chore(github): bump actions versions and add perms #117
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| permissions: | |
| contents: read | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - dev | |
| pull_request: | |
| branches: | |
| - main | |
| jobs: | |
| test: | |
| name: Test | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Run tests | |
| run: go test -v -race -coverprofile=coverage.out ./... | |
| - name: Upload coverage | |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 | |
| if: github.event_name == 'push' | |
| with: | |
| files: ./coverage.out | |
| fail_ci_if_error: false | |
| continue-on-error: true | |
| lint: | |
| name: Lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Run golangci-lint | |
| uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 | |
| with: | |
| version: v2.11 | |
| args: --timeout=5m | |
| generate: | |
| name: Verify generated code | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Install mise | |
| uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 | |
| with: | |
| install: true | |
| - name: Generate code | |
| run: go generate ./... | |
| - name: Check for uncommitted changes | |
| run: | | |
| if ! git diff --exit-code; then | |
| echo "Generated code is out of sync. Please run 'go generate ./...' and commit the changes." | |
| exit 1 | |
| fi | |
| build: | |
| name: Build binaries | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| target: | |
| - cmd/server | |
| - cmd/worker | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Build ${{ matrix.target }} | |
| run: go build -v ./${{ matrix.target }} | |
| docker: | |
| name: Build and push Docker image | |
| runs-on: ubuntu-latest | |
| needs: [test, lint, build] | |
| if: github.event_name == 'push' | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 | |
| - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 | |
| - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: App image metadata | |
| id: app-meta | |
| uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 | |
| with: | |
| images: ghcr.io/${{ github.repository }} | |
| tags: | | |
| type=sha,prefix=,enable=${{ github.ref == 'refs/heads/main' }} | |
| type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }} | |
| type=sha,prefix=dev-,enable=${{ github.ref == 'refs/heads/dev' }} | |
| type=raw,value=dev-latest,enable=${{ github.ref == 'refs/heads/dev' }} | |
| - name: Migrate image metadata | |
| id: migrate-meta | |
| uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 | |
| with: | |
| images: ghcr.io/${{ github.repository }}/migrate | |
| tags: | | |
| type=sha,prefix=,enable=${{ github.ref == 'refs/heads/main' }} | |
| type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }} | |
| type=sha,prefix=dev-,enable=${{ github.ref == 'refs/heads/dev' }} | |
| type=raw,value=dev-latest,enable=${{ github.ref == 'refs/heads/dev' }} | |
| - name: Build and push app image | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| with: | |
| context: . | |
| target: app | |
| push: true | |
| platforms: linux/amd64,linux/arm64 | |
| tags: ${{ steps.app-meta.outputs.tags }} | |
| labels: ${{ steps.app-meta.outputs.labels }} | |
| cache-from: type=gha,scope=app | |
| cache-to: type=gha,scope=app,mode=max | |
| build-args: | | |
| VERSION=${{ github.sha }} | |
| - name: Build and push migrate image | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| with: | |
| context: . | |
| target: migrate | |
| push: true | |
| platforms: linux/amd64,linux/arm64 | |
| tags: ${{ steps.migrate-meta.outputs.tags }} | |
| labels: ${{ steps.migrate-meta.outputs.labels }} | |
| cache-from: type=gha,scope=migrate | |
| cache-to: type=gha,scope=migrate,mode=max |