cache: the Store admission/serve sidecar seam (RPZ phase 4 prerequisi… #560
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| test: | |
| name: Test (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v7 | |
| with: | |
| go-version: stable | |
| - name: Build | |
| run: go build -v ./... | |
| - name: Test | |
| run: make test | |
| - name: Upload coverage | |
| if: matrix.os == 'ubuntu-latest' | |
| uses: codecov/codecov-action@v7 | |
| with: | |
| files: coverage.out | |
| # Coverage upload is informational; a Codecov outage or a | |
| # missing token (e.g. on fork PRs) must not fail the build. | |
| fail_ci_if_error: false | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| allocgate: | |
| name: Allocation gates | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v7 | |
| with: | |
| # Pinned deliberately: allocation counts are toolchain-sensitive, | |
| # and the hard-zero gate's verdict must not drift with "stable". | |
| # Keep in lockstep with go.mod's toolchain directive. | |
| go-version: '1.27.0' | |
| # The main test job runs with -race on every OS, which skips every | |
| # !race-tagged allocation pin. This job is where they actually run. | |
| - name: Allocation pins (no race) | |
| run: go test -count=1 -run 'Alloc|ServeRawHitClasses' ./... | |
| release-targets: | |
| # The release ships architectures no test job builds for. A transport | |
| # written against 64-bit kernel descriptors compiles cleanly on the | |
| # runner and breaks the release, which is exactly what happened once | |
| # already — so every published target is compiled here. | |
| name: Release targets build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go.mod | |
| - name: Cross-compile published targets | |
| run: | | |
| set -euo pipefail | |
| fail=0 | |
| # This list mirrors .goreleaser.yml exactly — targets and env | |
| # both. The MIPS release ships softfloat only, so that is the | |
| # variant compiled here; a hardfloat-only pass would be a gate | |
| # that never guards what ships. CGO_ENABLED=0 for the same | |
| # reason: the release builds every artifact without cgo, and | |
| # the native linux/amd64 step would otherwise gate a linkage | |
| # the release never uses. | |
| build() { | |
| if ! out=$(CGO_ENABLED=0 GOOS="$1" GOARCH="$2" GOARM="${3:-}" GOMIPS="${GOMIPS:-}" GOMIPS64="${GOMIPS64:-}" go build ./... 2>&1); then | |
| echo "::error::build failed for $1/$2${3:+v$3}${GOMIPS:+_$GOMIPS}" | |
| echo "$out" | |
| fail=1 | |
| else | |
| echo "ok $1/$2${3:+v$3}${GOMIPS:+_$GOMIPS}" | |
| fi | |
| } | |
| build linux amd64 | |
| build linux arm64 | |
| build linux arm 5 | |
| build linux arm 6 | |
| build linux arm 7 | |
| GOMIPS=softfloat build linux mips | |
| GOMIPS=softfloat build linux mipsle | |
| GOMIPS64=softfloat build linux mips64 | |
| GOMIPS64=softfloat build linux mips64le | |
| build darwin amd64 | |
| build darwin arm64 | |
| build windows amd64 | |
| build freebsd amd64 | |
| build openbsd amd64 | |
| build netbsd amd64 | |
| exit $fail | |
| lint: | |
| name: Lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v7 | |
| with: | |
| go-version: stable | |
| cache: false | |
| - uses: golangci/golangci-lint-action@v9 | |
| with: | |
| version: latest |