feat(db): reset and pull verbs for the shared Postgres (spec 15) (#103) #183
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| paths-ignore: ["**/*.md", "docs/**", "LICENSE", "NOTICE"] | |
| pull_request: | |
| paths-ignore: ["**/*.md", "docs/**", "LICENSE", "NOTICE"] | |
| permissions: | |
| contents: read | |
| # Cancel superseded runs on the same ref (fail-fast + CI economy). | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| # Single enforced Go toolchain floor (DECISIONS, ARCHITECTURE §7.8). | |
| GO_VERSION: "1.25" | |
| jobs: | |
| # One consolidated lane ordered cheap → expensive so a lint/unit failure stops | |
| # before the costly Docker + cross-compile work. actions/setup-go caches the | |
| # module + build cache (keyed by go.sum). ubuntu-latest ships Docker, used by | |
| # the integration + e2e steps. | |
| ci: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| check-latest: true | |
| cache: true # GOMODCACHE + GOCACHE, keyed by go.sum | |
| # --- cheap, high-signal (fail fast) --- | |
| - name: gofmt | |
| run: | | |
| unformatted=$(gofmt -l .) | |
| if [ -n "$unformatted" ]; then | |
| echo "These files are not gofmt-clean:"; echo "$unformatted"; exit 1 | |
| fi | |
| - name: go vet | |
| run: go vet ./... | |
| - name: installer lint (shellcheck + POSIX sh) | |
| run: | | |
| shellcheck --severity=warning install.sh | |
| sh -n install.sh | |
| - name: build (CGO disabled — static binary invariant) | |
| run: CGO_ENABLED=0 go build ./... | |
| - name: unit tests -race | |
| env: | |
| CGO_ENABLED: "1" # the race detector requires cgo (see Makefile) | |
| run: go test -race ./... | |
| - name: smoke (built binary, end-to-end in an XDG sandbox) | |
| run: make smoke | |
| - name: determinism (byte-identical generation) | |
| run: make determinism | |
| # --- medium --- | |
| - name: cross-compile (4 CGO-free release targets) | |
| env: | |
| CGO_ENABLED: "0" | |
| run: | | |
| for t in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64; do | |
| echo "→ $t" | |
| GOOS=${t%/*} GOARCH=${t#*/} go build -o /dev/null ./cmd/devstack | |
| done | |
| - name: govulncheck | |
| run: | | |
| go install golang.org/x/vuln/cmd/govulncheck@latest | |
| govulncheck ./... | |
| # --- expensive, real-daemon (Docker on ubuntu-latest) --- | |
| - name: docker available | |
| run: docker version | |
| - name: integration tests (-tags=integration -race) | |
| env: | |
| CGO_ENABLED: "1" | |
| run: go test -tags=integration -race ./... | |
| - name: e2e tests (-tags=e2e, real up/down via the CLI) | |
| env: | |
| DEVSTACK_E2E: "1" # ephemeral runner: safe to mutate the shared stack | |
| run: go test -tags=e2e ./tests/e2e/... | |
| # The full release pipeline (4 CGO-free targets + archives + checksums + | |
| # .deb/.rpm) — expensive and independent, so it runs in parallel and never | |
| # gates the fast feedback above. Needs full history for goreleaser's versioning. | |
| release-dryrun: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| check-latest: true | |
| cache: true | |
| - uses: goreleaser/goreleaser-action@v6 | |
| with: | |
| version: "~> v2" | |
| # --skip=sign: the dry-run validates build/archive/package config only. | |
| # Signing is keyless cosign over GitHub OIDC (release.yml) and cannot run | |
| # in a PR dry-run (no cosign binary, no id-token) — the real release signs. | |
| args: release --snapshot --clean --skip=sign | |
| # Native macOS arm64 lane (G2): proves the darwin/arm64 RUNTIME target — not just | |
| # the cross-compile on the Linux lane — actually builds and passes its daemon-free | |
| # tests. Hosted macOS runners have no Docker, so the integration/e2e (daemon) | |
| # steps stay on the ubuntu `ci` lane; this lane runs build + unit(-race) + a | |
| # binary preflight. Invoked via `go` directly (not make: hosted macOS ships BSD | |
| # make, and the Makefile uses GNU features). | |
| macos: | |
| runs-on: macos-14 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| check-latest: true | |
| cache: true | |
| - name: build (CGO disabled — static binary invariant) | |
| run: CGO_ENABLED=0 go build ./... | |
| - name: unit tests -race | |
| env: | |
| CGO_ENABLED: "1" # the race detector requires cgo | |
| run: go test -race ./... | |
| - name: binary preflight (runs natively on arm64) | |
| run: | | |
| go build -o devstack ./cmd/devstack | |
| ./devstack version | |
| ./devstack --help >/dev/null | |
| # Placeholder lanes wired as their milestones land: | |
| # - config-conformance: golden workspace exercising every schema field |