feat(jira): jira coverage hierarchy #29 #602
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI/CD Pipeline | |
| on: | |
| push: | |
| branches: [ main ] | |
| tags: [ 'v*' ] | |
| paths-ignore: | |
| - '.github/CODEOWNERS' | |
| - '.github/SECURITY.md' | |
| - '.slsa-goreleaser/**' | |
| - '.gitignore' | |
| - 'docs/**' | |
| - '**.md' | |
| pull_request: | |
| branches: [ main ] | |
| paths-ignore: | |
| - '.github/CODEOWNERS' | |
| - '.github/SECURITY.md' | |
| - '.slsa-goreleaser/**' | |
| - '.gitignore' | |
| - 'docs/**' | |
| - '**.md' | |
| # NOTE: If your enterprise restricts GITHUB_TOKEN permissions, | |
| # create a Personal Access Token (PAT) with 'repo' and 'write:packages' scopes | |
| # and add it as a secret named 'GH_PAT' | |
| env: | |
| GO_VERSION: '1.26' | |
| DAGGER_VERSION: '0.18.14' | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository }} | |
| jobs: | |
| lint: | |
| name: Lint Code | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| - name: Download dependencies | |
| run: go mod download | |
| - name: Install mockgen | |
| run: go install github.com/golang/mock/mockgen@v1.6.0 | |
| - name: Generate mocks | |
| run: go generate ./... | |
| - uses: dagger/dagger-for-github@8.0.0 | |
| with: | |
| version: ${{ env.DAGGER_VERSION }} | |
| verb: call | |
| module: ./ci | |
| args: lint --source . | |
| test: | |
| name: Run Tests | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| - name: Install mockgen | |
| run: go install github.com/golang/mock/mockgen@v1.6.0 | |
| - name: Add Go bin to PATH | |
| run: echo "$(go env GOPATH)/bin" >> $GITHUB_PATH | |
| - name: Download dependencies | |
| run: go mod download | |
| - uses: dagger/dagger-for-github@8.0.0 | |
| with: | |
| version: ${{ env.DAGGER_VERSION }} | |
| verb: call | |
| module: ./ci | |
| args: test --source . | |
| - name: Run JS client tests | |
| run: node web/js/graphql-client-test.js | |
| - name: Run tests with coverage | |
| run: | | |
| go test -race -coverprofile=coverage.txt -covermode=atomic ./... | |
| - name: Upload coverage to Codecov | |
| uses: codecov/codecov-action@v5 | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| files: ./coverage.txt | |
| flags: unittests | |
| name: codecov-umbrella | |
| fail_ci_if_error: false | |
| security-scan: | |
| name: Security Scan (Trivy) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: dagger/dagger-for-github@8.0.0 | |
| with: | |
| version: ${{ env.DAGGER_VERSION }} | |
| verb: call | |
| module: ./ci | |
| args: security-scan --source . | |
| vulnerability-check: | |
| name: Go Vulnerability Check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| - name: Install govulncheck | |
| run: go install golang.org/x/vuln/cmd/govulncheck@v1.3.0 | |
| - name: Run govulncheck | |
| run: | | |
| # Advisory-only: || true prevents blocking merges on vulnerabilities in indirect | |
| # dependencies that have no available fix. Remove once all transitive CVEs are cleared. | |
| govulncheck ./cmd/... ./internal/... ./pkg/... || true | |
| dependency-review: | |
| name: Dependency Review | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: actions/dependency-review-action@v4.7.1 | |
| with: | |
| fail-on-severity: moderate | |
| build: | |
| name: Build Images | |
| runs-on: ubuntu-latest | |
| # For PRs, only run a single build test. For main/tags, build all platforms | |
| strategy: | |
| matrix: | |
| platform: ${{ github.event_name == 'pull_request' && fromJson('["linux/amd64"]') || fromJson('["linux/amd64", "linux/arm64"]') }} | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Cache Docker layers | |
| uses: actions/cache@v4 | |
| with: | |
| path: /tmp/.buildx-cache | |
| key: ${{ runner.os }}-buildx-${{ github.sha }} | |
| restore-keys: | | |
| ${{ runner.os }}-buildx- | |
| - uses: dagger/dagger-for-github@8.0.0 | |
| with: | |
| version: ${{ env.DAGGER_VERSION }} | |
| verb: call | |
| module: ./ci | |
| args: build --source . --platforms ${{ matrix.platform }} | |
| all-checks: | |
| name: All Checks (Main Branch) | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: dagger/dagger-for-github@8.0.0 | |
| with: | |
| version: ${{ env.DAGGER_VERSION }} | |
| verb: call | |
| module: ./ci | |
| args: all --source . | |
| upload-main-coverage: | |
| name: Upload Coverage (main) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| if: github.event.repository.fork == false && github.ref == 'refs/heads/main' | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| - run: go test -race -coverprofile=coverage.txt -covermode=atomic ./... | |
| # codecov/codecov-action v5.1.2 (pinned for security) | |
| - uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| files: ./coverage.txt | |
| flags: unittests | |
| name: main-coverage | |
| fail_ci_if_error: false |