |
| version: v2.11.4 | |
| - name: Install revive | |
| run: go install github.com/mgechev/revive@v1.10.0 | |
| - name: Run revive | |
| run: revive -config revive.toml ./... |