Add Hetzner bare-metal provisioning for the public demo #55
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| # Quality gate for every push and pull request. The compatibility-gate | |
| # workflow (bpfcompat-example.yml) demonstrates running the action against | |
| # real VMs and stays opt-in; this workflow is the cheap, fast suite that | |
| # every PR must pass before merge: | |
| # - go vet | |
| # - golangci-lint against the new diff | |
| # - go test -race -coverprofile | |
| # - govulncheck against the pinned module set | |
| # - go build for all targets | |
| # | |
| # Everything runs on the default GitHub-hosted ubuntu-latest runner so PRs | |
| # don't depend on the self-hosted KVM fleet to merge. | |
| # | |
| # Security note: every ${{ github.* }} interpolation in this file is in | |
| # a workflow-level position (concurrency, artifact name, etc.) and never | |
| # substituted into a "run:" shell block. None of github.event.*, head_ref, | |
| # or commit message fields are read here, so workflow-injection attacks | |
| # via PR titles or commit messages are not applicable to this file. | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| GO_VERSION: "1.25.11" | |
| jobs: | |
| test: | |
| name: Test (-race) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| cache: true | |
| - name: go mod download | |
| run: go mod download | |
| - name: Validate action.yml parses | |
| # The composite action ships by tag; a YAML syntax error (e.g. an | |
| # unquoted colon in a description) breaks every consumer at "Set up | |
| # job" with no way to patch the tag. Catch it before release. | |
| run: python3 -c "import yaml,glob; [yaml.safe_load(open(f)) for f in ['action.yml'] + glob.glob('.github/workflows/*.yml')]; print('ok')" | |
| - name: go vet | |
| run: go vet ./... | |
| - name: go test | |
| run: go test -race -count=1 -coverprofile=coverage.out -covermode=atomic ./... | |
| - name: Coverage summary | |
| run: go tool cover -func=coverage.out | tail -20 | |
| - name: Upload coverage artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| if: always() | |
| with: | |
| name: coverage-${{ github.run_id }} | |
| path: coverage.out | |
| if-no-files-found: warn | |
| lint: | |
| name: golangci-lint | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| cache: true | |
| - name: golangci-lint (pull request diff) | |
| if: github.event_name == 'pull_request' | |
| uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9 | |
| with: | |
| version: latest | |
| args: --timeout=5m --new-from-rev=origin/main | |
| - name: Check push diff base | |
| id: push-diff-base | |
| if: github.event_name != 'pull_request' | |
| shell: bash | |
| run: | | |
| if git rev-parse --verify HEAD~1 >/dev/null 2>&1; then | |
| echo "has_parent=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "has_parent=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: golangci-lint (push diff) | |
| if: github.event_name != 'pull_request' && steps.push-diff-base.outputs.has_parent == 'true' | |
| uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9 | |
| with: | |
| version: latest | |
| args: --timeout=5m --new-from-rev=HEAD~1 | |
| - name: golangci-lint (root commit bootstrap) | |
| if: github.event_name != 'pull_request' && steps.push-diff-base.outputs.has_parent != 'true' | |
| run: echo "Skipping diff lint because this checkout has no parent commit." | |
| vuln: | |
| name: govulncheck | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| cache: true | |
| - name: Install govulncheck | |
| run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4 | |
| - name: govulncheck | |
| run: govulncheck ./... | |
| build: | |
| name: Build (Go side) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| cache: true | |
| # The C validator (validator/c-libbpf) needs libbpf-dev + clang on the | |
| # builder which the example workflow already handles; here we only | |
| # exercise the Go side so the CI gate stays portable. | |
| - name: go build | |
| run: go build ./... |