lerko
d1ab842283
Un-neuter grype CVE gate (was || echo, now fails on critical). Add .grype.yaml with ignore for CVE-2026-41589 (wish SCP — unreachable, we only import wish/bubbletea). Pin: grype v0.114.0, git-cliff v2.13.1, govulncheck v1.1.4. Tag `latest` only on tag push, not workflow_dispatch. Build path ./cmd/uptop (survives a main.go split). Add dist/ and uptop to .dockerignore.
72 lines
1.3 KiB
YAML
72 lines
1.3 KiB
YAML
name: CI
|
|
|
|
on:
|
|
pull_request:
|
|
|
|
env:
|
|
GO_VERSION: "1.26"
|
|
|
|
jobs:
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
shell: sh
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version: "1.26"
|
|
|
|
- uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~/go/pkg/mod
|
|
~/.cache/go-build
|
|
key: go-${{ hashFiles('go.sum') }}
|
|
restore-keys: go-
|
|
|
|
- name: Install build tools
|
|
run: apk add --no-cache gcc musl-dev
|
|
|
|
- name: Download modules
|
|
run: go mod download
|
|
|
|
- name: Test
|
|
run: CGO_ENABLED=1 go test -race -timeout 120s ./...
|
|
|
|
lint:
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
shell: sh
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version: "1.26"
|
|
|
|
- uses: golangci/golangci-lint-action@v7
|
|
with:
|
|
version: v2.11.2
|
|
|
|
vulncheck:
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
shell: sh
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version: "1.26"
|
|
|
|
- name: Install govulncheck
|
|
run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4
|
|
|
|
- name: Run govulncheck
|
|
run: govulncheck ./...
|