pipekit/.github/workflows/ci.yaml at main · AxeForging/pipekit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
name: PR

on:
  pull_request:
    types: [opened, edited, synchronize, reopened]
    branches:
      - main

permissions:
  contents: read
  pull-requests: write

jobs:
  pr-title:
    runs-on: ubuntu-latest
    steps:
      - uses: AxeForging/reusable-workflows/actions/pr-title-lint@291855e85ec985d1d318df82b8f9dce969b76933
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          pr-title: ${{ github.event.pull_request.title }}

  gauntlet:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: '1.25.13'

      - name: Build candidate and install external quality gates
        run: |
          make build
          QUALITY_BIN="$RUNNER_TEMP/quality-bin"
          mkdir -p "$QUALITY_BIN"
          cp ./dist/pipekit "$QUALITY_BIN/pipekit"
          curl -fsSL https://raw.githubusercontent.com/AxeForging/structlint/main/install.sh | \
            STRUCTLINT_VERSION=v0.6.0 STRUCTLINT_INSTALL_DIR="$QUALITY_BIN" sh
          curl -fsSL https://raw.githubusercontent.com/AxeForging/dupehound/main/install.sh | \
            DUPEHOUND_VERSION=v0.1.0 DUPEHOUND_INSTALL_DIR="$QUALITY_BIN" sh
          echo "$QUALITY_BIN" >> "$GITHUB_PATH"

      - uses: AxeForging/gauntlet@v0.1.0
        with:
          since: origin/${{ github.base_ref }}

      - name: Install govulncheck
        run: go install golang.org/x/vuln/cmd/govulncheck@latest

      - name: Vulnerability scan
        run: make vuln

      - name: Export env from JSON
        run: |
          ./dist/pipekit env from-json --flatten --uppercase-keys --to-github <<'JSON'
          {
            "name": "pipekit",
            "ci": {
              "platform": "github-actions",
              "purpose": "dogfood"
            }
          }
          JSON

      - name: Assert exported env in later step
        run: |
          ./dist/pipekit assert env-exists NAME CI_PLATFORM CI_PURPOSE
          test "$NAME" = "pipekit"
          test "$CI_PLATFORM" = "github-actions"
          test "$CI_PURPOSE" = "dogfood"

      - name: Export outputs from JSON
        id: json_outputs
        run: |
          ./dist/pipekit env from-json --uppercase-keys --to-github-output <<'JSON'
          {
            "artifact": "pipekit",
            "channel": "ci"
          }
          JSON

      - name: Assert exported outputs in later step
        env:
          ARTIFACT: ${{ steps.json_outputs.outputs.ARTIFACT }}
          CHANNEL: ${{ steps.json_outputs.outputs.CHANNEL }}
        run: |
          ./dist/pipekit assert env-exists ARTIFACT CHANNEL
          test "$ARTIFACT" = "pipekit"
          test "$CHANNEL" = "ci"

      - name: Export cache key
        id: cache_key
        run: ./dist/pipekit cache-key from-files go.sum --prefix "go-" --to-github-output cache_key

      - name: Assert cache key output in later step
        env:
          CACHE_KEY: ${{ steps.cache_key.outputs.cache_key }}
        run: |
          ./dist/pipekit assert env-exists CACHE_KEY
          case "$CACHE_KEY" in
            go-*) ;;
            *) echo "cache key missing go- prefix: $CACHE_KEY"; exit 1 ;;
          esac

      - name: Dogfood JSON, mask, exec, and summary
        run: |
          printf '{"module":"github.com/AxeForging/pipekit","kind":"ci"}\n' > pipekit-ci.json
          test "$(./dist/pipekit json get pipekit-ci.json --path '.module' --raw)" = "github.com/AxeForging/pipekit"
          ./dist/pipekit assert json-path --file pipekit-ci.json --path '.kind' --expected "ci"
          ./dist/pipekit git sha --short --to-github-output git_sha
          ./dist/pipekit git ref --slug --to-github-output ref_slug
          ./dist/pipekit checksum files dist/pipekit --output pipekit-checksums.txt
          ./dist/pipekit checksum verify pipekit-checksums.txt
          ./dist/pipekit artifact assert dist/pipekit pipekit-checksums.txt
          ./dist/pipekit artifact manifest dist/pipekit pipekit-checksums.txt --pretty --output pipekit-artifacts.json
          ./dist/pipekit changelog generate --from origin/main --conventional --output pipekit-changelog.md
          ./dist/pipekit mask github "secret-ci-value"
          ./dist/pipekit exec --attempts 2 --delay 1s --mask "secret-[a-z-]+" --tee pipekit-ci.log -- sh -c 'echo token=secret-ci-value'
          ./dist/pipekit summary badge --label "pipekit" --status success --to-github-summary
          ./dist/pipekit summary section --title "pipekit artifacts" --to-github-summary < pipekit-artifacts.json
          ./dist/pipekit summary section --title "pipekit CI log" --to-github-summary < pipekit-ci.log