ci(deps): Bump actions/setup-go from 5 to 6 #12
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: tests | |
| on: | |
| push: | |
| branches: [ main ] | |
| pull_request: | |
| branches: [ main ] | |
| permissions: | |
| contents: read | |
| env: | |
| GO_VERSION: '1.21' | |
| GOLANGCI_LINT_VERSION: 'v2.0.2' | |
| jobs: | |
| test: | |
| permissions: | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ ubuntu-latest, windows-latest, macos-latest ] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| # Build validation (cross-platform). | |
| # Pure-stdlib libraries have no go.sum, so we only diff go.mod. | |
| - name: Build validation | |
| run: | | |
| go build ./... | |
| go mod tidy | |
| git diff --exit-code go.mod | |
| - name: Run tests (Unix) | |
| if: runner.os != 'Windows' | |
| run: go test -v -race -coverprofile=coverage.out ./... | |
| - name: Run tests (Windows) | |
| if: runner.os == 'Windows' | |
| run: go test -v -coverprofile="coverage.out" ./... | |
| - name: Run benchmarks | |
| run: go test -bench=. -benchmem ./... | |
| - name: Upload coverage artifact | |
| if: matrix.os == 'ubuntu-latest' | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: coverage-out | |
| path: coverage.out | |
| retention-days: 1 | |
| # Badge generation runs only on main, and is the only job that needs | |
| # contents: write. Separating it from the test matrix keeps every test | |
| # job running with read-only credentials (least privilege). | |
| badges: | |
| needs: test | |
| if: github.ref == 'refs/heads/main' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| pull-requests: read | |
| security-events: read | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| - name: Download coverage artifact | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: coverage-out | |
| - name: Generate badge data | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| REPO: ${{ github.repository }} | |
| run: | | |
| mkdir -p .github/badges | |
| # Install pinned golangci-lint (never @latest in CI). | |
| go install "github.com/golangci/golangci-lint/v2/cmd/golangci-lint@${GOLANGCI_LINT_VERSION}" | |
| # Coverage badge | |
| if [[ -f "coverage.out" ]]; then | |
| COVERAGE=$(go tool cover -func=coverage.out | grep total | awk '{print $3}' | sed 's/%//') | |
| if (( $(echo "$COVERAGE >= 80" | bc -l) )); then | |
| COLOR="brightgreen" | |
| elif (( $(echo "$COVERAGE >= 60" | bc -l) )); then | |
| COLOR="yellow" | |
| else | |
| COLOR="red" | |
| fi | |
| echo '{"schemaVersion":1,"label":"coverage","message":"'$COVERAGE'%","color":"'$COLOR'"}' > .github/badges/coverage.json | |
| fi | |
| # Go version badge | |
| GO_VERSION=$(go version | grep -oE 'go[0-9]+\.[0-9]+(\.[0-9]+)?' | head -1) | |
| echo '{"schemaVersion":1,"label":"Go","message":"'$GO_VERSION'","color":"00ADD8"}' > .github/badges/go-version.json | |
| # Last updated badge | |
| LAST_COMMIT_DATE=$(git log -1 --format=%cd --date=short) | |
| echo '{"schemaVersion":1,"label":"last updated","message":"'$LAST_COMMIT_DATE'","color":"teal"}' > .github/badges/last-updated.json | |
| # golangci-lint badge | |
| if golangci-lint run; then | |
| echo '{"schemaVersion":1,"label":"golangci-lint","message":"0 issues","color":"brightgreen"}' > .github/badges/golangci-lint.json | |
| else | |
| ISSUES=$(golangci-lint run 2>&1 | grep -c "^.*\.go:" || echo "0") | |
| if [[ $ISSUES -eq 0 ]]; then | |
| echo '{"schemaVersion":1,"label":"golangci-lint","message":"passing","color":"brightgreen"}' > .github/badges/golangci-lint.json | |
| else | |
| echo '{"schemaVersion":1,"label":"golangci-lint","message":"'$ISSUES' issues","color":"red"}' > .github/badges/golangci-lint.json | |
| fi | |
| fi | |
| # Security/dependabot badge — queries THIS repo via $REPO env var | |
| DEPENDABOT_ALERTS=$(gh api "repos/$REPO/dependabot/alerts" --jq 'length' 2>/dev/null || echo "0") | |
| CODE_SCANNING_ALERTS=$(gh api "repos/$REPO/code-scanning/alerts" --jq '[.[] | select(.state == "open")] | length' 2>/dev/null || echo "0") | |
| TOTAL_ALERTS=$((DEPENDABOT_ALERTS + CODE_SCANNING_ALERTS)) | |
| OPEN_PRS=$(gh pr list --author "app/dependabot" --state open --json number --jq 'length' 2>/dev/null || echo "0") | |
| if [[ $TOTAL_ALERTS -gt 0 ]]; then | |
| if [[ $DEPENDABOT_ALERTS -gt 0 && $CODE_SCANNING_ALERTS -gt 0 ]]; then | |
| echo '{"schemaVersion":1,"label":"security","message":"'$TOTAL_ALERTS' alerts","color":"red"}' > .github/badges/dependabot.json | |
| elif [[ $DEPENDABOT_ALERTS -gt 0 ]]; then | |
| echo '{"schemaVersion":1,"label":"security","message":"'$DEPENDABOT_ALERTS' dependency alerts","color":"red"}' > .github/badges/dependabot.json | |
| else | |
| echo '{"schemaVersion":1,"label":"security","message":"'$CODE_SCANNING_ALERTS' code alerts","color":"red"}' > .github/badges/dependabot.json | |
| fi | |
| elif [[ $OPEN_PRS -gt 0 ]]; then | |
| echo '{"schemaVersion":1,"label":"dependabot","message":"'$OPEN_PRS' updates","color":"blue"}' > .github/badges/dependabot.json | |
| else | |
| echo '{"schemaVersion":1,"label":"security","message":"all clear","color":"brightgreen"}' > .github/badges/dependabot.json | |
| fi | |
| - name: Commit badges to main | |
| env: | |
| RUN_NUMBER: ${{ github.run_number }} | |
| run: | | |
| git config --global user.name "github-actions[bot]" | |
| git config --global user.email "github-actions[bot]@users.noreply.github.com" | |
| git add .github/badges/ | |
| if git diff --staged --quiet; then | |
| echo "No badge changes to commit" | |
| else | |
| git commit -m "Update badges from CI run $RUN_NUMBER [skip ci]" | |
| git push origin main | |
| fi |