sith/.github/workflows/ci.yml at main · ArdurAI/sith · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
name: ci

on:
  push:
    branches: [dev, main]
  pull_request:
    branches: [dev, main]

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

env:
  GO_VERSION: "1.26.5"
  GOLANGCI_VERSION: "v2.12.2"
  GOVULNCHECK_VERSION: "v1.6.0"
  GORELEASER_VERSION: "v2.17.0"
  HELM_VERSION: "v4.2.3"
  HELM_LINUX_AMD64_SHA256: "e9b88b4ee95b18c706839c28d3a0220e5bc470e9cd9262410c90793c45ff8b7c"
  PROMETHEUS_VERSION: "v3.13.1"
  PROMETHEUS_LINUX_AMD64_SHA256: "962b812371aff838d152b6ff2d56fdb7a6396f5542f48ebf73421b9721f0d103"
  SYFT_VERSION: "v1.49.0"

jobs:
  build-test-lint:
    name: build · vet · gofmt · lint · test · e2e
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: ${{ env.GO_VERSION }}
          check-latest: false
          cache: true
          cache-dependency-path: go.sum

      - name: Download and verify modules
        run: |
          go mod download
          go mod verify

      - name: gofmt check
        run: |
          diff=$(gofmt -l .)
          if [ -n "$diff" ]; then
            echo "::error::gofmt needed on:"
            echo "$diff"
            exit 1
          fi

      - name: go vet
        run: go vet ./...

      - name: golangci-lint
        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
        with:
          version: ${{ env.GOLANGCI_VERSION }}
          args: ./...

      - name: Format and imports check
        run: golangci-lint fmt --diff ./...

      - name: Vulnerability scan
        run: |
          go install "golang.org/x/vuln/cmd/govulncheck@${GOVULNCHECK_VERSION}"
          govulncheck ./...

      - name: Build
        run: go build -trimpath ./...

      - name: Unit tests with race detector
        run: go test -race -count=1 -coverprofile=coverage.out ./...

      - name: Operator safety policy tests
        run: make test-scripts

      - name: Multi-layer tenant-isolation suite
        run: make e2e-isolation

      - name: Warm-cache TUI p95 latency
        run: make perf

      - name: Binary integration smoke test
        run: go test -race -count=1 -tags=e2e ./tests/e2e

      - name: Install pinned promtool
        run: |
          set -euo pipefail
          version="${PROMETHEUS_VERSION#v}"
          archive="$RUNNER_TEMP/prometheus.tar.gz"
          curl --fail --silent --show-error --location --proto '=https' --tlsv1.2 --retry 3 --retry-all-errors \
            --output "$archive" "https://github.com/prometheus/prometheus/releases/download/${PROMETHEUS_VERSION}/prometheus-${version}.linux-amd64.tar.gz"
          echo "${PROMETHEUS_LINUX_AMD64_SHA256}  ${archive}" | sha256sum --check --status
          tar -xzf "$archive" -C "$RUNNER_TEMP"
          install -m 0755 "$RUNNER_TEMP/prometheus-${version}.linux-amd64/promtool" "$RUNNER_TEMP/promtool"

      - name: Portable Prometheus alert contract
        run: make test-alert-rules PROMTOOL="$RUNNER_TEMP/promtool"

      - name: Immutable OCI image contract
        run: make e2e-oci

      - name: Install pinned Helm
        run: |
          set -euo pipefail
          archive="$RUNNER_TEMP/helm.tar.gz"
          curl --fail --silent --show-error --location --proto '=https' --tlsv1.2 --retry 3 --retry-all-errors \
            --output "$archive" "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz"
          echo "${HELM_LINUX_AMD64_SHA256}  ${archive}" | sha256sum --check --status
          tar -xzf "$archive" -C "$RUNNER_TEMP"
          install -m 0755 "$RUNNER_TEMP/linux-amd64/helm" "$RUNNER_TEMP/helm"

      - name: Fail-closed Helm hub chart contract
        run: make e2e-helm HELM="$RUNNER_TEMP/helm"

      - name: Install pinned kind
        run: go install sigs.k8s.io/kind@v0.32.0

      - name: Real two-cluster fan-out test
        run: make e2e-kind KIND="$(go env GOPATH)/bin/kind"

  release-snapshot:
    name: reproducible archives · SPDX SBOM · Homebrew formula
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          persist-credentials: false

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: ${{ env.GO_VERSION }}
          check-latest: false
          cache: true
          cache-dependency-path: go.sum

      - name: Install pinned Syft
        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
        with:
          syft-version: ${{ env.SYFT_VERSION }}

      - name: Install pinned GoReleaser
        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
        with:
          version: ${{ env.GORELEASER_VERSION }}
          install-only: true

      - name: Download and verify modules
        run: |
          go mod download
          go mod verify

      - name: Verify release snapshot and rebuild reproducibility
        run: make release-check