Skip to content

Final launch gate: CI hardening, log safety, full test coverage, shell completions #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vtino17 merged 6 commits into from
Jul 23, 2026
Merged

Final launch gate: CI hardening, log safety, full test coverage, shell completions #7

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
66ba432
ci: align all workflows with go.mod via go-version-file
vtino17 Jul 23, 2026
f6001a2
fix: signal 0 for process existence check, strengthen lifecycle tests…
vtino17 Jul 23, 2026
8196edd
fix: use Go helper-process pattern for process tests instead of exec.…
vtino17 Jul 23, 2026
906fa62
fix: increase helper process wait times, fix gofmt trailing newlines
vtino17 Jul 23, 2026
f3b0f7d
fix: use flexible grep patterns for archive content verification (REA…
vtino17 Jul 23, 2026
c10b9e2
chore: remove dead internal/doctor package, update audit with CI evid…
vtino17 Jul 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
92 changes: 53 additions & 39 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,12 +18,8 @@ jobs:
- uses: actions/setup-go@v5
with:
go-version-file: go.mod
- uses: actions/cache@v4
with:
path: ~/go/pkg/mod
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
restore-keys: |
${{ runner.os }}-go-
cache: true
cache-dependency-path: go.sum
- run: test -z "$(gofmt -l .)"
- run: go vet ./...

Expand All @@ -34,13 +30,9 @@ jobs:
- uses: actions/setup-go@v5
with:
go-version-file: go.mod
- uses: actions/cache@v4
with:
path: ~/go/pkg/mod
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
restore-keys: |
${{ runner.os }}-go-
- run: go test ./...
cache: true
cache-dependency-path: go.sum
- run: go test ./... -timeout 15m

race:
runs-on: ubuntu-latest
Expand All @@ -49,13 +41,9 @@ jobs:
- uses: actions/setup-go@v5
with:
go-version-file: go.mod
- uses: actions/cache@v4
with:
path: ~/go/pkg/mod
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
restore-keys: |
${{ runner.os }}-go-
- run: go test -race ./... -timeout 15m
cache: true
cache-dependency-path: go.sum
- run: go test -race ./... -timeout 20m

build:
runs-on: ubuntu-latest
Expand All @@ -64,12 +52,8 @@ jobs:
- uses: actions/setup-go@v5
with:
go-version-file: go.mod
- uses: actions/cache@v4
with:
path: ~/go/pkg/mod
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
restore-keys: |
${{ runner.os }}-go-
cache: true
cache-dependency-path: go.sum
- run: go build ./...

integration:
Expand All @@ -79,13 +63,9 @@ jobs:
- uses: actions/setup-go@v5
with:
go-version-file: go.mod
- uses: actions/cache@v4
with:
path: ~/go/pkg/mod
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
restore-keys: |
${{ runner.os }}-go-
- run: go test -tags=integration ./test/integration/... -timeout 15m
cache: true
cache-dependency-path: go.sum
- run: go test -tags=integration ./test/integration/... -timeout 20m

integration-race:
runs-on: ubuntu-latest
Expand All @@ -94,10 +74,44 @@ jobs:
- uses: actions/setup-go@v5
with:
go-version-file: go.mod
- uses: actions/cache@v4
cache: true
cache-dependency-path: go.sum
- run: go test -race -tags=integration ./test/integration/... -timeout 25m

release-dry-run:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-go@v5
with:
go-version-file: go.mod
cache: true
cache-dependency-path: go.sum
- name: Run release packaging dry-run
run: |
chmod +x scripts/build-release-artifacts.sh
VERSION=0.0.0-dry-run COMMIT=DRY-RUN BUILD_DATE=$(date -u +%Y-%m-%d) \
./scripts/build-release-artifacts.sh ./dist
- name: Verify archives
run: |
set -euo pipefail
cd dist
for f in \
taskcapsule_0.0.0-dry-run_linux_amd64.tar.gz \
taskcapsule_0.0.0-dry-run_linux_arm64.tar.gz \
taskcapsule_0.0.0-dry-run_darwin_amd64.tar.gz \
taskcapsule_0.0.0-dry-run_darwin_arm64.tar.gz \
taskcapsule_0.0.0-dry-run_windows_amd64.zip; do
test -f "$f" || { echo "Missing: $f"; exit 1; }
echo "Found: $f"
done
tar tzf taskcapsule_0.0.0-dry-run_linux_amd64.tar.gz | grep -E "(^|/)LICENSE" > /dev/null || { echo "LICENSE missing in linux amd64"; tar tzf taskcapsule_0.0.0-dry-run_linux_amd64.tar.gz | head -5; exit 1; }
tar tzf taskcapsule_0.0.0-dry-run_linux_amd64.tar.gz | grep -E "(^|/)README" > /dev/null || { echo "README missing in linux amd64"; tar tzf taskcapsule_0.0.0-dry-run_linux_amd64.tar.gz | head -10; exit 1; }
unzip -l taskcapsule_0.0.0-dry-run_windows_amd64.zip | grep -q "taskcapsule.exe" || { echo "taskcapsule.exe missing"; exit 1; }
test -f checksums.txt || { echo "checksums.txt missing"; exit 1; }
sha256sum -c checksums.txt || { echo "Checksum verification failed"; exit 1; }
echo "All archives valid"
- uses: actions/upload-artifact@v4
with:
path: ~/go/pkg/mod
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
restore-keys: |
${{ runner.os }}-go-
- run: go test -race -tags=integration ./test/integration/... -timeout 20m
name: release-dry-run
path: dist/*
173 changes: 124 additions & 49 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,79 +4,88 @@ on:
push:
tags:
- 'v*'
workflow_dispatch:
inputs:
dry-run:
description: 'Build artifacts without publishing'
required: true
default: 'true'

permissions:
contents: write
contents: read

jobs:
validate:
validate-and-test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Validate tag and assets
- uses: actions/setup-go@v5
with:
go-version-file: go.mod
cache: true
cache-dependency-path: go.sum

- name: Validate tag or branch
run: |
VERSION="${{ github.ref_name }}"
echo "VERSION=$VERSION"
[[ "$VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] || { echo "Invalid tag format: $VERSION"; exit 1; }
if [[ "${{ github.event_name }}" == "push" && "${{ github.ref_type }}" == "tag" ]]; then
VERSION="${{ github.ref_name }}"
[[ "$VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] || { echo "Invalid tag format: $VERSION"; exit 1; }
fi
test -f LICENSE || { echo "LICENSE file missing"; exit 1; }
test -f README.md || { echo "README.md file missing"; exit 1; }
echo "Tag and assets validated"

- name: Format check
run: test -z "$(gofmt -l .)"

- name: Vet
run: go vet ./...

- name: Test
run: go test ./... -timeout 15m

- name: Race test
run: go test -race ./... -timeout 20m

- name: Integration test
run: go test -tags=integration ./test/integration/... -timeout 20m

- name: Build all
run: go build ./...

- name: Verify module
run: go mod verify

build:
needs: [validate]
needs: [validate-and-test]
if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
runs-on: ubuntu-latest
strategy:
matrix:
include:
- goos: linux
goarch: amd64
ext: ""
- goos: linux
goarch: arm64
ext: ""
- goos: darwin
goarch: amd64
ext: ""
- goos: darwin
goarch: arm64
ext: ""
- goos: windows
goarch: amd64
ext: ".exe"
steps:
- uses: actions/checkout@v4
- uses: actions/setup-go@v5
with:
go-version: '1.21'
go-version-file: go.mod
cache: true
cache-dependency-path: go.sum

- name: Build and package
- name: Build and package all targets
run: |
GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} go build \
-trimpath \
-ldflags "-s -w -X github.com/vtino17/taskcapsule/internal/version.Version=${GITHUB_REF_NAME#v} \
-X github.com/vtino17/taskcapsule/internal/version.Commit=$GITHUB_SHA \
-X github.com/vtino17/taskcapsule/internal/version.BuildDate=$(date -u +%Y-%m-%d)" \
-o taskcapsule${{ matrix.ext }} ./cmd/taskcapsule

artifact="taskcapsule_${GITHUB_REF_NAME#v}_${{ matrix.goos }}_${{ matrix.goarch }}"
mkdir -p "$artifact"
cp taskcapsule${{ matrix.ext }} LICENSE README.md "$artifact/"

if [ "${{ matrix.goos }}" = "windows" ]; then
cd "$artifact" && zip -q "../${artifact}.zip" taskcapsule.exe LICENSE README.md
else
tar czf "${artifact}.tar.gz" -C "$artifact" taskcapsule${{ matrix.ext }} LICENSE README.md
fi
chmod +x scripts/build-release-artifacts.sh
VERSION="${GITHUB_REF_NAME#v}" \
COMMIT="$GITHUB_SHA" \
BUILD_DATE="$(date -u +%Y-%m-%d)" \
./scripts/build-release-artifacts.sh ./dist

- name: Upload artifact
uses: actions/upload-artifact@v4
- uses: actions/upload-artifact@v4
with:
name: ${{ matrix.goos }}_${{ matrix.goarch }}
path: taskcapsule_*.tar.gz taskcapsule_*.zip
name: release-artifacts
path: dist/*

release:
needs: [build]
needs: [validate-and-test, build]
if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- uses: actions/checkout@v4
- uses: actions/download-artifact@v4
Expand All @@ -101,3 +110,69 @@ jobs:
--notes "See the [CHANGELOG](https://github.com/$GITHUB_REPOSITORY/blob/main/CHANGELOG.md) for details." \
--verify-tag \
--latest

release-dry-run:
needs: [validate-and-test]
if: github.event_name == 'workflow_dispatch'
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-go@v5
with:
go-version-file: go.mod
cache: true
cache-dependency-path: go.sum

- name: Package all targets
run: |
chmod +x scripts/build-release-artifacts.sh
VERSION=0.0.0-dry-run \
COMMIT=DRY-RUN \
BUILD_DATE=$(date -u +%Y-%m-%d) \
./scripts/build-release-artifacts.sh ./dist

- name: Verify all 5 archives exist
run: |
set -e
cd dist
for f in \
taskcapsule_0.0.0-dry-run_linux_amd64.tar.gz \
taskcapsule_0.0.0-dry-run_linux_arm64.tar.gz \
taskcapsule_0.0.0-dry-run_darwin_amd64.tar.gz \
taskcapsule_0.0.0-dry-run_darwin_arm64.tar.gz \
taskcapsule_0.0.0-dry-run_windows_amd64.zip; do
test -f "$f" || { echo "Missing: $f"; exit 1; }
echo "Found: $f"
done
echo "All 5 archives present"

- name: Verify Linux amd64 archive contents
run: |
set -euo pipefail
cd dist
tar tzf taskcapsule_0.0.0-dry-run_linux_amd64.tar.gz | grep -E "(^|/)LICENSE" > /dev/null || { echo "LICENSE missing"; tar tzf taskcapsule_0.0.0-dry-run_linux_amd64.tar.gz | head -5; exit 1; }
tar tzf taskcapsule_0.0.0-dry-run_linux_amd64.tar.gz | grep -q "README.md" || { echo "README.md missing"; exit 1; }
tar tzf taskcapsule_0.0.0-dry-run_linux_amd64.tar.gz | grep -q "taskcapsule" || { echo "binary missing"; exit 1; }
echo "Linux amd64 archive valid"

- name: Verify Windows archive contents
run: |
set -euo pipefail
cd dist
unzip -l taskcapsule_0.0.0-dry-run_windows_amd64.zip | grep -q "LICENSE" || { echo "LICENSE missing"; exit 1; }
unzip -l taskcapsule_0.0.0-dry-run_windows_amd64.zip | grep -q "README.md" || { echo "README.md missing"; exit 1; }
unzip -l taskcapsule_0.0.0-dry-run_windows_amd64.zip | grep -q "taskcapsule.exe" || { echo "taskcapsule.exe missing"; exit 1; }
echo "Windows archive valid"

- name: Verify checksums
run: |
set -euo pipefail
cd dist
test -f checksums.txt || { echo "checksums.txt missing"; exit 1; }
sha256sum -c checksums.txt || { echo "checksum verification failed"; exit 1; }
echo "All checksums valid"

- uses: actions/upload-artifact@v4
with:
name: release-dry-run
path: dist/*
Loading
Loading