Repository navigation
ci: no Blacksmith builder's config to ignore #243
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Go CLI | |
| on: | |
| push: | |
| branches: [main, master] | |
| pull_request: | |
| branches: [main, master] | |
| workflow_dispatch: {} | |
| schedule: | |
| # Daily 06:00 UTC: the full runtime parity matrix + publish parity. On | |
| # push/PR only the cases affected by the change run (see parity-runtime). | |
| - cron: "0 6 * * *" | |
| # Least privilege for every job in this workflow: the jobs only check out the repo. | |
| # A job that needs more must widen it | |
| # for itself. Without this default, GITHUB_TOKEN falls back to the repository's | |
| # (possibly write) default — see the CodeQL "workflow does not contain permissions" | |
| # rule, which TestWorkflowsDeclarePermissions pins. | |
| permissions: | |
| contents: read | |
| jobs: | |
| lint-and-test: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7 | |
| with: | |
| go-version-file: go.mod | |
| - run: go tool task lint | |
| - run: go tool task spec:compliance | |
| - run: go tool task vuln | |
| - run: go tool task test:race | |
| - run: go tool task coverage | |
| - name: Coverage summary | |
| if: always() | |
| run: go tool task coverage:summary SRC=coverage.out TITLE="unit (hermetic)" | |
| - run: go tool task test:integration | |
| - run: go tool task build | |
| - run: go tool task build:smoke | |
| # Binary covdata for the cross-lane merge (coverage-report job). | |
| - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 | |
| if: always() | |
| with: | |
| name: covdata-unit | |
| path: artifacts/coverage/data/unit | |
| if-no-files-found: error | |
| e2e: | |
| runs-on: ubuntu-latest | |
| needs: lint-and-test | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7 | |
| with: | |
| go-version-file: go.mod | |
| - run: go tool task coverage:e2e | |
| - name: Coverage summary | |
| if: always() | |
| run: go tool task coverage:summary SRC=artifacts/coverage/data/e2e TITLE=e2e | |
| - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 | |
| if: always() | |
| with: | |
| name: covdata-e2e | |
| path: artifacts/coverage/data/e2e | |
| if-no-files-found: error | |
| - if: always() | |
| run: go tool task clean | |
| # Hermetic parity gate: read-configuration golden comparison + the contract | |
| # lane of the parity matrix (flag validation / output contract, no Docker). | |
| parity: | |
| runs-on: ubuntu-latest | |
| needs: lint-and-test | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| submodules: recursive | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7 | |
| with: | |
| go-version-file: go.mod | |
| # pnpm installs the reference, through the firewall (task reference); pnpm 11 needs Node 22.13+. | |
| - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 | |
| with: | |
| version: 11.27.1 | |
| - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7 | |
| with: | |
| node-version: "24" | |
| - run: go tool task reference | |
| - run: go tool task parity:contract | |
| - run: go tool task parity:network | |
| # Coverage is measured separately with an instrumented Go binary. Keep the | |
| # functional parity run above release-like, and avoid conflating subprocess | |
| # coverage with the hermetic unit profile. | |
| - run: go tool task coverage:parity-contract | |
| - name: Coverage summary | |
| if: always() | |
| run: go tool task coverage:summary SRC=artifacts/coverage/data/contract TITLE=parity:contract | |
| - if: always() | |
| run: go tool task reference:commit | |
| - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 | |
| if: always() | |
| with: | |
| name: parity-contract-network-v0.89.0 | |
| path: artifacts/ | |
| if-no-files-found: error | |
| - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 | |
| if: always() | |
| with: | |
| name: covdata-contract | |
| path: artifacts/coverage/data/contract | |
| if-no-files-found: error | |
| # "Did the repo change today?" gate for the expensive daily lanes. Manual dispatch | |
| # always runs; a scheduled run only proceeds when HEAD has a commit within the last | |
| # day (devtool daily-changed) — on a private/billed repo this skips the daily matrix | |
| # on quiet days. Runs on schedule/dispatch so the daily lanes' `needs:` is satisfied. | |
| daily-changes: | |
| if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' | |
| runs-on: ubuntu-latest | |
| outputs: | |
| run: ${{ steps.check.outputs.run }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7 | |
| with: | |
| go-version-file: go.mod | |
| - id: check | |
| run: go tool task ci:daily-changes | |
| # Single sharded runtime parity matrix, parameterized by event: | |
| # push/PR — SCOPED to the commands the diff can affect (devtool parity-affected), | |
| # run with the plain binary: a fast gate (the full matrix is ~45 min). | |
| # daily — the FULL matrix with the instrumented binary, so one run gates parity | |
| # AND measures coverage; daily-changes keeps it off on quiet days. | |
| # 4 shards across independent runners (each its own docker daemon) so the matrix | |
| # never contends for one runner's CPU/disk/daemon. PARITY_SHARD_TOTAL MUST equal the | |
| # length of matrix.shard — parity_sharding_workflow_test.go enforces it so a mismatch | |
| # can't silently drop cases. | |
| parity-runtime: | |
| needs: [lint-and-test, daily-changes] | |
| # Every push/PR, and on schedule/dispatch only when the repo changed. always() so a | |
| # skipped daily-changes (push/PR) doesn't skip this job; the explicit lint-and-test | |
| # check restores the normal "needs succeeded" gate. | |
| if: >- | |
| always() | |
| && needs.lint-and-test.result == 'success' | |
| && (github.event_name == 'push' || github.event_name == 'pull_request' | |
| || needs.daily-changes.outputs.run == 'true') | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| shard: [0, 1, 2, 3] | |
| env: | |
| PARITY_RUNTIME_TIMEOUT: "10m" | |
| # Each shard owns ~a quarter of the selected cases; -parallel 2 per 2-core runner | |
| # is the proven-safe load (per-case id-label / COMPOSE_PROJECT_NAME isolation). | |
| PARITY_PARALLEL: "2" | |
| PARITY_SHARD_INDEX: ${{ matrix.shard }} | |
| PARITY_SHARD_TOTAL: "4" | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| submodules: recursive | |
| # Full history so the push/PR diff base is present for the affected mapping. | |
| fetch-depth: 0 | |
| # devtool (the affected mapping) runs before the composite setup, so Go here. | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7 | |
| with: | |
| go-version-file: go.mod | |
| - name: Plan this run | |
| id: plan | |
| # A pull request's diff is its base..head; a push's, what it moved the branch from..to. | |
| env: | |
| DIFF_BASE: ${{ github.event.pull_request.base.sha || github.event.before }} | |
| DIFF_HEAD: ${{ github.event.pull_request.head.sha || github.sha }} | |
| run: go tool task parity:plan | |
| - if: steps.plan.outputs.run == 'true' | |
| uses: ./.github/actions/setup-parity-runtime | |
| # push/PR: scoped, plain binary — a fast gate. | |
| - name: Run parity (scoped, plain) | |
| if: steps.plan.outputs.run == 'true' && (github.event_name == 'push' || github.event_name == 'pull_request') | |
| env: | |
| PARITY_COMMAND: ${{ steps.plan.outputs.commands }} | |
| run: go tool task parity:runtime | |
| # daily: full matrix, instrumented binary — gates parity AND measures coverage. | |
| - name: Run parity (full, instrumented) | |
| if: steps.plan.outputs.run == 'true' && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') | |
| run: go tool task coverage:parity-runtime | |
| - name: Coverage summary | |
| if: always() && steps.plan.outputs.run == 'true' && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') | |
| run: go tool task coverage:summary SRC=artifacts/coverage/data/runtime TITLE="parity:runtime shard $PARITY_SHARD_INDEX" | |
| - if: always() && steps.plan.outputs.run == 'true' | |
| run: go tool task reference:commit | |
| - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 | |
| if: always() && steps.plan.outputs.run == 'true' | |
| with: | |
| name: parity-runtime-v0.89.0-shard-${{ matrix.shard }} | |
| path: artifacts/ | |
| if-no-files-found: error | |
| # daily only: covdata slice for the cross-lane merge (distinct name per shard). | |
| - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 | |
| if: always() && steps.plan.outputs.run == 'true' && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') | |
| with: | |
| name: covdata-runtime-shard-${{ matrix.shard }} | |
| path: artifacts/coverage/data/runtime | |
| if-no-files-found: error | |
| - if: always() && steps.plan.outputs.run == 'true' | |
| run: go tool task clean | |
| # Publish parity (features/templates → ephemeral OCI registry). Daily only, its own | |
| # job so it doesn't steal a runtime shard's runner. | |
| parity-publish-full: | |
| needs: [lint-and-test, daily-changes] | |
| if: needs.daily-changes.outputs.run == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| submodules: recursive | |
| - uses: ./.github/actions/setup-parity-runtime | |
| - run: go tool task coverage:parity-publish | |
| - name: Coverage summary | |
| if: always() | |
| run: go tool task coverage:summary SRC=artifacts/coverage/data/publish TITLE=parity:publish | |
| - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 | |
| if: always() | |
| with: | |
| name: covdata-publish | |
| path: artifacts/coverage/data/publish | |
| if-no-files-found: error | |
| - if: always() | |
| run: go tool task clean | |
| # Single gate + cross-lane coverage for ALL events (absorbs the old push/PR | |
| # parity-runtime aggregator, the daily report, and the per-PR coverage-report): | |
| # gates the runtime matrix (and, on daily, publish) into one pass/fail, and merges | |
| # every lane's covdata (unit + e2e + contract, plus the daily runtime shards + | |
| # publish) into the one true cross-lane number. | |
| parity-runtime-gate: | |
| if: always() | |
| runs-on: ubuntu-latest | |
| needs: [lint-and-test, e2e, parity, parity-runtime, parity-publish-full] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7 | |
| with: | |
| go-version-file: go.mod | |
| - name: Download all lane covdata | |
| uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 | |
| with: | |
| pattern: covdata-* | |
| path: artifacts/coverage/data | |
| - name: Normalize lane dirs | |
| run: go tool task coverage:unpack | |
| - name: Merged coverage report | |
| run: go tool task coverage:merge | |
| - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 | |
| with: | |
| name: covdata-merged | |
| path: artifacts/coverage/data/merged.out | |
| if-no-files-found: warn | |
| # Final verdict last, so coverage is posted even when a shard failed. A skipped | |
| # lane (publish on push/PR, or the whole matrix on a quiet daily) counts as pass. | |
| - name: Gate on runtime + publish | |
| env: | |
| RUNTIME_RESULT: ${{ needs.parity-runtime.result }} | |
| PUBLISH_RESULT: ${{ needs.parity-publish-full.result }} | |
| run: go tool task parity:gate | |
| cross-compile: | |
| runs-on: ubuntu-latest | |
| needs: lint-and-test | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7 | |
| with: | |
| go-version-file: go.mod | |
| - run: go tool task build:cross |