Skip to content

Commit 9c3f50d

Browse files
wagoodmanwagoodman
authored
improve automations (#57)
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
1 parent 19c6eec commit 9c3f50d

File tree

14 files changed

+324
-261
lines changed

14 files changed

+324
-261
lines changed

‎.binny.yaml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
# only pull in version updates that were released more than a week ago (low-pass filter for quickly-retracted releases)
2+
cooldown: 7d
3+
tools:
4+
# we want to use a pinned version of binny to manage the toolchain (so binny manages itself!)
5+
- name: binny
6+
version:
7+
want: v0.13.0
8+
method: github-release
9+
with:
10+
repo: anchore/binny
11+
12+
# used at release to generate the changelog
13+
- name: chronicle
14+
version:
15+
want: v0.8.3
16+
method: github-release
17+
with:
18+
repo: anchore/chronicle
19+
20+
# used for linting
21+
- name: golangci-lint
22+
version:
23+
want: v2.11.4
24+
method: github-release
25+
with:
26+
repo: golangci/golangci-lint
27+
28+
# used for organizing imports during static analysis
29+
- name: gosimports
30+
version:
31+
want: v0.3.8
32+
method: github-release
33+
with:
34+
repo: rinchsan/gosimports
35+
36+
# used during static analysis for license compliance
37+
- name: bouncer
38+
version:
39+
want: v0.4.0
40+
method: github-release
41+
with:
42+
repo: wagoodman/go-bouncer
43+
44+
# used for showing the changelog at release
45+
- name: glow
46+
version:
47+
want: v2.1.1
48+
method: github-release
49+
with:
50+
repo: charmbracelet/glow
51+
52+
# used for running all local and CI tasks
53+
- name: task
54+
version:
55+
want: v3.49.1
56+
method: github-release
57+
with:
58+
repo: go-task/task
59+
60+
# used for creating GitHub releases in CI
61+
- name: gh
62+
version:
63+
want: v2.89.0
64+
method: github-release
65+
with:
66+
repo: cli/cli

‎.github/dependabot.yml‎

Lines changed: 26 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,43 @@
11
version: 2
22

33
updates:
4+
45
- package-ecosystem: gomod
56
directory: "/"
6-
schedule:
7-
interval: "daily"
87
cooldown:
98
default-days: 7
9+
schedule:
10+
interval: "weekly"
11+
day: "friday"
1012
open-pull-requests-limit: 10
1113
labels:
1214
- "dependencies"
15+
groups:
16+
go-minor-patch:
17+
applies-to: version-updates
18+
patterns:
19+
- "*"
20+
update-types:
21+
- "minor"
22+
- "patch"
1323

1424
- package-ecosystem: "github-actions"
15-
directory: "/"
16-
schedule:
17-
interval: "daily"
25+
directories:
26+
- "/"
27+
- "/.github/actions/*"
1828
cooldown:
1929
default-days: 7
30+
schedule:
31+
interval: "weekly"
32+
day: "friday"
2033
open-pull-requests-limit: 10
2134
labels:
2235
- "dependencies"
36+
groups:
37+
actions-minor-patch:
38+
applies-to: version-updates
39+
patterns:
40+
- "*"
41+
update-types:
42+
- "minor"
43+
- "patch"

‎.github/scripts/go-mod-tidy-check.sh‎

Lines changed: 0 additions & 30 deletions
This file was deleted.

‎.github/workflows/codeql.yaml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
name: "CodeQL"
2+
3+
on:
4+
push:
5+
branches: [ "main" ]
6+
pull_request:
7+
branches: [ "main" ]
8+
schedule:
9+
- cron: '38 11 * * 3'
10+
11+
jobs:
12+
analyze:
13+
name: Analyze (${{ matrix.language }})
14+
runs-on: ubuntu-latest
15+
permissions:
16+
security-events: write
17+
packages: read
18+
actions: read
19+
contents: read
20+
21+
strategy:
22+
fail-fast: false
23+
matrix:
24+
include:
25+
- language: actions
26+
build-mode: none
27+
28+
- language: go
29+
build-mode: manual
30+
31+
steps:
32+
- name: Checkout repository
33+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
34+
with:
35+
persist-credentials: false
36+
37+
- name: Setup Go
38+
if: matrix.language == 'go'
39+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
40+
with:
41+
go-version-file: go.mod
42+
43+
- name: Initialize CodeQL
44+
uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
45+
with:
46+
languages: ${{ matrix.language }}
47+
build-mode: ${{ matrix.build-mode }}
48+
49+
- name: Build (Go)
50+
if: matrix.build-mode == 'manual'
51+
shell: bash
52+
run: go build ./...
53+
54+
- name: Perform CodeQL Analysis
55+
uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
56+
with:
57+
category: "/language:${{matrix.language}}"

‎.github/workflows/release.yaml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
name: "Release"
2+
3+
permissions:
4+
contents: read
5+
checks: read
6+
7+
concurrency:
8+
group: release
9+
cancel-in-progress: false
10+
11+
on:
12+
workflow_dispatch:
13+
inputs:
14+
version:
15+
description: tag the latest commit on main with the given version (prefixed with v)
16+
required: true
17+
18+
jobs:
19+
20+
version-available:
21+
uses: anchore/workflows/.github/workflows/check-version-available.yaml@4f25313f96311410cad4173f74617654a3e46d48 # v0.3.0
22+
with:
23+
version: ${{ github.event.inputs.version }}
24+
25+
check-gate:
26+
uses: anchore/workflows/.github/workflows/check-gate.yaml@4f25313f96311410cad4173f74617654a3e46d48 # v0.3.0
27+
with:
28+
checks: '["Static analysis", "Unit tests"]'
29+
30+
release:
31+
needs: [check-gate, version-available]
32+
environment: release
33+
runs-on: ubuntu-24.04
34+
permissions:
35+
contents: write
36+
steps:
37+
# setup checkout, go, go-make, binny, and cache go modules
38+
- uses: anchore/go-make/.github/actions/setup@1747ccaf5ab9a24fc6beaff2c4665007fe656462 # dev branch!
39+
40+
- name: Create release
41+
env:
42+
GITHUB_TOKEN: ${{ github.token }}
43+
DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
44+
RELEASE_VERSION: ${{ github.event.inputs.version }}
45+
run: make ci-release

‎.github/workflows/validate-github-actions.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,5 @@ jobs:
2828
- name: "Run zizmor"
2929
uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
3030
with:
31-
# there is a pass/fail gate as a repo ruleset (if there is no ruleset configured then the action will pass by default)
3231
advanced-security: true
3332
inputs: .github

‎.github/workflows/validations.yaml‎

Lines changed: 6 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -9,82 +9,26 @@ on:
99
permissions:
1010
contents: read
1111

12-
env:
13-
GO_VERSION: "1.24.x"
14-
GO_CACHE_KEY: efa04b89c1b1
15-
1612
jobs:
1713

1814
Static-Analysis:
15+
# Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
1916
name: "Static analysis"
2017
runs-on: ubuntu-24.04
21-
permissions:
22-
contents: read
2318
steps:
24-
- uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
25-
with:
26-
go-version: ${{ env.GO_VERSION }}
27-
28-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
29-
with:
30-
persist-credentials: false
31-
32-
- name: Restore tool cache
33-
id: tool-cache
34-
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
35-
with:
36-
path: ${{ github.workspace }}/.tmp
37-
key: ${{ runner.os }}-tool-${{ hashFiles('Makefile') }}
38-
39-
- name: Restore go cache
40-
id: go-cache
41-
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
42-
with:
43-
path: ~/go/pkg/mod
44-
key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-${{ env.GO_CACHE_KEY }}-${{ hashFiles('**/go.sum') }}
45-
restore-keys: |
46-
${{ runner.os }}-go-${{ env.GO_VERSION }}-${{ env.GO_CACHE_KEY }}-
47-
48-
- name: (cache-miss) Bootstrap all project dependencies
49-
if: steps.tool-cache.outputs.cache-hit != 'true' || steps.go-cache.outputs.cache-hit != 'true'
50-
run: make bootstrap
19+
# setup checkout, go, go-make, binny, and cache go modules
20+
- uses: anchore/go-make/.github/actions/setup@1747ccaf5ab9a24fc6beaff2c4665007fe656462 # dev branch!
5121

5222
- name: Run static analysis
5323
run: make static-analysis
5424

5525
Unit-Test:
26+
# Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
5627
name: "Unit tests"
5728
runs-on: ubuntu-24.04
58-
permissions:
59-
contents: read
6029
steps:
61-
- uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
62-
with:
63-
go-version: ${{ env.GO_VERSION }}
64-
65-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
66-
with:
67-
persist-credentials: false
68-
69-
- name: Restore tool cache
70-
id: tool-cache
71-
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
72-
with:
73-
path: ${{ github.workspace }}/.tmp
74-
key: ${{ runner.os }}-tool-${{ hashFiles('Makefile') }}
75-
76-
- name: Restore go cache
77-
id: go-cache
78-
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
79-
with:
80-
path: ~/go/pkg/mod
81-
key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-${{ env.GO_CACHE_KEY }}-${{ hashFiles('**/go.sum') }}
82-
restore-keys: |
83-
${{ runner.os }}-go-${{ env.GO_VERSION }}-${{ env.GO_CACHE_KEY }}-
84-
85-
- name: (cache-miss) Bootstrap all project dependencies
86-
if: steps.tool-cache.outputs.cache-hit != 'true' || steps.go-cache.outputs.cache-hit != 'true'
87-
run: make bootstrap
30+
# setup checkout, go, go-make, binny, and cache go modules
31+
- uses: anchore/go-make/.github/actions/setup@1747ccaf5ab9a24fc6beaff2c4665007fe656462 # dev branch!
8832

8933
- name: Run unit tests
9034
run: make unit

‎.gitignore‎

Lines changed: 16 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,23 @@
1+
# IDE
2+
.server/
3+
.vscode/
4+
.history/
5+
.idea/
6+
7+
# local development
18
go.work
29
go.work.sum
10+
/specs
11+
mise.toml
312

4-
/example
13+
# releases
514
CHANGELOG.md
15+
VERSION
616
/test/results
717
/dist
818
/snapshot
9-
.server/
10-
.vscode/
11-
.history/
19+
20+
# assets
1221
*.fingerprint
1322
*.tar
1423
*.jar
@@ -17,10 +26,10 @@ CHANGELOG.md
1726
*.jpi
1827
*.hpi
1928
*.zip
20-
.idea/
2129
*.log
2230
.images
2331
.tmp/
32+
.tool/
2433
coverage.txt
2534
bin/
2635

@@ -40,4 +49,5 @@ bin/
4049
# macOS Finder metadata
4150
.DS_STORE
4251

43-
*.profile
52+
*.profile
53+

0 commit comments

Comments
 (0)