fix(codeql): Workflow does not contain permissions (#814) #1207
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| test: | |
| runs-on: self-hosted | |
| timeout-minutes: 15 | |
| container: | |
| image: golang:1.26.5 | |
| options: --cpus=2 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Trust workspace | |
| run: git config --global --replace-all safe.directory '*' | |
| - name: Verify license headers | |
| run: bash scripts/verify-license.sh | |
| - name: Check formatting | |
| run: | | |
| unformatted="$(gofmt -s -l .)" | |
| if [ -n "$unformatted" ]; then | |
| echo "::error::Not gofmt-clean. Run 'gofmt -s -w .' and commit:" | |
| echo "$unformatted" | |
| gofmt -s -d . | |
| exit 1 | |
| fi | |
| - name: Check go.mod is tidy | |
| run: | | |
| go mod tidy | |
| if ! git diff --exit-code -- go.mod go.sum; then | |
| echo "::error::go.mod/go.sum are not tidy. Run 'go mod tidy' and commit the diff above." | |
| exit 1 | |
| fi | |
| - name: Vet | |
| run: go vet ./... | |
| - name: Govulncheck | |
| run: | | |
| go install golang.org/x/vuln/cmd/govulncheck@v1.6.0 | |
| govulncheck ./... | |
| - name: Test with coverage | |
| run: | | |
| go test -v -race -count=1 -coverprofile=coverage.out ./... | |
| go tool cover -func=coverage.out | grep total: | awk '{print $3}' | |
| - name: Check coverage threshold | |
| run: | | |
| COVERAGE=$(go tool cover -func=coverage.out | grep total: | awk '{print $3}' | sed 's/%//') | |
| echo "Total coverage: ${COVERAGE}%" | |
| if awk "BEGIN {exit !($COVERAGE < 90)}"; then | |
| echo "FAIL: Coverage ${COVERAGE}% is below 90% threshold" | |
| exit 1 | |
| fi | |
| echo "PASS: Coverage ${COVERAGE}% meets 90% threshold" | |
| - name: Build | |
| run: go build -o ./opencodereview ./cmd/opencodereview | |
| - name: Smoke test | |
| run: | | |
| ./opencodereview --version | |
| ./opencodereview --version | grep -q "open-code-review" | |
| HELP=$(./opencodereview --help) | |
| echo "$HELP" | grep -q "Commands:" | |
| echo "$HELP" | grep -q "review" | |
| echo "$HELP" | grep -q "scan" | |
| echo "$HELP" | grep -q "delegate" | |
| echo "$HELP" | grep -q "config" | |
| echo "$HELP" | grep -q "llm" | |
| echo "$HELP" | grep -q "viewer" | |
| echo "$HELP" | grep -q "session" | |
| echo "$HELP" | grep -q "rules" | |
| rm -f ./opencodereview | |
| cross-compile: | |
| runs-on: self-hosted | |
| timeout-minutes: 10 | |
| container: | |
| image: golang:1.26.5 | |
| options: --cpus=2 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - {goos: linux, goarch: arm64} | |
| - {goos: darwin, goarch: amd64} | |
| - {goos: darwin, goarch: arm64} | |
| - {goos: windows, goarch: amd64} | |
| - {goos: windows, goarch: arm64} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Trust workspace | |
| run: git config --global --replace-all safe.directory '*' | |
| - name: Build ${{ matrix.goos }}/${{ matrix.goarch }} | |
| env: | |
| GOOS: ${{ matrix.goos }} | |
| GOARCH: ${{ matrix.goarch }} | |
| CGO_ENABLED: '0' | |
| run: go build -o /dev/null ./... |