Skip to content
CI

fix: use graycode-eco platform name instead of rho-eco #489

Sign in to view logs

fix: use graycode-eco platform name instead of rho-eco

fix: use graycode-eco platform name instead of rho-eco #489

Workflow file for this run

.github/workflows/ci.yml at b729b13
# Strict CI pipeline for graycode-eco Go repos.
# All jobs must pass — no continue-on-error except where explicitly noted.
name: CI
on:
push:
branches: [main]
pull_request:
branches: [main]
permissions:
contents: read
security-events: write
pull-requests: read
concurrency:
group: ci-${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
env:
GO_VERSION: "1.26.6"
GOPRIVATE: "github.com/GrayCodeAI/*"
GONOSUMDB: "github.com/GrayCodeAI/*"
GONOSUMCHECK: "1"
# CI must resolve the module versions pinned in go.mod/go.sum, not whatever
# sibling working trees a go.work workspace happens to point at. Go's own
# reference warns a committed go.work "may cause a continuous integration (CI)
# system to select and thus test the wrong versions of a module's
# dependencies" and that "CI systems should generally not be allowed to use
# the go.work file".
GOWORK: "off"
jobs:
# -------------------------------------------------------------------------
# 1. Format — gofumpt + goimports must be clean (zero tolerance).
# -------------------------------------------------------------------------
format:
name: format
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: ${{ env.GO_VERSION }}
cache: true
- name: Boundary guard
run: |
bash ./scripts/check-ecosystem-boundaries.sh
bash ./scripts/check-client-layering.sh
- name: gofumpt
run: |
go install mvdan.cc/gofumpt@v0.10.0
out=$(gofumpt -l .)
if [ -n "$out" ]; then
echo "::error::gofumpt would reformat:"
echo "$out" | head -20
exit 1
fi
- name: goimports
run: |
go install golang.org/x/tools/cmd/goimports@v0.30.0
out=$(goimports -l .)
if [ -n "$out" ]; then
echo "::error::goimports would reformat:"
echo "$out" | head -20
exit 1
fi
# -------------------------------------------------------------------------
# 2. Module hygiene — tidy, verify, no stray replace directives.
# -------------------------------------------------------------------------
module:
name: module hygiene
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: ${{ env.GO_VERSION }}
cache: true
- name: go mod tidy
run: |
go mod tidy
if ! git diff --quiet -- go.mod go.sum; then
echo "::error::go.mod / go.sum out of date — run 'go mod tidy'"
git diff -- go.mod go.sum
exit 1
fi
- name: go mod verify
run: go mod verify
- name: Check no local replace directives
run: make check-replace
- name: no stray replace directives
run: |
if grep -q "^\s*replace" go.mod; then
echo "::warning::go.mod contains replace directives (should use go.work for local dev)"
fi
# -------------------------------------------------------------------------
# 3. Vet + static analysis — compiler-level correctness.
# -------------------------------------------------------------------------
vet:
name: vet
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: ${{ env.GO_VERSION }}
cache: true
- name: go vet
run: go vet ./...
# -------------------------------------------------------------------------
# 4. Lint — golangci-lint with project-specific config.
# -------------------------------------------------------------------------
lint:
name: lint
runs-on: ubuntu-latest
needs: [format, vet]
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: ${{ env.GO_VERSION }}
cache: true
- name: Boundary guard
run: |
bash ./scripts/check-ecosystem-boundaries.sh
bash ./scripts/check-client-layering.sh
- name: Run golangci-lint
run: |
go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.1.0
golangci-lint run --timeout=5m
# -------------------------------------------------------------------------
# 5. Tests — race detector, coverage threshold, test shuffling.
# -------------------------------------------------------------------------
test:
name: test (race + coverage)
runs-on: ubuntu-latest
needs: [format, vet]
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: ${{ env.GO_VERSION }}
cache: true
- name: Boundary guard
run: |
bash ./scripts/check-ecosystem-boundaries.sh
bash ./scripts/check-client-layering.sh
- name: Test with race detector
run: go test ./... -race -count=1 -shuffle=on -coverprofile=coverage.out -covermode=atomic -timeout=300s
- name: Coverage summary
run: |
coverage=$(go tool cover -func=coverage.out | grep total | awk '{print $3}' | tr -d '%' | tail -1)
echo "Coverage: ${coverage}%"
echo "COVERAGE=${coverage}" >> "$GITHUB_ENV"
- name: Coverage threshold (minimum 60%)
run: |
if (( $(echo "${COVERAGE} < 60" | bc -l) )); then
echo "::error::Coverage ${COVERAGE}% is below minimum 60%"
exit 1
fi
- name: Upload coverage
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: coverage-${{ github.job }}
path: coverage.out
retention-days: 30
# -------------------------------------------------------------------------
# 6. Security — vulnerability scan + secret detection.
# -------------------------------------------------------------------------
security:
name: security
runs-on: ubuntu-latest
needs: [format, vet]
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: ${{ env.GO_VERSION }}
cache: true
- name: govulncheck
run: |
go install golang.org/x/vuln/cmd/govulncheck@v1.1.4
govulncheck ./...
- name: gosec (advisory)
run: |
go install github.com/securego/gosec/v2/cmd/gosec@v2.22.4
gosec -exclude=G104,G703,G704,G101,G107,G112,G114,G115,G201,G202,G203,G204,G301,G302,G304,G305,G306,G307,G401,G402,G403,G404,G501,G502,G503,G504,G505,G601,G602 -confidence=medium -severity=high ./...
# -------------------------------------------------------------------------
# Dead code detection.
# -------------------------------------------------------------------------
deadcode:
name: deadcode
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: ${{ env.GO_VERSION }}
cache: true
- name: deadcode
run: |
go install golang.org/x/tools/cmd/deadcode@v0.30.0
deadcode -test ./...
# -------------------------------------------------------------------------
# Duplication detection — jscpd.
# -------------------------------------------------------------------------
jscpd:
name: duplication
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: '24'
- name: jscpd
run: |
npx --yes jscpd@5.0.12 --min-lines 5 --min-tokens 50 --reporters console --blame .
# -------------------------------------------------------------------------
# 7. Secret scan — detect leaked API keys, tokens, credentials.
# -------------------------------------------------------------------------
secrets:
name: secrets
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: trufflesecurity/trufflehog@27b0417c16317ca9a472a9a8092acce143b49c55 # v3.95.9
with:
extra_args: --only-verified
# -------------------------------------------------------------------------
# 8. Markdown lint — validate documentation quality.
# -------------------------------------------------------------------------
markdown:
name: markdown
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Run markdownlint-cli2
run: |
npm install -g markdownlint-cli2
markdownlint-cli2 '**/*.md'
# -------------------------------------------------------------------------
# 9. Fuzz the message-sanitization and cache-key helpers that consume
# untrusted/adversarial LLM conversation content.
# -------------------------------------------------------------------------
fuzz:
name: fuzz (60s)
runs-on: ubuntu-latest
needs: [test]
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: ${{ env.GO_VERSION }}
cache: true
- name: Run fuzz targets
run: |
go test -fuzz=FuzzSanitizeMessages -fuzztime=60s ./client
go test -fuzz=FuzzMergeConsecutiveRoles -fuzztime=60s ./client
go test -fuzz=FuzzBuildCacheKey -fuzztime=60s ./client
go test -fuzz=FuzzGuardrailsCheck -fuzztime=60s ./client
# -------------------------------------------------------------------------
# 10. Cross-platform build matrix — zero CGO, all targets.
# -------------------------------------------------------------------------
build:
name: build (${{ matrix.goos }}/${{ matrix.goarch }})
runs-on: ubuntu-latest
needs: [format, lint, test, security]
strategy:
fail-fast: false
matrix:
goos: [linux, darwin, windows]
goarch: [amd64, arm64]
exclude:
- goos: windows
goarch: arm64
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: ${{ env.GO_VERSION }}
cache: true
- name: Build (library — cross-compile all packages)
env:
GOOS: ${{ matrix.goos }}
GOARCH: ${{ matrix.goarch }}
CGO_ENABLED: "0"
run: go build -trimpath -v ./...