Umputun
76d0cc2cf6
setup-go with go-version "1.25" resolved to 1.25.11, which govulncheck flags for GO-2026-5856 (ECH privacy leak in crypto/tls, fixed in go1.25.12). Pin the exact patch in ci-backend.yml and release.yml so the vuln scan passes and release binaries build on the fixed toolchain.
116 lines
3.1 KiB
YAML
116 lines
3.1 KiB
YAML
name: backend
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
tags:
|
|
paths:
|
|
- ".github/workflows/ci-backend.yml"
|
|
- "backend/**"
|
|
- "Dockerfile"
|
|
- "docker-init.sh"
|
|
- ".dockerignore"
|
|
- "!backend/scripts/**"
|
|
- "!**.md"
|
|
pull_request:
|
|
paths:
|
|
- ".github/workflows/ci-backend.yml"
|
|
- "backend/**"
|
|
- "Dockerfile"
|
|
- "docker-init.sh"
|
|
- ".dockerignore"
|
|
- "!backend/scripts/**"
|
|
- "!**.md"
|
|
|
|
jobs:
|
|
test:
|
|
name: Test & Coverage
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: debug if needed
|
|
run: if [[ "$DEBUG" == "true" ]]; then env; fi
|
|
env:
|
|
DEBUG: ${{secrets.DEBUG}}
|
|
|
|
- name: install go
|
|
uses: actions/setup-go@v6
|
|
with:
|
|
go-version: "1.25.12"
|
|
cache-dependency-path: backend
|
|
|
|
- name: test and build backend
|
|
run: |
|
|
go test -race -timeout=60s -covermode=atomic -coverprofile=$GITHUB_WORKSPACE/profile.cov_tmp ./...
|
|
cat $GITHUB_WORKSPACE/profile.cov_tmp | grep -v "_mock.go" > $GITHUB_WORKSPACE/profile.cov
|
|
go build -race ./...
|
|
working-directory: backend/app
|
|
env:
|
|
TZ: "America/Chicago"
|
|
|
|
- name: test examples
|
|
run: |
|
|
go test -race ./...
|
|
go build -race ./...
|
|
working-directory: backend/_example/memory_store
|
|
env:
|
|
TZ: "America/Chicago"
|
|
|
|
- name: golangci-lint
|
|
uses: golangci/golangci-lint-action@v9
|
|
with:
|
|
version: "v2.10.1"
|
|
working-directory: backend/app
|
|
|
|
- name: golangci-lint on example directory
|
|
uses: golangci/golangci-lint-action@v9
|
|
with:
|
|
version: "v2.10.1"
|
|
args: --config ../../.golangci.yml
|
|
working-directory: backend/_example/memory_store
|
|
|
|
- name: submit coverage
|
|
run: |
|
|
go install github.com/mattn/goveralls@latest
|
|
goveralls -service="github" -coverprofile=$GITHUB_WORKSPACE/profile.cov
|
|
working-directory: backend
|
|
env:
|
|
COVERALLS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
vulncheck:
|
|
name: Vulnerability scan
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: install go
|
|
uses: actions/setup-go@v6
|
|
with:
|
|
go-version: "1.25.12"
|
|
# both go.sum files so the cache key covers the main and example modules scanned below
|
|
cache-dependency-path: |
|
|
backend/go.sum
|
|
backend/_example/memory_store/go.sum
|
|
|
|
- name: govulncheck
|
|
run: |
|
|
go install golang.org/x/vuln/cmd/govulncheck@v1.5.0
|
|
govulncheck ./...
|
|
(cd _example/memory_store && govulncheck ./...)
|
|
working-directory: backend
|
|
env:
|
|
# ignore the committed vendor dirs and resolve modules from the cache so
|
|
# both the main module and the nested example module scan consistently
|
|
GOFLAGS: "-mod=readonly"
|