Go #59

Workflow file for this run

	name: Go

	on:
	push:
	branches: [main]
	pull_request:
	types: [opened, synchronize, reopened, ready_for_review]
	workflow_dispatch:

	# Workflow default: read-only. Each job widens as needed.
	permissions:
	contents: read

	# Cancel superseded PR runs; never cancel main pushes.
	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: ${{ github.event_name == 'pull_request' }}

	jobs:
	golangci:
	name: Go Lint
	runs-on: ubuntu-latest
	# Skip drafts so WIP PRs don't burn minutes until they're ready.
	if: github.event_name != 'pull_request' \|\| !github.event.pull_request.draft
	steps:
	- name: Checkout repository
	uses: actions/checkout@v7

	- name: Set up Go
	uses: actions/setup-go@v6
	with:
	go-version-file: ./go.mod
	cache: false # gh-attach has zero external deps — nothing to cache

	- name: golangci-lint
	uses: golangci/golangci-lint-action@v9
	with:
	# Run with golangci-lint's default linter set. No .golangci.yml,
	# no linter overrides — start clean and only add rules if and
	# when a real need comes up.
	only-new-issues: ${{ github.event_name == 'pull_request' }}
	version: latest
	skip-cache: true
	problem-matchers: true

	license:
	name: License Check
	runs-on: ubuntu-latest
	# Skip drafts so WIP PRs don't burn minutes until they're ready.
	if: github.event_name != 'pull_request' \|\| !github.event.pull_request.draft
	steps:
	- name: Checkout repository
	uses: actions/checkout@v7

	- name: Set up Go
	uses: actions/setup-go@v6
	with:
	go-version-file: ./go.mod
	cache: false # gh-attach has zero external deps — nothing to cache

	- name: Validate dependency licenses
	uses: enthus-appdev/oss-actions/go-license-validator@v1
	with:
	# Forbidden licenses. The copyleft family (GPL/LGPL/AGPL)
	# would force gh-attach to relicense or vendor-patch any dep
	# that picks one up; the source-available set
	# (SSPL/BUSL/Elastic/Commons-Clause) prevents the tool from
	# being used in common commercial and SaaS contexts. Both
	# groups are incompatible with the project's permissive MIT
	# licensing, so anything from either family should block a
	# merge. gh-attach currently has zero external dependencies
	# so this check is pure future-proofing — it'll fire the
	# moment a future PR brings in a dep with an incompatible
	# license.
	forbidden_licenses: "GPL-3.0;GPL-2.0;LGPL-3.0;LGPL-2.1;AGPL-3.0;SSPL-1.0;BUSL-1.1;Elastic-2.0;Commons-Clause"

	test:
	name: Go Test
	runs-on: ubuntu-latest
	# Skip drafts so WIP PRs don't burn minutes until they're ready.
	if: github.event_name != 'pull_request' \|\| !github.event.pull_request.draft
	permissions:
	contents: write # vladopajic/go-test-coverage pushes the badge SVG to `badges` branch on main
	actions: read # dawidd6/action-download-artifact reads prior run artifacts for PR coverage diff
	steps:
	- name: Checkout repository
	uses: actions/checkout@v7

	- name: Set up Go
	uses: actions/setup-go@v6
	with:
	go-version-file: ./go.mod
	cache: false # gh-attach has zero external deps — nothing to cache

	- name: Test with coverage
	# -coverpkg=./internal/... limits coverage measurement to the
	# internal packages that actually contain logic. cmd/gh-attach
	# is a 3-statement entry-point wrapper; including it would
	# drag the total down for no meaningful reason.
	run: go test -coverpkg=./internal/... -coverprofile=cover.out ./...

	- name: Archive code coverage results
	uses: actions/upload-artifact@v7
	with:
	name: code-coverage
	path: cover.out

	# Download the most recent main.breakdown artifact so the coverage check
	# below can produce a PR diff. The first PR after this workflow is added
	# won't have a baseline yet — that's expected and the report will simply
	# show absolute numbers without a delta.
	- name: Download main.breakdown baseline
	id: download-main-breakdown
	if: github.event_name == 'pull_request'
	uses: dawidd6/action-download-artifact@v21
	with:
	branch: main
	workflow_conclusion: success
	name: main.breakdown
	if_no_artifact_found: warn

	- name: Check test coverage
	id: coverage
	uses: vladopajic/go-test-coverage/action/source@v2
	with:
	profile: cover.out
	# Badge push: main runs only. On PRs the token is empty so the
	# action runs in read-only mode and no push is attempted.
	git-token: ${{ github.ref_name == 'main' && secrets.GITHUB_TOKEN \|\| '' }}
	git-branch: badges
	# Write main.breakdown only on main runs so PRs can use it as a diff baseline.
	breakdown-file-name: ${{ github.ref_name == 'main' && 'main.breakdown' \|\| '' }}
	# Use the downloaded baseline on PRs; empty string disables the diff.
	diff-base-breakdown-file-name: ${{ steps.download-main-breakdown.outputs.found_artifact == 'true' && 'main.breakdown' \|\| '' }}

	- name: Upload main.breakdown for future PR comparison
	if: github.ref_name == 'main'
	uses: actions/upload-artifact@v7
	with:
	name: main.breakdown
	path: main.breakdown
	if-no-files-found: error

	code_coverage:
	name: Code coverage report
	if: github.event_name == 'pull_request' && !github.event.pull_request.draft
	runs-on: ubuntu-latest
	needs: test
	permissions:
	contents: read
	actions: read # download the code-coverage artifact from the test job
	pull-requests: write # post the per-PR coverage diff comment
	steps:
	- uses: fgrosse/go-coverage-report@v1.3.0
	with:
	coverage-artifact-name: code-coverage
	coverage-file-name: cover.out

Navigation Menu

Uh oh!

Go #59

Workflow file

Go #59

Uh oh!

Workflow file for this run