moto/.github/workflows/ci.yml at main · cppla/moto · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
name: CI

on:
  push:
  pull_request:

permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: 1.27.3
          cache: true
          cache-dependency-path: go.sum
      - name: Check formatting
        run: make fmt-check
      - name: Validate workflows
        run: make workflow-check
      - name: Check release packaging
        run: make release-check
      - name: Verify modules
        run: make mod-check
      - name: Verify managed dependency baselines
        run: make dependency-boundary-check
      - name: Test
        run: make test
      - name: Check transport regression
        run: make transport-regression-check
      - name: Vet
        run: make vet
      - name: Static analysis
        run: make staticcheck
      - name: Test with race detector
        run: make race
      - name: Stress routing, reload, and fault transitions
        run: make fault-test
      - name: Check reachable vulnerabilities
        run: make vuln
      - name: Query original upstream vulnerability advisories
        if: always()
        run: make upstream-vuln
      - name: Retain upstream advisory evidence
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: upstream-advisories
          path: bin/security-advisories/
          if-no-files-found: error
          retention-days: 30
      - name: Validate sample config
        run: make config-check
      - name: Check container context and final image
        run: make container-image-check
      - name: Check benchmark script syntax
        run: make bench-check
      - name: Run loopback-only benchmark smoke
        run: make bench-smoke

  routing-regression:
    name: Routing regression (${{ matrix.os }})
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-24.04, macos-latest]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: 1.27.3
          cache: true
          cache-dependency-path: go.sum
      - name: Validate the regression gate
        run: python3 -B test/routing_regression_test.py
      - name: Verify Boost, cache, health, and recovery regressions
        run: make routing-regression
        env:
          REGRESSION_SEED: ${{ github.run_id }}
      - name: Retain regression evidence
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: routing-regression-${{ matrix.os }}
          path: bin/routing-regression/
          if-no-files-found: error
          retention-days: 14

  build:
    strategy:
      matrix:
        include:
          - os: ubuntu-latest
            goos: linux
            goarch: amd64
          - os: ubuntu-latest
            goos: linux
            goarch: arm64
          - os: macos-latest
            goos: darwin
            goarch: arm64
          - os: windows-latest
            goos: windows
            goarch: amd64
    runs-on: ${{ matrix.os }}
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: 1.27.3
          cache: true
          cache-dependency-path: go.sum
      - run: go build -trimpath -buildvcs=false ./...
        env:
          CGO_ENABLED: "0"
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}