94 lines
2.7 KiB
YAML
94 lines
2.7 KiB
YAML
# CI that runs on the GitHub mirror.
|
|
#
|
|
# The real pipeline lives in .forgejo/workflows and does the building, the
|
|
# registry push and the deploy, because only the Forgejo runner can reach the
|
|
# cluster. This workflow deliberately does none of that. It exists so the
|
|
# repository a reviewer opens on GitHub shows its own green checks, and so a
|
|
# secret can never reach the mirror unnoticed.
|
|
#
|
|
# No secrets are consumed here and none are needed.
|
|
|
|
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: ci-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
secrets:
|
|
name: secret scan
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
# Run as a plain container rather than a marketplace action, so the same
|
|
# command works unchanged on the Forgejo runner.
|
|
- name: gitleaks
|
|
run: |
|
|
docker run --rm -v "$PWD:/repo" \
|
|
ghcr.io/gitleaks/gitleaks:v8.30.1 \
|
|
detect --source /repo --redact -v
|
|
|
|
go:
|
|
name: vet, test, lint
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
# The API is written by a separate agent. Until it lands there is no
|
|
# go.mod, and this job should pass rather than fail on an empty tree.
|
|
- id: probe
|
|
run: |
|
|
if [ -f apps/api/go.mod ]; then
|
|
echo "ready=true" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "ready=false" >> "$GITHUB_OUTPUT"
|
|
echo "apps/api/go.mod not present yet, skipping Go checks" >> "$GITHUB_STEP_SUMMARY"
|
|
fi
|
|
|
|
- uses: actions/setup-go@v7
|
|
if: steps.probe.outputs.ready == 'true'
|
|
with:
|
|
go-version-file: apps/api/go.mod
|
|
cache-dependency-path: apps/api/go.sum
|
|
|
|
- name: vet and test
|
|
if: steps.probe.outputs.ready == 'true'
|
|
working-directory: apps/api
|
|
run: |
|
|
go vet ./...
|
|
go test -race ./...
|
|
|
|
- uses: golangci/golangci-lint-action@v9
|
|
if: steps.probe.outputs.ready == 'true'
|
|
with:
|
|
working-directory: apps/api
|
|
|
|
terraform:
|
|
name: terraform
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- name: format and validate
|
|
run: |
|
|
for stack in terraform/infra terraform/platform
|
|
do
|
|
docker run --rm -v "$PWD:/work" -w "/work/$stack" \
|
|
hashicorp/terraform:1.15.9 fmt -check
|
|
docker run --rm -v "$PWD:/work" -w "/work/$stack" \
|
|
hashicorp/terraform:1.15.9 init -backend=false -lockfile=readonly
|
|
docker run --rm -v "$PWD:/work" -w "/work/$stack" \
|
|
hashicorp/terraform:1.15.9 validate
|
|
done
|