-
Notifications
You must be signed in to change notification settings - Fork 43
128 lines (106 loc) · 3.98 KB
/
Copy pathmain.yaml
File metadata and controls
128 lines (106 loc) · 3.98 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
name: Build, Test and Publish
permissions:
contents: read
on:
merge_group:
push:
pull_request:
workflow_dispatch:
jobs:
test:
runs-on: ubuntu-latest
steps:
- name: Harden the runner (Audit all outbound calls)
uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
with:
egress-policy: audit
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
cache-dependency-path: "./go.sum"
check-latest: true
go-version-file: "./go.mod"
- name: Build
run: go build -v ./...
- name: Test
run: go test -race -coverprofile=coverage.txt -covermode=atomic -v ./...
- name: Upload coverage to Codecov
uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
continue-on-error: true
with:
token: ${{ secrets.CODECOV_TOKEN }}
slug: openfga/go-sdk
lint-format:
runs-on: ubuntu-latest
name: Lint and Format Check
steps:
- name: Harden the runner (Audit all outbound calls)
uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
with:
egress-policy: audit
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
cache-dependency-path: "./go.sum"
check-latest: true
go-version-file: "./go.mod"
- name: Check formatting
run: |
unformatted=$(gofmt -l .)
if [ -n "$unformatted" ]; then
echo "The following files are not formatted:"
echo "$unformatted"
exit 1
fi
- name: Run go vet
run: go vet ./...
- name: golangci-lint
uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
with:
version: v2.12.2
govulncheck:
runs-on: ubuntu-latest
name: Run govulncheck
steps:
- name: Harden the runner (Audit all outbound calls)
uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
with:
egress-policy: audit
- id: govulncheck
uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # v1.1.0
with:
cache-dependency-path: "./go.sum"
go-version-file: "./go.mod"
verify-version:
runs-on: ubuntu-latest
if: startsWith(github.ref, 'refs/tags/v')
needs: [test, lint-format]
steps:
- name: Harden the runner (Audit all outbound calls)
uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
with:
egress-policy: audit
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Verify versions match
run: |
TAG_VERSION="${GITHUB_REF#refs/tags/v}"
MANIFEST_VERSION=$(jq -r '.["."]' .release-please-manifest.json)
GO_VERSION=$(grep 'x-release-please-version' internal/constants/constants.go | grep -oP '"\K[^"]+(?=")')
echo "Tag: $TAG_VERSION | Manifest: $MANIFEST_VERSION | constants.go: $GO_VERSION"
if [[ "$TAG_VERSION" != "$MANIFEST_VERSION" ]]; then
echo "ERROR: Tag version does not match manifest version"
exit 1
fi
if [[ "$GO_VERSION" != "$MANIFEST_VERSION" ]]; then
echo "ERROR: constants.go version does not match manifest version"
exit 1
fi
echo "All versions verified: $TAG_VERSION"
undraft-release:
if: startsWith(github.ref, 'refs/tags/v')
needs: [verify-version]
permissions:
contents: write
uses: openfga/.github/.github/workflows/undraft-release.yml@835baf31562809ad9eb884c73efc5b79318f700f # pin@main