AetherCode-Execution-Engine/.github/workflows/ci.yml at development · stjosephsplacements/AetherCode-Execution-Engine · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
name: CI

# Every promotion (development -> production) is a PR that must be green on
# CI. CI also runs on direct pushes to each branch.
on:
  push:
    branches:
      - development
      - production
      - "feature/**"
      - "fix/**"
      - "security/**"
      - "ci/**"
      - "docs/**"
      - "chore/**"
      - "refactor/**"
  pull_request:

# The engine is audited-by-default: this is a code-execution service, so the
# PR pipeline is the main line of defense.
permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: true

      - name: Module tidy check
        run: |
          go mod tidy
          git diff --exit-code -- go.mod go.sum

      - name: Build
        run: go build ./...

      - name: Vet
        run: go vet ./...

      - name: Format check
        run: |
          unformatted="$(gofmt -s -l .)"
          if [ -n "$unformatted" ]; then
            echo "::error::The following files are not gofmt-clean:"
            echo "$unformatted"
            gofmt -s -d $unformatted
            exit 1
          fi

      # Unit tests are hermetic (the rate limiter uses an in-process
      # miniredis), so no external services are required here.
      - name: Test (race detector + coverage)
        run: go test -race -count=1 -timeout=120s -coverprofile=coverage.out -covermode=atomic ./...

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v5
        with:
          files: coverage.out
          flags: unit
          fail_ci_if_error: false

  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: true

      - name: golangci-lint
        uses: golangci/golangci-lint-action@v9
        with:
          version: v2.15.0
          args: --timeout=5m

  codeql:
    name: CodeQL Analysis
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v7

      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version-file: go.mod
          cache: true

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: go
          queries: security-extended,security-and-quality

      - name: Build for CodeQL
        run: go build ./...

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: /language:go
          upload-database: false