fv-go/.github/workflows/ci.yml at main · oldwired/fv-go · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
name: ci
on:
  # Tag pushes are excluded here — release.yml invokes this workflow
  # via workflow_call against the tagged commit, so letting push fire
  # on tags too would run every CI job twice for each tag.
  push:
    branches: ['**']
  pull_request:
  workflow_call:

# Minimal-by-default token scope. Every job in this workflow only
# needs to read repo contents (checkout, run tests, fetch deps).
# Explicit permissions block prevents GITHUB_TOKEN from inheriting
# broader rights from repo/org defaults — CodeQL flags this and it
# is correct.
permissions:
  contents: read

jobs:
  test:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
      - run: go build ./...

      # Vet split into two steps so the unsafeptr false-positive in the
      # conpty bridge (uintptr → unsafe.Pointer for PROC_THREAD_ATTRIBUTE_
      # PSEUDOCONSOLE, Microsoft's documented pattern) can be suppressed
      # without weakening checks anywhere else.
      - name: vet (every package except the conpty bridge)
        shell: bash
        run: |
          pkgs=$(go list ./... | grep -v '/internal/conpty')
          go vet $pkgs
      - name: vet conpty (unsafeptr disabled for kernel-handle conversion)
        if: matrix.os == 'windows-latest'
        run: go vet -unsafeptr=false ./pkg/fv/widgets/terminal/internal/conpty/...

      - run: go test ./...

  race:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
      - run: go test -race ./pkg/fv/...

  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod

      # gofmt is non-fatal in go itself but a hard fail here — any
      # unformatted file leaves a noisy diff for future contributors.
      - name: gofmt
        run: |
          diff=$(gofmt -l -d .)
          if [ -n "$diff" ]; then
            echo "$diff"
            echo
            echo "Files above are not gofmt-clean. Run 'gofmt -w .' locally."
            exit 1
          fi

      - name: golangci-lint
        # golangci-lint-action v7+ is required for golangci-lint v2.x;
        # v6 only supports v1.x and rejects "v2.*" version strings.
        uses: golangci/golangci-lint-action@v7
        with:
          version: v2.12.2

  vuln:
    runs-on: ubuntu-latest
    steps:
      # govulncheck-action handles checkout + Go install internally
      # (repo-checkout: true is the default, and the action runs its
      # own setup-go). Running our own actions/checkout@v6 here would
      # leave behind credentials from v6's new file-based persistence
      # mechanism that conflict with the action's internal
      # actions/checkout@v4.1.1 — git ends up sending two
      # Authorization headers and the fetch fails with HTTP 400.
      - name: govulncheck
        uses: golang/govulncheck-action@v1
        with:
          go-version-file: go.mod
          go-package: ./...