-
Notifications
You must be signed in to change notification settings - Fork 9k
81 lines (74 loc) · 2.88 KB
/
Copy pathlint.yml
File metadata and controls
81 lines (74 loc) · 2.88 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
name: Lint
on:
push:
branches:
- trunk
paths:
- "**.go"
- go.mod
- go.sum
- ".github/golangci-lint-version"
- ".github/govulncheck-version"
- ".github/licenses.tmpl"
- ".github/workflows/lint.yml"
- "script/licenses"
pull_request:
paths:
- "**.go"
- go.mod
- go.sum
- ".github/golangci-lint-version"
- ".github/govulncheck-version"
- ".github/licenses.tmpl"
- ".github/workflows/lint.yml"
- "script/licenses"
permissions:
contents: read
jobs:
lint:
runs-on: ubuntu-latest
steps:
- name: Check out code
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Set up Go
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: 'go.mod'
- name: Ensure Go source and modules are up to date
run: |
go mod tidy -diff
go fix -diff ./...
- name: golangci-lint
uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
with:
version-file: .github/golangci-lint-version
# Verify that license generation succeeds for all release platforms (GOOS/GOARCH).
# This catches issues like new dependencies with unrecognized licenses before release time.
#
# actions/setup-go does not setup the installed toolchain to be preferred over the system install,
# which causes go-licenses to raise "Package ... does not have module info" errors.
# For more information, https://github.com/google/go-licenses/issues/244#issuecomment-1885098633
- name: Verify license generation
run: |
export GOROOT=$(go env GOROOT)
export PATH=${GOROOT}/bin:$PATH
make licenses-check
# Discover vulnerabilities within Go standard libraries used to build GitHub CLI using govulncheck.
govulncheck:
runs-on: ubuntu-latest
steps:
- name: Check out code
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Set up Go
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: 'go.mod'
# `govulncheck` exits unsuccessfully if vulnerabilities are found, providing results in stdout.
# See https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck#hdr-Exit_codes for more information on exit codes.
#
# On go1.25+, To make `-mode binary` work we need to make sure the binary is built with `go build -buildvcs=false`
# Since our builds do not use `-buildvcs=false`, we run in source mode here instead.
- name: Check Go vulnerabilities
run: |
govulncheck_version=$(grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' .github/govulncheck-version)
go run "golang.org/x/vuln/cmd/govulncheck@$govulncheck_version" ./...