feat(generate): C3c — emit compose healthcheck: + lower intra-project dependsOn (spec 10) #39
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| env: | |
| # Single enforced Go toolchain floor (DECISIONS, ARCHITECTURE §7.8). | |
| GO_VERSION: "1.25" | |
| jobs: | |
| build-test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| check-latest: true | |
| - name: gofmt | |
| run: | | |
| unformatted=$(gofmt -l .) | |
| if [ -n "$unformatted" ]; then | |
| echo "These files are not gofmt-clean:"; echo "$unformatted"; exit 1 | |
| fi | |
| - name: go vet | |
| run: go vet ./... | |
| - name: build (CGO disabled — static binary invariant) | |
| run: CGO_ENABLED=0 go build ./... | |
| - name: test -race | |
| env: | |
| CGO_ENABLED: "1" # the race detector requires cgo (see Makefile) | |
| run: go test -race ./... | |
| govulncheck: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| check-latest: true | |
| - name: govulncheck | |
| run: | | |
| go install golang.org/x/vuln/cmd/govulncheck@latest | |
| govulncheck ./... | |
| cross-compile: | |
| # Proves the 4 release targets build CGO-free from one Linux runner. | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| goos: [linux, darwin] | |
| goarch: [amd64, arm64] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| check-latest: true | |
| - name: build ${{ matrix.goos }}/${{ matrix.goarch }} | |
| env: | |
| CGO_ENABLED: "0" | |
| GOOS: ${{ matrix.goos }} | |
| GOARCH: ${{ matrix.goarch }} | |
| run: go build -o /dev/null ./cmd/devstack | |
| determinism: | |
| # Asserts the generation pipeline is byte-identical across runs/paths | |
| # (spec 02 acceptance #3, ARCHITECTURE §3) — the rebuild-hash and any | |
| # "commit generated artifacts" decision depend on it. | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| check-latest: true | |
| - name: determinism (byte-identical generation) | |
| run: make determinism | |
| installer: | |
| # Lints the curl|sh installer so a broken install path is caught before release. | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: shellcheck install.sh | |
| run: shellcheck --severity=warning install.sh | |
| - name: POSIX sh syntax | |
| run: sh -n install.sh | |
| release-dryrun: | |
| # Proves the full release pipeline (4 CGO-free targets + archives + checksums | |
| # + .deb/.rpm) builds, without tagging — so a tag push never fails late. | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| check-latest: true | |
| - uses: goreleaser/goreleaser-action@v6 | |
| with: | |
| version: "~> v2" | |
| args: release --snapshot --clean | |
| # Placeholder lanes wired as their milestones land: | |
| # - schema-drift: JSON-Schema ↔ Go-struct round-trip check (M1) | |
| # - integration: testcontainers-go / dind lane behind a build tag (M7) |