forked from open-component-model/ocm
-
Notifications
You must be signed in to change notification settings - Fork 0
138 lines (125 loc) · 5.28 KB
/
lint_and_test.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
name: lint-and-test
on:
pull_request:
workflow_call:
push:
branches:
- main
permissions:
contents: read
pull-requests: read
jobs:
test:
name: Run tests
runs-on: large_runner
steps:
- name: Self Hosted Runner Post Job Cleanup Action
uses: TooMuch4U/[email protected]
- name: Checkout
uses: actions/checkout@v4
- name: Setup Go
uses: actions/setup-go@v5
with:
go-version-file: '${{ github.workspace }}/go.mod'
cache: false
- name: Get go environment for use with cache
run: |
echo "go_cache=$(go env GOCACHE)" >> $GITHUB_ENV
echo "go_modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV
# This step will only reuse the go mod and build cache from main made during the Build,
# see lint_and_test.yaml => "test" Job
# This means it never caches by itself and PRs cannot cause cache pollution / thrashing
# This is because we have huge storage requirements for our cache because of the mass of dependencies
#
# NOTE: This is different from our regular build cache (which contains all archs and is built in a different job)
# This is because it requires caching of test dependencies, which are compiled only for linux-amd64 for test runs in CI.
- name: Restore / Reuse Cache from central build
id: cache-golang-restore
uses: actions/cache/restore@v4 # Only Restore, not build another cache (too big)
with:
path: |
${{ env.go_cache }}
${{ env.go_modcache }}
key: ${{ env.cache_name }}-${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}-${{ hashFiles('**/go.mod') }}
restore-keys: |
${{ env.cache_name }}-${{ runner.os }}-go-
env:
cache_name: run-tests-go-cache # needs to be the same key in the end as in the build step
- name: Build
run: make build -j
- name: Test
run: make install-requirements test
# NOTE: This is different from our regular build cache (which contains all archs and is built in a different job)
# This is because it requires caching of test dependencies, which are compiled only for linux-amd64 for test runs in CI.
- name: Save Cache of Build (only on main)
id: cache-golang-save
if: github.ref == 'refs/heads/main' # Only run on main, never in PR
uses: actions/cache/save@v4 # Only saves cache build-test (linux-amd64)
with:
path: |
${{ env.go_cache }}
${{ env.go_modcache }}
key: ${{ env.cache_name }}-${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}-${{ hashFiles('**/go.mod') }}
upload-chunk-size: 256000000 # default of 32MB is not really optimal for our large cache, choose 256MB instead
env:
cache_name: run-tests-go-cache # needs to be the same key in the end as in the build step
go-lint:
name: Lint Golang
runs-on: large_runner
steps:
- name: Self Hosted Runner Post Job Cleanup Action
uses: TooMuch4U/[email protected]
- name: Checkout
uses: actions/checkout@v4
- name: Setup Go
uses: actions/setup-go@v5
with:
go-version-file: '${{ github.workspace }}/go.mod'
cache: false
- name: Get go environment for use with cache
run: |
echo "go_cache=$(go env GOCACHE)" >> $GITHUB_ENV
echo "go_modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV
# This step will only reuse the go mod and build cache from main made during the Build,
# see push_ocm.yaml => "ocm-cli-latest" Job
# This means it never caches by itself and PRs cannot cause cache pollution / thrashing
# This is because we have huge storage requirements for our cache because of the mass of dependencies
- name: Restore / Reuse Cache from central build
id: cache-golang-restore
uses: actions/cache/restore@v4 # Only Restore, not build another cache (too big)
with:
path: |
${{ env.go_cache }}
${{ env.go_modcache }}
key: ${{ env.cache_name }}-${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}-${{ hashFiles('**/go.mod') }}
restore-keys: |
${{ env.cache_name }}-${{ runner.os }}-go-
env:
cache_name: ocm-cli-latest-go-cache # needs to be the same key in the end as in the build step
- name: Install goimports
run: go install golang.org/x/tools/cmd/goimports@latest
- name: Lint
run: make check
codespell: # call reusable workflow from central '.github' repo
uses: open-component-model/.github/.github/workflows/codespell.yml@main
secrets: inherit
with:
codespell-ignore: .github/config/wordlist.txt
codespell-files-glob: ./**/*.y*ml ./**/*.go
gosec:
name: Go Security Checker
runs-on: ubuntu-latest
env:
GO111MODULE: on
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Run Gosec Security Scanner
uses: securego/[email protected]
with:
args: '-no-fail -fmt sarif -out results.sarif ./...'
- name: Upload SARIF file
uses: github/codeql-action/upload-sarif@v3
with:
# Path to SARIF file relative to the root of the repository
sarif_file: results.sarif