chore(deps): bump the go-dependencies group across 1 directory with 2… #93
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Go CLI | |
| on: | |
| push: | |
| branches: [main, master] | |
| pull_request: | |
| branches: [main, master] | |
| workflow_dispatch: {} | |
| schedule: | |
| # Daily 06:00 UTC: the full runtime parity matrix + publish parity. On | |
| # push/PR only the cases affected by the change run (see parity-runtime). | |
| - cron: "0 6 * * *" | |
| jobs: | |
| lint-and-test: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| code-quality: write | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version-file: go.mod | |
| - uses: go-task/setup-task@v2 | |
| with: | |
| version: 3.x | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| - run: task lint | |
| - run: task spec:compliance | |
| - run: task vuln | |
| - run: task test:race | |
| - run: task coverage | |
| - name: Coverage summary | |
| if: always() | |
| run: go run ./cmd/devtool coverage-report coverage.out "unit (hermetic)" >> "$GITHUB_STEP_SUMMARY" | |
| - run: task test:integration | |
| - run: task build | |
| - run: ./devcontainer --version | |
| # Convert the Go coverage profile (coverage.out) to Cobertura XML for | |
| # GitHub's native Code Quality feature. | |
| - name: Convert coverage to Cobertura XML | |
| run: | | |
| go install github.com/boumenot/gocover-cobertura@latest | |
| gocover-cobertura < coverage.out > coverage.xml | |
| - name: Upload coverage report | |
| uses: actions/upload-code-coverage@v1 | |
| with: | |
| file: coverage.xml | |
| language: Go | |
| label: code-coverage/go | |
| # Binary covdata for the cross-lane merge (coverage-report job). | |
| - uses: actions/upload-artifact@v7 | |
| if: always() | |
| with: | |
| name: covdata-unit | |
| path: artifacts/coverage/data/unit | |
| if-no-files-found: error | |
| e2e: | |
| runs-on: ubuntu-latest | |
| needs: lint-and-test | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version-file: go.mod | |
| - uses: go-task/setup-task@v2 | |
| with: | |
| version: 3.x | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| - run: task coverage:e2e | |
| - name: Coverage summary | |
| if: always() | |
| run: go run ./cmd/devtool coverage-report artifacts/coverage/data/e2e "e2e" >> "$GITHUB_STEP_SUMMARY" | |
| - uses: actions/upload-artifact@v7 | |
| if: always() | |
| with: | |
| name: covdata-e2e | |
| path: artifacts/coverage/data/e2e | |
| if-no-files-found: error | |
| - if: always() | |
| run: task clean | |
| # Hermetic parity gate: read-configuration golden comparison + the contract | |
| # lane of the parity matrix (flag validation / output contract, no Docker). | |
| parity: | |
| runs-on: ubuntu-latest | |
| needs: lint-and-test | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| submodules: recursive | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version-file: go.mod | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: "20" | |
| - uses: go-task/setup-task@v2 | |
| with: | |
| version: 3.x | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| - run: task reference | |
| - run: task parity:contract | |
| - run: task parity:network | |
| # Coverage is measured separately with an instrumented Go binary. Keep the | |
| # functional parity run above release-like, and avoid conflating subprocess | |
| # coverage with the hermetic unit profile. | |
| - run: task coverage:parity-contract | |
| - name: Coverage summary | |
| if: always() | |
| run: go run ./cmd/devtool coverage-report artifacts/coverage/data/contract "parity:contract" >> "$GITHUB_STEP_SUMMARY" | |
| - if: always() | |
| run: | | |
| mkdir -p artifacts | |
| git -C reference rev-parse HEAD > artifacts/reference-commit.txt | |
| - uses: actions/upload-artifact@v7 | |
| if: always() | |
| with: | |
| name: parity-contract-network-v0.88.0 | |
| path: artifacts/ | |
| if-no-files-found: error | |
| - uses: actions/upload-artifact@v7 | |
| if: always() | |
| with: | |
| name: covdata-contract | |
| path: artifacts/coverage/data/contract | |
| if-no-files-found: error | |
| # "Did the repo change today?" gate for the expensive daily lanes. Manual dispatch | |
| # always runs; a scheduled run only proceeds when HEAD has a commit within the last | |
| # day (devtool daily-changed) — on a private/billed repo this skips the daily matrix | |
| # on quiet days. Runs on schedule/dispatch so the daily lanes' `needs:` is satisfied. | |
| daily-changes: | |
| if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' | |
| runs-on: ubuntu-latest | |
| outputs: | |
| run: ${{ steps.check.outputs.run }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version-file: go.mod | |
| - id: check | |
| run: | | |
| if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then | |
| echo "manual dispatch → always run" >&2 | |
| echo "run=true" >> "$GITHUB_OUTPUT" | |
| else | |
| go run ./cmd/devtool daily-changed >> "$GITHUB_OUTPUT" | |
| fi | |
| # Single sharded runtime parity matrix, parameterized by event: | |
| # push/PR — SCOPED to the commands the diff can affect (devtool parity-affected), | |
| # run with the plain binary: a fast gate (the full matrix is ~45 min). | |
| # daily — the FULL matrix with the instrumented binary, so one run gates parity | |
| # AND measures coverage; daily-changes keeps it off on quiet days. | |
| # 4 shards across independent runners (each its own docker daemon) so the matrix | |
| # never contends for one runner's CPU/disk/daemon. PARITY_SHARD_TOTAL MUST equal the | |
| # length of matrix.shard — parity_sharding_workflow_test.go enforces it so a mismatch | |
| # can't silently drop cases. | |
| parity-runtime: | |
| needs: [lint-and-test, daily-changes] | |
| # Every push/PR, and on schedule/dispatch only when the repo changed. always() so a | |
| # skipped daily-changes (push/PR) doesn't skip this job; the explicit lint-and-test | |
| # check restores the normal "needs succeeded" gate. | |
| if: >- | |
| always() | |
| && needs.lint-and-test.result == 'success' | |
| && (github.event_name == 'push' || github.event_name == 'pull_request' | |
| || needs.daily-changes.outputs.run == 'true') | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| shard: [0, 1, 2, 3] | |
| env: | |
| PARITY_RUNTIME_TIMEOUT: "10m" | |
| # Each shard owns ~a quarter of the selected cases; -parallel 2 per 2-core runner | |
| # is the proven-safe load (per-case id-label / COMPOSE_PROJECT_NAME isolation). | |
| PARITY_PARALLEL: "2" | |
| PARITY_SHARD_INDEX: ${{ matrix.shard }} | |
| PARITY_SHARD_TOTAL: "4" | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| submodules: recursive | |
| # Full history so the push/PR diff base is present for the affected mapping. | |
| fetch-depth: 0 | |
| # devtool (the affected mapping) runs before the composite setup, so Go here. | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version-file: go.mod | |
| - name: Plan this run | |
| id: plan | |
| run: | | |
| if [ "${{ github.event_name }}" = "push" ] || [ "${{ github.event_name }}" = "pull_request" ]; then | |
| if [ "${{ github.event_name }}" = "pull_request" ]; then | |
| base="${{ github.event.pull_request.base.sha }}"; head="${{ github.event.pull_request.head.sha }}" | |
| else | |
| base="${{ github.event.before }}"; head="${{ github.sha }}" | |
| fi | |
| go run ./cmd/devtool parity-affected-commands "$base" "$head" >> "$GITHUB_OUTPUT" | |
| else | |
| # daily: the full matrix (this job only runs when daily-changes said so). | |
| echo "run=true" >> "$GITHUB_OUTPUT" | |
| echo "commands=all" >> "$GITHUB_OUTPUT" | |
| fi | |
| - if: steps.plan.outputs.run == 'true' | |
| uses: ./.github/actions/setup-parity-runtime | |
| with: | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| # push/PR: scoped, plain binary — a fast gate. | |
| - name: Run parity (scoped, plain) | |
| if: steps.plan.outputs.run == 'true' && (github.event_name == 'push' || github.event_name == 'pull_request') | |
| env: | |
| PARITY_COMMAND: ${{ steps.plan.outputs.commands }} | |
| run: task parity:runtime | |
| # daily: full matrix, instrumented binary — gates parity AND measures coverage. | |
| - name: Run parity (full, instrumented) | |
| if: steps.plan.outputs.run == 'true' && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') | |
| run: task coverage:parity-runtime | |
| - name: Coverage summary | |
| if: always() && steps.plan.outputs.run == 'true' && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') | |
| run: go run ./cmd/devtool coverage-report artifacts/coverage/data/runtime "parity:runtime shard ${{ matrix.shard }}" >> "$GITHUB_STEP_SUMMARY" | |
| - if: always() && steps.plan.outputs.run == 'true' | |
| run: | | |
| mkdir -p artifacts | |
| git -C reference rev-parse HEAD > artifacts/reference-commit.txt | |
| - uses: actions/upload-artifact@v7 | |
| if: always() && steps.plan.outputs.run == 'true' | |
| with: | |
| name: parity-runtime-v0.88.0-shard-${{ matrix.shard }} | |
| path: artifacts/ | |
| if-no-files-found: error | |
| # daily only: covdata slice for the cross-lane merge (distinct name per shard). | |
| - uses: actions/upload-artifact@v7 | |
| if: always() && steps.plan.outputs.run == 'true' && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') | |
| with: | |
| name: covdata-runtime-shard-${{ matrix.shard }} | |
| path: artifacts/coverage/data/runtime | |
| if-no-files-found: error | |
| - if: always() && steps.plan.outputs.run == 'true' | |
| run: task clean | |
| # Publish parity (features/templates → ephemeral OCI registry). Daily only, its own | |
| # job so it doesn't steal a runtime shard's runner. | |
| parity-publish-full: | |
| needs: [lint-and-test, daily-changes] | |
| if: needs.daily-changes.outputs.run == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| submodules: recursive | |
| - uses: ./.github/actions/setup-parity-runtime | |
| with: | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| - run: task coverage:parity-publish | |
| - name: Coverage summary | |
| if: always() | |
| run: go run ./cmd/devtool coverage-report artifacts/coverage/data/publish "parity:publish" >> "$GITHUB_STEP_SUMMARY" | |
| - uses: actions/upload-artifact@v7 | |
| if: always() | |
| with: | |
| name: covdata-publish | |
| path: artifacts/coverage/data/publish | |
| if-no-files-found: error | |
| - if: always() | |
| run: task clean | |
| # Single gate + cross-lane coverage for ALL events (absorbs the old push/PR | |
| # parity-runtime aggregator, the daily report, and the per-PR coverage-report): | |
| # gates the runtime matrix (and, on daily, publish) into one pass/fail, and merges | |
| # every lane's covdata (unit + e2e + contract, plus the daily runtime shards + | |
| # publish) into the one true cross-lane number. | |
| parity-runtime-gate: | |
| if: always() | |
| runs-on: ubuntu-latest | |
| needs: [lint-and-test, e2e, parity, parity-runtime, parity-publish-full] | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version-file: go.mod | |
| - uses: go-task/setup-task@v2 | |
| with: | |
| version: 3.x | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Download all lane covdata | |
| uses: actions/download-artifact@v8 | |
| with: | |
| pattern: covdata-* | |
| path: artifacts/coverage/data | |
| # download-artifact nests each artifact under covdata-<lane>/; flatten to <lane>/ | |
| # so coverage:merge sees one dir per lane (the runtime shards stay distinct). | |
| - name: Normalize lane dirs | |
| run: | | |
| cd artifacts/coverage/data | |
| for d in covdata-*; do [ -d "$d" ] && mv "$d" "${d#covdata-}"; done | |
| ls -R . || true | |
| - name: Merged coverage report | |
| run: task coverage:merge | tee -a "$GITHUB_STEP_SUMMARY" | |
| - uses: actions/upload-artifact@v7 | |
| with: | |
| name: covdata-merged | |
| path: artifacts/coverage/data/merged.out | |
| if-no-files-found: warn | |
| # Final verdict last, so coverage is posted even when a shard failed. A skipped | |
| # lane (publish on push/PR, or the whole matrix on a quiet daily) counts as pass. | |
| - name: Gate on runtime + publish | |
| run: | | |
| runtime="${{ needs.parity-runtime.result }}" | |
| publish="${{ needs.parity-publish-full.result }}" | |
| echo "runtime: $runtime, publish: $publish" | |
| for r in "$runtime" "$publish"; do | |
| case "$r" in | |
| success|skipped) ;; | |
| *) echo "runtime/publish parity failed"; exit 1 ;; | |
| esac | |
| done | |
| cross-compile: | |
| runs-on: ubuntu-latest | |
| needs: lint-and-test | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version-file: go.mod | |
| - uses: go-task/setup-task@v2 | |
| with: | |
| version: 3.x | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| - run: task build:cross | |
| - run: ls -lh dist/ |