chore(deps): update module github.com/mikefarah/yq/v4 to v4.53.6 #7509
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copyright AGNTCY Contributors (https://github.com/agntcy) | |
| # SPDX-License-Identifier: Apache-2.0 | |
| name: CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| tags: | |
| - "v*.*.*" | |
| - "!gui/**" | |
| pull_request: | |
| permissions: | |
| contents: write | |
| packages: write | |
| id-token: write | |
| pull-requests: write | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| changes: | |
| name: Detect Changes | |
| runs-on: ubuntu-latest | |
| outputs: | |
| code: ${{ steps.result.outputs.code }} | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 | |
| - name: Check for code changes | |
| uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3 | |
| id: filter | |
| with: | |
| predicate-quantifier: 'every' | |
| filters: | | |
| code: | |
| - '!gui/**' | |
| - '!docs/**' | |
| - '!.github/workflows/docs-ci.yaml' | |
| - '!.github/workflows/docs-deploy.yml' | |
| - '!.github/workflows/reusable-docs.yml' | |
| - '!README.md' | |
| - '!CHANGELOG.md' | |
| - '!CONTRIBUTING.md' | |
| - '!CODE_OF_CONDUCT.md' | |
| - '!SECURITY.md' | |
| - '!LICENSE.md' | |
| - '!MAINTAINERS.md' | |
| - '!CONTRIBUTORS.md' | |
| - '!AUTHZ.md' | |
| - '!API_SPEC.md' | |
| - '!RELEASE.md' | |
| - '!.gitignore' | |
| - name: Determine result | |
| id: result | |
| run: | | |
| # Always run for tag pushes (releases), otherwise use paths-filter result | |
| if [[ "${{ startsWith(github.ref, 'refs/tags/') }}" == "true" ]]; then | |
| echo "code=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "code=${{ steps.filter.outputs.code }}" >> $GITHUB_OUTPUT | |
| fi | |
| lint: | |
| name: Lint | |
| needs: changes | |
| if: needs.changes.outputs.code == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup Go | |
| uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 | |
| with: | |
| go-version: "1.27.1" | |
| cache-dependency-path: "**/*.sum" | |
| - name: Install Task | |
| uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0 | |
| - name: Setup lint cache | |
| uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0 | |
| with: | |
| path: | | |
| ~/.cache/golangci-lint | |
| ~/.cache/go-build | |
| key: lint-cache-${{ runner.os }}-${{ hashFiles('**/*.sum') }} | |
| restore-keys: | | |
| lint-cache-${{ runner.os }}- | |
| - name: Run linters | |
| run: | | |
| task lint | |
| # `helm lint` only checks that a chart renders. The policy CronJob | |
| # templates encode behaviour (predicate translation, pagination, the | |
| # template-time rejections) that only these assertions cover. | |
| - name: Run Helm chart tests | |
| run: | | |
| task test:helm | |
| license: | |
| name: License | |
| needs: changes | |
| if: needs.changes.outputs.code == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 | |
| with: | |
| fetch-depth: 0 | |
| # Licenses are classified from the LICENSE files in the module cache, so the | |
| # check needs Go and a warm cache but no network access of its own. | |
| - name: Setup Go | |
| uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 | |
| with: | |
| go-version: "1.27.1" | |
| cache-dependency-path: "**/*.sum" | |
| - name: Install Task | |
| uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0 | |
| - name: License | |
| run: | | |
| task license | |
| verify: | |
| name: Verify | |
| needs: changes | |
| if: needs.changes.outputs.code == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install Task | |
| uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0 | |
| - name: Check auto-generated code | |
| run: | | |
| task gen | |
| if [[ -n "$(git status --porcelain)" ]]; then | |
| echo "There are uncommitted changes after running 'task gen'. Please commit these changes." | |
| exit 1 | |
| fi | |
| - name: Setup Node.js | |
| uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 | |
| with: | |
| node-version: "22" | |
| - name: Check UI build is up to date | |
| run: | | |
| task ui:build | |
| if [[ -n "$(git status --porcelain server/gateway/static)" ]]; then | |
| echo "::error::UI static files are out of date. Run 'task ui:build' and commit the changes." | |
| git diff --stat server/gateway/static | |
| exit 1 | |
| fi | |
| # This build builds local artifacts to the workflow run so that | |
| # we can load and test functionalities locally. | |
| # It does not push a tag as it includes test-specific instrumentation | |
| # and is not intended for use outside of testing. | |
| build: | |
| name: Build | |
| needs: | |
| - lint | |
| - license | |
| - verify | |
| uses: ./.github/workflows/reusable-build.yaml | |
| with: | |
| image_repo: ghcr.io/agntcy | |
| image_tag: ${{ github.sha }} | |
| # This build pushes a "latest" tag to the repo so that we can later do | |
| # security posture analysis and post-check tests in other workflows. | |
| # It does not include any test-specific instrumentation. | |
| # Only run for push to main, nothing else (tags/releases/PRs) | |
| push: | |
| name: Push | |
| if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }} | |
| needs: | |
| - lint | |
| - license | |
| - verify | |
| uses: ./.github/workflows/reusable-build.yaml | |
| with: | |
| image_repo: ghcr.io/agntcy | |
| image_tag: latest | |
| push: true | |
| helm-push-latest: | |
| name: Helm push (latest) | |
| if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }} | |
| needs: | |
| - push | |
| uses: ./.github/workflows/reusable-release-helm.yaml | |
| with: | |
| image_repo: ghcr.io/agntcy | |
| release_tag: 0.0.0-latest | |
| test: | |
| name: Test | |
| needs: | |
| - build | |
| uses: ./.github/workflows/reusable-test.yaml | |
| with: | |
| image_repo: ghcr.io/agntcy | |
| image_tag: ${{ github.sha }} | |
| cross-platform: | |
| name: Cross-Platform Test | |
| needs: | |
| - build | |
| uses: ./.github/workflows/reusable-test-e2e-cross-platform.yaml | |
| coverage: | |
| name: Coverage | |
| needs: [ test ] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 | |
| with: | |
| fetch-depth: 0 | |
| - name: Download coverage artifact | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| path: .coverage | |
| pattern: "coverage-*" | |
| merge-multiple: true | |
| - name: Upload to Codecov | |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v6.0.2 | |
| with: | |
| codecov_yml_path: codecov.yml | |
| files: ".coverage/**/*.out" | |
| verbose: true | |
| use_oidc: true | |
| release: | |
| name: Release | |
| if: ${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '/') }} | |
| needs: | |
| - test | |
| uses: ./.github/workflows/reusable-release.yaml | |
| with: | |
| image_repo: ghcr.io/agntcy | |
| release_tag: ${{ github.ref_name }} | |
| integration: | |
| name: Run integration tests | |
| runs-on: ubuntu-latest | |
| needs: | |
| - release | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 | |
| with: | |
| fetch-depth: 0 | |
| - name: Run tests | |
| uses: ./.github/actions/trigger-integrations | |
| with: | |
| github-token: ${{ secrets.AGNTCY_BUILD_BOT_GH_TOKEN }} | |
| success: | |
| name: Success | |
| # https://github.com/actions/runner/issues/2566 | |
| # https://github.com/actions/toolkit/issues/581 | |
| # Success if all needed jobs either passed or were skipped (no failures/cancellations) | |
| if: ${{ !cancelled() && !contains(needs.*.result, 'cancelled') && !contains(needs.*.result, 'failure') }} | |
| needs: | |
| - changes | |
| - test | |
| - coverage | |
| - release | |
| - cross-platform | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Echo Success | |
| run: | | |
| if [[ "${{ needs.changes.outputs.code }}" == "true" ]]; then | |
| echo "::notice Success! All code checks passed." | |
| else | |
| echo "::notice Success! No code changes detected, skipped builds and tests." | |
| fi |