Dmitry VerkhoturovandUmputun
d1f8cf412b
Nothing in CI guarded against known vulnerabilities in the Go dependency tree. Add a vulncheck job that runs govulncheck over the backend module on every backend change. The version is pinned rather than tracking latest for reproducible runs. Current tree scans clean.
116 lines
3.1 KiB
YAML
116 lines
3.1 KiB
YAML
name: backend
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
tags:
|
|
paths:
|
|
- ".github/workflows/ci-backend.yml"
|
|
- "backend/**"
|
|
- "Dockerfile"
|
|
- "docker-init.sh"
|
|
- ".dockerignore"
|
|
- "!backend/scripts/**"
|
|
- "!**.md"
|
|
pull_request:
|
|
paths:
|
|
- ".github/workflows/ci-backend.yml"
|
|
- "backend/**"
|
|
- "Dockerfile"
|
|
- "docker-init.sh"
|
|
- ".dockerignore"
|
|
- "!backend/scripts/**"
|
|
- "!**.md"
|
|
|
|
jobs:
|
|
test:
|
|
name: Test & Coverage
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: debug if needed
|
|
run: if [[ "$DEBUG" == "true" ]]; then env; fi
|
|
env:
|
|
DEBUG: ${{secrets.DEBUG}}
|
|
|
|
- name: install go
|
|
uses: actions/setup-go@v6
|
|
with:
|
|
go-version: "1.25"
|
|
cache-dependency-path: backend
|
|
|
|
- name: test and build backend
|
|
run: |
|
|
go test -race -timeout=60s -covermode=atomic -coverprofile=$GITHUB_WORKSPACE/profile.cov_tmp ./...
|
|
cat $GITHUB_WORKSPACE/profile.cov_tmp | grep -v "_mock.go" > $GITHUB_WORKSPACE/profile.cov
|
|
go build -race ./...
|
|
working-directory: backend/app
|
|
env:
|
|
TZ: "America/Chicago"
|
|
|
|
- name: test examples
|
|
run: |
|
|
go test -race ./...
|
|
go build -race ./...
|
|
working-directory: backend/_example/memory_store
|
|
env:
|
|
TZ: "America/Chicago"
|
|
|
|
- name: golangci-lint
|
|
uses: golangci/golangci-lint-action@v9
|
|
with:
|
|
version: "v2.10.1"
|
|
working-directory: backend/app
|
|
|
|
- name: golangci-lint on example directory
|
|
uses: golangci/golangci-lint-action@v9
|
|
with:
|
|
version: "v2.10.1"
|
|
args: --config ../../.golangci.yml
|
|
working-directory: backend/_example/memory_store
|
|
|
|
- name: submit coverage
|
|
run: |
|
|
go install github.com/mattn/goveralls@latest
|
|
goveralls -service="github" -coverprofile=$GITHUB_WORKSPACE/profile.cov
|
|
working-directory: backend
|
|
env:
|
|
COVERALLS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
vulncheck:
|
|
name: Vulnerability scan
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: install go
|
|
uses: actions/setup-go@v6
|
|
with:
|
|
go-version: "1.25"
|
|
# both go.sum files so the cache key covers the main and example modules scanned below
|
|
cache-dependency-path: |
|
|
backend/go.sum
|
|
backend/_example/memory_store/go.sum
|
|
|
|
- name: govulncheck
|
|
run: |
|
|
go install golang.org/x/vuln/cmd/govulncheck@v1.5.0
|
|
govulncheck ./...
|
|
(cd _example/memory_store && govulncheck ./...)
|
|
working-directory: backend
|
|
env:
|
|
# ignore the committed vendor dirs and resolve modules from the cache so
|
|
# both the main module and the nested example module scan consistently
|
|
GOFLAGS: "-mod=readonly"
|