Skip to content

Commit bc9362f

Browse files
maksym-iv-efmaksym-iv-ef
authored
feat: Initial commit (#1)
* feat: Initial * feat: Add standard GO checks workflow * wip: Testing tags * wip: Testing tags
1 parent 6a9db9a commit bc9362f

5 files changed

Lines changed: 310 additions & 0 deletions

File tree

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# Description
2+
<!--
3+
Not mandatory, don't copy/paste PR name here if it doest not make sense.
4+
Short/Long description of the PR
5+
-->
6+
7+
# Changes summary
8+
<!--
9+
Not mandatory, but helpful if PR is big enough.
10+
Summary for the changes done in this PR. Using bullet list is a good idea.
11+
* [CHORE] change1
12+
* [FEAT] change1
13+
* [FIX] change1
14+
-->

‎.github/renovate.json‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{
2+
"dependencyDashboard": true,
3+
"automerge": false,
4+
"extends": [
5+
"config:recommended"
6+
],
7+
"schedule": [
8+
"before 4am on the first day of the month"
9+
],
10+
"reviewers": [
11+
"team:ops"
12+
],
13+
"terraform": {
14+
"rangeStrategy": "bump"
15+
}
16+
}

‎.github/workflows/release_tag.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
name: Release tag
2+
concurrency:
3+
group: release-tag-${{ github.ref }}
4+
on:
5+
push:
6+
branches:
7+
- main
8+
- initial
9+
10+
jobs:
11+
release_tag:
12+
name: Release a tag
13+
permissions:
14+
contents: write
15+
uses: ./.github/workflows/reusable_release_tag.yml
16+
with:
17+
push_major_tag: true

‎.github/workflows/reusable_go_checks.yml‎

Lines changed: 191 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,191 @@
1+
on:
2+
workflow_call:
3+
inputs:
4+
gosec_args:
5+
type: string
6+
default: "-severity high -exclude-dir examples -exclude=G115 ./..."
7+
description: "gosec tool command line arguments"
8+
semgrep_cmd:
9+
type: string
10+
default: "semgrep scan --config auto --error"
11+
description: "Semgrep command to run"
12+
unit_test_cmd:
13+
type: string
14+
default: "make test"
15+
description: "Golang unit test command to run"
16+
unit_test_report_coverage_cmd:
17+
type: string
18+
default: "make report-coverage"
19+
description: "Command to report the unit tests coverage"
20+
unit_test_runs-on:
21+
type: string
22+
default: ubuntu-latest
23+
description: "GHA runner for the Unit Test job (ubuntu-latest, ubuntu-latest-4c, ubuntu-latest-8c)"
24+
integration_test_enabled:
25+
type: boolean
26+
default: false
27+
description: "Golang integration test command to run"
28+
integration_test_cmd:
29+
type: string
30+
default: "make test-integration"
31+
description: "Golang integration test command to run"
32+
integration_test_runs-on:
33+
type: string
34+
default: ubuntu-latest
35+
description: "GHA runner for the Integration Test job (ubuntu-latest, ubuntu-latest-4c, ubuntu-latest-8c)"
36+
runs-on:
37+
type: string
38+
default: ubuntu-latest
39+
description: "GHA runner for the job (ubuntu-latest, ubuntu-latest-4c, ubuntu-latest-8c)"
40+
timeout-minutes:
41+
type: number
42+
default: 10
43+
description: "Job timeout in minutes"
44+
go_version_file:
45+
type: string
46+
default: 'go.mod'
47+
description: "Go version file to use"
48+
sonarcloud_run:
49+
type: boolean
50+
default: false
51+
description: "If true, run a SonarCloud scan after unit tests complete"
52+
sonarcloud_project_key:
53+
type: string
54+
default: ""
55+
description: "SonarCloud project key"
56+
sonarcloud_org:
57+
type: string
58+
default: "elastiflow"
59+
description: "SonarCloud organization"
60+
secrets:
61+
go_dependency_fetcher_token:
62+
required: false
63+
description: "GitHub token with read access to the Golang dependency repositories"
64+
git_ssh_key:
65+
required: false
66+
description: "Git ssh key with access to ElastiFlow repositories"
67+
sonarcloud_token:
68+
required: false
69+
description: "SonarCloud token (required if sonarcloud_run is true)"
70+
71+
jobs:
72+
go-mod-tidy:
73+
name: 'go-mod-tidy'
74+
runs-on: ${{ inputs.runs-on }}
75+
timeout-minutes: ${{ inputs.timeout-minutes }}
76+
steps:
77+
- name: Checkout
78+
uses: actions/checkout@v4
79+
- name: Setup Go
80+
uses: actions/setup-go@v5
81+
with:
82+
go-version-file: ${{ inputs.go_version_file }}
83+
- name: Run Tidy
84+
run: |
85+
find . -type f -name 'go.mod' | while read -r svc; do
86+
cd $(dirname "${svc}");
87+
echo "In $(pwd)";
88+
go mod tidy;
89+
cd -;
90+
done
91+
git diff --exit-code
92+
goimports:
93+
name: 'goimports'
94+
runs-on: ${{ inputs.runs-on }}
95+
timeout-minutes: ${{ inputs.timeout-minutes }}
96+
steps:
97+
- name: Checkout
98+
uses: actions/checkout@v4
99+
- name: Setup Go
100+
uses: actions/setup-go@v5
101+
with:
102+
go-version-file: ${{ inputs.go_version_file }}
103+
- name: Run goimports
104+
run: |
105+
go install golang.org/x/tools/cmd/goimports@latest
106+
goimports -l -w ./
107+
git diff --exit-code
108+
staticcheck:
109+
name: 'staticcheck'
110+
runs-on: ${{ inputs.runs-on }}
111+
timeout-minutes: ${{ inputs.timeout-minutes }}
112+
steps:
113+
- name: Checkout
114+
uses: actions/checkout@v4
115+
- name: Setup Go
116+
uses: actions/setup-go@v5
117+
with:
118+
go-version-file: ${{ inputs.go_version_file }}
119+
- name: Run Staticcheck
120+
run: |
121+
go install honnef.co/go/tools/cmd/staticcheck@latest
122+
find . -type f -name 'go.mod' | while read -r svc; do
123+
cd $(dirname "${svc}");
124+
echo "In $(pwd)";
125+
staticcheck ./...;
126+
cd -;
127+
done
128+
gosec:
129+
name: 'gosec'
130+
runs-on: ${{ inputs.runs-on }}
131+
timeout-minutes: ${{ inputs.timeout-minutes }}
132+
steps:
133+
- name: Checkout
134+
uses: actions/checkout@v4
135+
- name: Setup Go
136+
uses: actions/setup-go@v5
137+
with:
138+
go-version-file: ${{ inputs.go_version_file }}
139+
- name: Security Scan
140+
uses: securego/gosec@v2.22.5
141+
with:
142+
args: ${{ inputs.gosec_args }}
143+
semgrep:
144+
name: 'semgrep scan'
145+
runs-on: ${{ inputs.runs-on }}
146+
timeout-minutes: ${{ inputs.timeout-minutes }}
147+
container:
148+
image: returntocorp/semgrep
149+
steps:
150+
- name: Checkout
151+
uses: actions/checkout@v4
152+
- name: semgrep scan
153+
run: ${{ inputs.semgrep_cmd }}
154+
unit_test:
155+
name: 'unit test'
156+
runs-on: ${{ inputs.unit_test_runs-on }}
157+
timeout-minutes: ${{ inputs.timeout-minutes }}
158+
steps:
159+
- name: Checkout
160+
uses: actions/checkout@v4
161+
with:
162+
fetch-depth: 0
163+
- name: Setup Go
164+
uses: actions/setup-go@v5
165+
with:
166+
go-version-file: ${{ inputs.go_version_file }}
167+
- name: Run tests
168+
run: ${{ inputs.unit_test_cmd }}
169+
- name: Report coverage
170+
if: always()
171+
run: |
172+
echo "Coverage:" >> ${GITHUB_STEP_SUMMARY}
173+
echo '```' >> ${GITHUB_STEP_SUMMARY}
174+
${{ inputs.unit_test_report_coverage_cmd }} >> ${GITHUB_STEP_SUMMARY}
175+
echo '```' >> ${GITHUB_STEP_SUMMARY}
176+
integration_test:
177+
name: 'integration test'
178+
if: ${{ inputs.integration_test_enabled }}
179+
runs-on: ${{ inputs.integration_test_runs-on }}
180+
timeout-minutes: ${{ inputs.timeout-minutes }}
181+
steps:
182+
- name: Checkout
183+
uses: actions/checkout@v4
184+
with:
185+
fetch-depth: 0
186+
- name: Setup Go
187+
uses: actions/setup-go@v5
188+
with:
189+
go-version-file: ${{ inputs.go_version_file }}
190+
- name: Run tests
191+
run: ${{ inputs.integration_test_cmd }}

‎.github/workflows/reusable_release_tag.yml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
on:
2+
workflow_call:
3+
inputs:
4+
tag_prefix:
5+
type: string
6+
default: "v"
7+
description: "Prefix to prepend to the tag"
8+
tag_suffix:
9+
type: string
10+
default: ""
11+
description: "Suffix to append to the tag, useful for RC releases, etc"
12+
push_minor_tag:
13+
type: boolean
14+
default: false
15+
description: "If true, push a major tag (vX.Y) in addition to the semver tag"
16+
push_major_tag:
17+
type: boolean
18+
default: false
19+
description: "If true, push a major tag (vX) in addition to the semver tag"
20+
secrets:
21+
custom_github_token:
22+
required: false
23+
description: "Token for the repo, useful when tag release event needs to trigger another workflow in the same repo"
24+
outputs:
25+
version:
26+
description: The version string generated by action
27+
value: ${{ jobs.release_tag.outputs.version }}
28+
version_tag:
29+
description: String identifier that would be used to tag the current commit as the "released" version. Typically this would only be used to generate a Git tag name
30+
value: ${{ jobs.release_tag.outputs.version_tag }}
31+
32+
env:
33+
TAG_SUFFIX_DELIMITER: ${{ inputs.tag_suffix && '-' || ''}}
34+
35+
jobs:
36+
release_tag:
37+
name: release a tag
38+
runs-on: ubuntu-latest
39+
outputs:
40+
version: ${{ steps.semver.outputs.version }}
41+
version_tag: ${{ steps.semver.outputs.version_tag }}
42+
steps:
43+
- uses: actions/checkout@v4
44+
with:
45+
fetch-depth: 0
46+
- name: Bump semver
47+
id: semver
48+
uses: paulhatch/semantic-version@v5.4.0
49+
with:
50+
tag_prefix: ${{ inputs.tag_prefix }}
51+
namespace: ${{ inputs.tag_suffix }}
52+
- name: Create and push semver tag
53+
uses: anothrNick/github-tag-action@v1
54+
env:
55+
GITHUB_TOKEN: ${{ secrets.custom_github_token || secrets.GITHUB_TOKEN }}
56+
CUSTOM_TAG: ${{ steps.semver.outputs.version_tag }}
57+
- name: Create and push minor tag
58+
if: ${{ inputs.push_minor_tag }}
59+
uses: anothrNick/github-tag-action@v1
60+
env:
61+
GITHUB_TOKEN: ${{ secrets.custom_github_token || secrets.GITHUB_TOKEN }}
62+
FORCE_WITHOUT_CHANGES: true
63+
GIT_API_TAGGING: false # not using API causes force push, which is needed to overwrite existing tag
64+
CUSTOM_TAG: "${{ inputs.tag_prefix }}${{ steps.semver.outputs.major }}.${{ steps.semver.outputs.minor }}${{ env.TAG_SUFFIX_DELIMITER }}${{ inputs.tag_suffix }}"
65+
- name: Create and push major tag
66+
if: ${{ inputs.push_major_tag }}
67+
uses: anothrNick/github-tag-action@v1
68+
env:
69+
GITHUB_TOKEN: ${{ secrets.custom_github_token || secrets.GITHUB_TOKEN }}
70+
FORCE_WITHOUT_CHANGES: true
71+
GIT_API_TAGGING: false # not using API causes force push, which is needed to overwrite existing tag
72+
CUSTOM_TAG: "${{ inputs.tag_prefix }}${{ steps.semver.outputs.major }}${{ env.TAG_SUFFIX_DELIMITER }}${{ inputs.tag_suffix }}"

0 commit comments

Comments
 (0)