feat(pipeline): manifest v4 carries the verdict the two booleans coul… #66
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Build, vet, test, lint, govulncheck. The gate on every push and pull request. | |
| name: ci | |
| on: | |
| push: | |
| branches: [main, 'ci/**'] # ci/** proves a workflow change green before it lands on main | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: # so a run can be kicked off without inventing a commit | |
| # Least privilege by default; the one job re-grants only read. | |
| permissions: {} | |
| jobs: | |
| build-test: | |
| name: build · vet · test · lint · vuln | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| # Deny egress by default. The runner is where a poisoned dependency or a compromised | |
| # action would try to reach its own infrastructure; if it is not on this list, it does | |
| # not resolve. Everything here is what the Go toolchain and the checks actually need. | |
| # storage.googleapis.com is not optional: proxy.golang.org hands out a signed redirect | |
| # there for the larger module zips, so a build only fails on the modules big enough to | |
| # take that path, and only when they miss the proxy's cache. | |
| - name: Harden the runner | |
| uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 | |
| with: | |
| egress-policy: block | |
| allowed-endpoints: > | |
| api.github.com:443 | |
| github.com:443 | |
| proxy.golang.org:443 | |
| release-assets.githubusercontent.com:443 | |
| storage.googleapis.com:443 | |
| sum.golang.org:443 | |
| vuln.go.dev:443 | |
| mcr.microsoft.com:443 | |
| *.data.mcr.microsoft.com:443 | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: '1.26.6' | |
| check-latest: false | |
| - name: gofmt | |
| run: test -z "$(gofmt -l .)" || { echo 'gofmt needed on:'; gofmt -l .; exit 1; } | |
| - name: go vet | |
| run: go vet ./... | |
| - name: build | |
| run: go build -mod=readonly ./... | |
| # The Azure destination tests fail rather than skip when CI is set, so the emulator | |
| # has to be running here. Same image digest the tests were proven against. The image's | |
| # default command lacks --skipApiVersionCheck, and the SDK speaks a newer API version | |
| # than Azurite knows, so without the flag every request is a 400. The readiness loop | |
| # accepts any HTTP response; a 400 from an unauthenticated probe still means "up". | |
| - name: Start Azurite | |
| run: | | |
| docker run -d --name azurite -p 10000:10000 \ | |
| mcr.microsoft.com/azure-storage/azurite@sha256:76b8127d608fab8287a14a4bfeb9a5502cdcffb4bf1e86f09f324ebb0e70edba \ | |
| azurite-blob --blobHost 0.0.0.0 --skipApiVersionCheck | |
| for _ in $(seq 1 30); do | |
| curl -s -o /dev/null http://127.0.0.1:10000/devstoreaccount1 && break | |
| sleep 1 | |
| done | |
| - name: test | |
| env: | |
| AZURITE_BLOB_ENDPOINT: http://127.0.0.1:10000 | |
| run: go test -mod=readonly ./... | |
| - name: lint | |
| run: make lint | |
| - name: govulncheck | |
| run: make vuln |