Skip to content

Commit 4c15d8f

Browse files
adcondevadcondev
authored
ci(github): add ci workflows (#40)
This pull request introduces a comprehensive security model for the Scale Daemon's dashboard and WebSocket configuration, updates CI/CD workflows for improved dependency handling and build checks, and enhances developer experience with new templates and documentation.
2 parents 9023776 + f35a8dd commit 4c15d8f

23 files changed

Lines changed: 1026 additions & 93 deletions

‎.github/codeql-config.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
name: "Ticket Daemon CodeQL Config"
2+
3+
# Query settings
4+
disable-default-queries: false
5+
6+
# Queries to run
7+
queries:
8+
- uses: security-extended
9+
- uses: security-and-quality
10+
11+
# Exclude test files, examples, and vendored code
12+
paths-ignore:
13+
# Test files
14+
- '**/*_test.go'
15+
- 'test/**'
16+
- 'internal/testutils/**'
17+
18+
# Examples (not production code)
19+
- 'examples/**'
20+
21+
# Vendored dependencies
22+
- 'vendor/**'
23+
24+
# Test data
25+
- 'testdata/**'
26+
27+
# Build artifacts
28+
- '*.exe'
29+
- '*.dll'
30+
- '*.so'
31+
32+
# IDE files
33+
- '.idea/**'
34+
- '.vscode/**'
35+
36+
# Advanced: Query packs
37+
packs:
38+
- codeql/go-queries

‎.github/pull_request_template.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
## 📝 Description
2+
3+
## 🧪 Testing Strategy
4+
5+
- [ ] Unit tests passed locally
6+
- [ ] Manual test on **Local** environment
7+
- [ ] Manual test on **Remote** environment
8+
- [ ] Verified build with `task build`
9+
10+
## ✅ Checklist
11+
12+
- [ ] Code follows project style (ran `gofmt` / `golangci-lint`)
13+
- [ ] Self-reviewed code
14+
- [ ] No new meaningful warnings generated

‎.github/workflows/ci.yml‎

Lines changed: 137 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,18 @@ name: CI
33
on:
44
push:
55
branches: [ main, master ]
6+
paths-ignore:
7+
- '**.md'
8+
- 'docs/**'
69
pull_request:
710
branches: [ main, master ]
11+
paths-ignore:
12+
- '**.md'
13+
- 'docs/**'
14+
15+
concurrency:
16+
group: ${{ github.workflow }}-${{ github.ref }}
17+
cancel-in-progress: true
818

919
env:
1020
GO_VERSION: '1.24.x'
@@ -13,20 +23,74 @@ permissions:
1323
contents: read
1424

1525
jobs:
26+
pr-validation:
27+
name: 📋 PR Validation
28+
runs-on: ubuntu-latest
29+
if: github.event_name == 'pull_request'
30+
steps:
31+
- name: Checkout code
32+
uses: actions/checkout@v6
33+
with:
34+
fetch-depth: 0
35+
36+
- name: Validate PR Title
37+
uses: amannn/action-semantic-pull-request@v6
38+
env:
39+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
40+
with:
41+
types: |
42+
feat
43+
fix
44+
docs
45+
style
46+
refactor
47+
perf
48+
test
49+
build
50+
ci
51+
chore
52+
deps
53+
revert
54+
scopes: |
55+
github
56+
api
57+
web
58+
auth
59+
config
60+
daemon
61+
scale
62+
server
63+
general
64+
requireScope: true
65+
subjectPattern: ^(?![A-Z]).+$
66+
subjectPatternError: |
67+
The subject must start with lowercase letter.
68+
1669
test:
1770
name: 🧪 Test and Coverage
1871
runs-on: ubuntu-latest
72+
timeout-minutes: 10 # 🛑 Hard limit
1973

2074
steps:
2175
- name: Checkout code
2276
uses: actions/checkout@v6
2377

78+
- name: Checkout Poster library
79+
uses: actions/checkout@v6
80+
with:
81+
repository: adcondev/poster
82+
path: poster
83+
2484
- name: Setup Go
2585
uses: actions/setup-go@v6
2686
with:
2787
go-version: ${{ env.GO_VERSION }}
2888
cache: true
2989

90+
- name: Patch Go modules for CI
91+
run: |
92+
go mod edit -replace github.com/adcondev/poster=./poster
93+
3094
- name: Run tests with race detection
3195
run: go test -v -race -coverprofile=coverage.txt -covermode=atomic ./...
3296

@@ -45,6 +109,7 @@ jobs:
45109
flags: unittests
46110
name: codecov-ubuntu
47111
fail_ci_if_error: false
112+
token: ${{ secrets.CODECOV_TOKEN }}
48113

49114
benchmark:
50115
name: ⚡ Performance Benchmarks
@@ -61,6 +126,12 @@ jobs:
61126
with:
62127
fetch-depth: 0
63128

129+
- name: Checkout Poster library
130+
uses: actions/checkout@v6
131+
with:
132+
repository: adcondev/poster
133+
path: poster
134+
64135
- name: Setup Go
65136
uses: actions/setup-go@v6
66137
with:
@@ -70,14 +141,20 @@ jobs:
70141
- name: Run benchmarks (base)
71142
continue-on-error: true
72143
run: |
73-
git clean -fdx
144+
# Ignore our cloned repos so git clean doesn't delete them
145+
git clean -fdx -e poster/
146+
git reset --hard
74147
git checkout ${{ github.event.pull_request.base.sha }}
75-
go test -bench=. -benchmem -run=^$ ./... > /tmp/base-benchmark.txt 2>&1
148+
# Re-apply the patch because checkout restores the base go.mod
149+
go mod edit -replace github.com/adcondev/poster=./poster
150+
go test -bench=. -benchmem -run=^$ ./... > /tmp/base-benchmark.txt 2>&1 || true
76151
77152
- name: Run benchmarks (current)
78153
run: |
79-
git clean -fdx
154+
git clean -fdx -e poster/
155+
git reset --hard
80156
git checkout ${{ github.event.pull_request.head.sha }}
157+
go mod edit -replace github.com/adcondev/poster=./poster
81158
go test -bench=. -benchmem -run=^$ ./... > /tmp/current-benchmark.txt 2>&1
82159
83160
- name: Compare benchmarks
@@ -92,7 +169,7 @@ jobs:
92169
echo '```' >> benchmark-comment.md
93170
grep "^Benchmark" /tmp/current-benchmark.txt | head -20 >> benchmark-comment.md
94171
echo '```' >> benchmark-comment.md
95-
172+
96173
if grep -q "^Benchmark" /tmp/base-benchmark.txt; then
97174
echo "" >> benchmark-comment.md
98175
echo "### 📊 Base Branch Results" >> benchmark-comment.md
@@ -152,15 +229,70 @@ jobs:
152229
- name: Checkout code
153230
uses: actions/checkout@v6
154231

232+
- name: Checkout Poster library
233+
uses: actions/checkout@v6
234+
with:
235+
repository: adcondev/poster
236+
path: poster
237+
155238
- name: Setup Go
156239
uses: actions/setup-go@v6
157240
with:
158241
go-version: ${{ env.GO_VERSION }}
159242
cache: true
160243

244+
- name: Patch Go modules for CI
245+
run: |
246+
go mod edit -replace github.com/adcondev/poster=./poster
247+
161248
- name: Run golangci-lint
162249
uses: golangci/golangci-lint-action@v9
163250
with:
164251
version: latest
165252
skip-cache: false
166-
args: --config=./.golangci.yml --timeout=5m
253+
args: --config=.golangci.yml --timeout=5m
254+
255+
build:
256+
name: 🏗️ Build Check
257+
runs-on: ubuntu-latest
258+
needs: test # Only build if tests pass
259+
steps:
260+
- name: Checkout code
261+
uses: actions/checkout@v6
262+
263+
- name: Checkout Poster library
264+
uses: actions/checkout@v6
265+
with:
266+
repository: adcondev/poster
267+
path: poster
268+
269+
- name: Setup Go
270+
uses: actions/setup-go@v6
271+
with:
272+
go-version: ${{ env.GO_VERSION }}
273+
cache: true
274+
275+
- name: Patch Go modules for CI
276+
run: |
277+
go mod edit -replace github.com/adcondev/poster=./poster
278+
279+
- name: Install Task
280+
uses: arduino/setup-task@v2
281+
with:
282+
version: 3.x
283+
repo-token: ${{ secrets.GITHUB_TOKEN }}
284+
285+
- name: Build via Taskfile
286+
env:
287+
GOOS: windows
288+
GOARCH: amd64
289+
SCALE_AUTH_TOKEN: ${{ secrets.SCALE_AUTH_TOKEN || 'build-token' }}
290+
SCALE_DASHBOARD_HASH: ${{ secrets.SCALE_DASHBOARD_HASH || '' }}
291+
BUILD_ENV: 'remote'
292+
run: |
293+
task build
294+
295+
echo "## 📦 Build Artifact" >> $GITHUB_STEP_SUMMARY
296+
echo "| File | Size |" >> $GITHUB_STEP_SUMMARY
297+
echo "|------|------|" >> $GITHUB_STEP_SUMMARY
298+
ls -lh bin/*.exe | awk '{print "| " $9 " | " $5 " |"}' >> $GITHUB_STEP_SUMMARY

‎.github/workflows/codeql.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,14 @@ on:
88
- 'go.mod'
99
- 'go.sum'
1010
- '.github/workflows/codeql.yml'
11+
- '.github/codeql-config.yml' # Trigger on config changes too
1112
pull_request:
1213
branches: [ main, master ]
1314
paths:
1415
- '**.go'
1516
- 'go.mod'
1617
- 'go.sum'
18+
- '.github/codeql-config.yml'
1719
schedule:
1820
# Run every Monday at midnight UTC
1921
- cron: '0 0 * * 1'
@@ -51,6 +53,8 @@ jobs:
5153
uses: github/codeql-action/init@v4
5254
with:
5355
languages: ${{ matrix.language }}
56+
# ⬇️ CRITICAL: Links to your config file ⬇️
57+
config-file: ./.github/codeql-config.yml
5458

5559
- name: Autobuild
5660
uses: github/codeql-action/autobuild@v4
@@ -69,4 +73,4 @@ jobs:
6973
echo "**Language:** Go" >> $GITHUB_STEP_SUMMARY
7074
echo "**Status:** ${{ job.status }}" >> $GITHUB_STEP_SUMMARY
7175
echo "" >> $GITHUB_STEP_SUMMARY
72-
echo "📊 [View detailed results](https://github.com/${{ github.repository }}/security/code-scanning)" >> $GITHUB_STEP_SUMMARY
76+
echo "📊 [View detailed results](https://github.com/${{ github.repository }}/security/code-scanning)" >> $GITHUB_STEP_SUMMARY

‎.github/workflows/pr-automation.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,8 +53,10 @@ jobs:
5353
pr-comment:
5454
name: PR Comment
5555
runs-on: ubuntu-latest
56-
if: github.event_name == 'pull_request' && github.event.action == 'opened'
57-
56+
if: >-
57+
github.event_name == 'pull_request' &&
58+
github.event.action == 'opened' &&
59+
github.actor != github.repository_owner
5860
steps:
5961
- name: Comment on PR
6062
uses: actions/github-script@v8

‎.gitignore‎

Lines changed: 34 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,34 @@
1-
bin
2-
.task
3-
tmp
1+
# If you prefer the allow list template instead of the deny list, see community template:
2+
# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore
3+
#
4+
# Binaries for programs and plugins
5+
*.exe
6+
*.exe~
7+
*.dll
8+
*.so
9+
*.dylib
10+
11+
# Test binary, built with `go test -c`
12+
*.test
13+
14+
# Code coverage profiles and other test artifacts
15+
*.out
16+
coverage.*
17+
*.coverprofile
18+
profile.cov
19+
20+
# Dependency directories (remove the comment below to include it)
21+
# vendor/
22+
23+
# Go workspace file
24+
go.work
25+
go.work.sum
26+
27+
# Security - never commit secrets
28+
.env
29+
.env.*
30+
!.env.example
31+
32+
# Editor/IDE
33+
# .idea/
34+
# .vscode/

0 commit comments

Comments
 (0)