refactor: build gro on the shared google-cli-common module #248
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| # Standard keyring opt-out tags (cli-common working-with-secrets.md §1.10). | |
| env: | |
| GOFLAGS: -tags=keyring_no1password,keyring_nopassage | |
| jobs: | |
| build-platform: # OS matrix — NOT a required check | |
| name: build (${{ matrix.os }}) | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: open-cli-collective/.github/actions/go-build@v1 | |
| with: | |
| go-version-file: go.mod | |
| build: # required aggregate — stable bare name | |
| needs: [build-platform] | |
| if: ${{ always() }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| # Fail only on a real failure/cancellation; a skipped leg must NOT fail | |
| # the gate (which `== 'success'` would do). | |
| - if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }} | |
| run: echo "::error::a build-platform leg failed or was cancelled" && exit 1 | |
| # Preserve the pre-migration `make tidy test build` tidy gate: `make tidy` runs | |
| # `go mod tidy && git diff --exit-code go.mod go.sum`, failing a PR whose module | |
| # files aren't tidy. The go-build/go-test composites don't tidy, so this stays. | |
| tidy: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: go.mod | |
| - run: make tidy | |
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: open-cli-collective/.github/actions/go-test@v1 | |
| with: | |
| go-version-file: go.mod | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: open-cli-collective/.github/actions/go-lint@v1 | |
| with: | |
| go-version-file: go.mod | |
| # Regression sentinel (preserved): the shared go-build@v1 matrix legs build with | |
| # default CGO and would NOT catch a static-linux regression. This cross-compiles | |
| # the release targets CGO-off and asserts the static build graph never pulls in | |
| # the 1Password/keyring stack. Kept required to preserve its blocking semantics. | |
| static-release-guard: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: go.mod | |
| - name: Static release build guard | |
| run: | | |
| set -euo pipefail | |
| for target in linux/amd64 linux/arm64 windows/amd64 windows/arm64; do | |
| goos="${target%/*}" | |
| goarch="${target#*/}" | |
| CGO_ENABLED=0 GOOS="$goos" GOARCH="$goarch" \ | |
| go build -o "$RUNNER_TEMP/gro-$goos-$goarch" ./cmd/gro | |
| done | |
| for goarch in amd64 arm64; do | |
| deps=$(CGO_ENABLED=0 GOOS=linux GOARCH="$goarch" go list -deps ./cmd/gro) | |
| if printf '%s\n' "$deps" | grep -E '^(github.com/byteness/keyring|github.com/1password/onepassword-sdk-go)(/|$)'; then | |
| echo "static Linux gro $goarch build graph must not include byteness/keyring or onepassword-sdk-go" | |
| exit 1 | |
| fi | |
| done | |
| # Preserve gro's opt-in coverage floor (ci.md §6): `make test-cover-check` runs | |
| # the suite with -race + coverage and fails below the 60% threshold. Kept as its | |
| # own required check so the floor stays blocking (not advisory). | |
| coverage: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: go.mod | |
| - run: make test-cover-check | |
| identity-check: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: open-cli-collective/.github/actions/identity-check@v1 # distribution.md §8.2 | |
| pr-title: | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: open-cli-collective/.github/actions/pr-title@v1 | |
| with: | |
| title: ${{ github.event.pull_request.title }} |