docs: add the logo to the readme and the chart #43
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Build, vet, test, lint, govulncheck. The gate on every push and pull request. | |
| name: ci | |
| on: | |
| push: | |
| branches: [main, 'ci/**'] # ci/** proves a workflow change green before it lands on main | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: # so a run can be kicked off without inventing a commit | |
| # Least privilege by default; the one job re-grants only read. | |
| permissions: {} | |
| jobs: | |
| build-test: | |
| name: build · vet · test · lint · vuln | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| # Deny egress by default. The runner is where a poisoned dependency or a compromised | |
| # action would try to reach its own infrastructure; if it is not on this list, it does | |
| # not resolve. Everything here is what the Go toolchain and the checks actually need. | |
| # storage.googleapis.com is not optional: proxy.golang.org hands out a signed redirect | |
| # there for the larger module zips, so a build only fails on the modules big enough to | |
| # take that path, and only when they miss the proxy's cache. | |
| - name: Harden the runner | |
| uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 | |
| with: | |
| egress-policy: block | |
| allowed-endpoints: > | |
| api.github.com:443 | |
| github.com:443 | |
| proxy.golang.org:443 | |
| release-assets.githubusercontent.com:443 | |
| storage.googleapis.com:443 | |
| sum.golang.org:443 | |
| vuln.go.dev:443 | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: '1.26.6' | |
| check-latest: false | |
| - name: gofmt | |
| run: test -z "$(gofmt -l .)" || { echo 'gofmt needed on:'; gofmt -l .; exit 1; } | |
| - name: go vet | |
| run: go vet ./... | |
| - name: build | |
| run: go build -mod=readonly ./... | |
| - name: test | |
| run: go test -mod=readonly ./... | |
| - name: lint | |
| run: make lint | |
| - name: govulncheck | |
| run: make vuln |