Credit v0.3.12 contributors by GitHub handle #176
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| # Cancel an in-flight run when a branch is pushed again. | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # Build and test on Linux and macOS with the race detector on. gofmt and vet | |
| # run here too so a formatting slip fails fast on both platforms. The full | |
| # suite includes Chrome-driven end-to-end tests, so the runners install a | |
| # browser first; tests that find none skip themselves, so the job still passes | |
| # if a future runner image drops Chrome. | |
| test: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@v7.0.0 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version-file: go.mod | |
| check-latest: true | |
| cache: true | |
| - name: install chromium (linux) | |
| if: matrix.os == 'ubuntu-latest' | |
| uses: browser-actions/setup-chrome@v2.1.2 | |
| id: chrome | |
| - name: gofmt | |
| run: | | |
| unformatted=$(gofmt -s -l .) | |
| if [ -n "$unformatted" ]; then | |
| echo "These files need gofmt -s -w:" | |
| echo "$unformatted" | |
| exit 1 | |
| fi | |
| - name: go vet | |
| run: go vet ./... | |
| - name: build | |
| run: go build ./... | |
| # The GitHub Ubuntu runner disables unprivileged user namespaces (AppArmor), | |
| # so Chrome's sandbox cannot initialize there and the secure default would | |
| # make it refuse to start. IN_DOCKER is kage's documented escape hatch for | |
| # exactly that case, and setting it here also exercises the container path. | |
| # macOS does not need it, so it stays empty on that leg. | |
| - name: test | |
| env: | |
| KAGE_CHROME: ${{ steps.chrome.outputs.chrome-path }} | |
| IN_DOCKER: ${{ matrix.os == 'ubuntu-latest' && '1' || '' }} | |
| run: go test -race -count=1 -coverprofile=coverage.out ./... | |
| - name: coverage summary | |
| if: matrix.os == 'ubuntu-latest' | |
| run: go tool cover -func=coverage.out | tail -1 | |
| # golangci-lint bundles staticcheck, govet, ineffassign, errcheck, unused and | |
| # more, so it is the main quality gate. | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7.0.0 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version-file: go.mod | |
| check-latest: true | |
| cache: true | |
| - uses: golangci/golangci-lint-action@v9.2.1 | |
| with: | |
| version: latest | |
| # Scan the module and its dependencies for known vulnerabilities. | |
| govulncheck: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7.0.0 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version-file: go.mod | |
| check-latest: true | |
| cache: true | |
| - name: govulncheck | |
| run: | | |
| go install golang.org/x/vuln/cmd/govulncheck@latest | |
| govulncheck ./... | |
| # Confirm go.mod and go.sum are tidy: a PR that adds an import without running | |
| # go mod tidy fails here instead of breaking a later release. | |
| tidy: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7.0.0 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version-file: go.mod | |
| check-latest: true | |
| cache: true | |
| - name: go mod tidy is clean | |
| run: | | |
| go mod tidy | |
| git diff --exit-code -- go.mod go.sum | |
| # `go install module/package@version` rejects dependency-changing replace | |
| # directives. Issue #72 shipped one accidentally while removing leakless. | |
| - name: module supports versioned go install | |
| run: | | |
| if ! go mod edit -json | grep -q '"Replace": null'; then | |
| echo "go.mod contains a replace directive; versioned go install will fail" | |
| exit 1 | |
| fi | |
| # Compile the optional native-window viewer (-tags webview, cgo) so that path | |
| # keeps building. The default CI build is pure Go and never touches it. The | |
| # viewer code is the same Go on every OS, only the system WebView library | |
| # differs, so a macOS compile (WebKit ships in the SDK) catches our | |
| # regressions without the WebKitGTK version juggling Linux runners need. It is | |
| # build-only: actually opening a window needs a display. | |
| webview: | |
| runs-on: macos-latest | |
| steps: | |
| - uses: actions/checkout@v7.0.0 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version-file: go.mod | |
| check-latest: true | |
| cache: true | |
| - name: build webview viewer | |
| run: CGO_ENABLED=1 go build -tags webview ./cmd/kage | |
| # Cross-compile the GUI-subsystem Windows base the release ships for | |
| # double-click viewers (kage pack --base). A change that breaks the | |
| # -H windowsgui link is caught here instead of at release time. Pure Go, so it | |
| # cross-compiles from Linux with no extra toolchain. | |
| windows-gui: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7.0.0 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version-file: go.mod | |
| check-latest: true | |
| cache: true | |
| - name: build windowsgui base | |
| env: | |
| GOOS: windows | |
| CGO_ENABLED: "0" | |
| run: | | |
| go build -ldflags "-H=windowsgui" -o kage-windowsgui.exe ./cmd/kage | |
| go list -deps ./cmd/kage > windows-deps.txt | |
| if grep -qx github.com/ysmood/leakless windows-deps.txt; then | |
| echo "Windows build imports leakless; its embedded helper triggers Defender" | |
| exit 1 | |
| fi | |
| go tool nm kage-windowsgui.exe > windows-symbols.txt | |
| if grep -q github.com/ysmood/leakless windows-symbols.txt; then | |
| echo "Windows binary contains leakless symbols" | |
| exit 1 | |
| fi |