monk/.github/workflows/test-cli.yaml at main · nitrictech/monk · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
name: Test CLI

on:
  push:
    branches:
      - "**"
    paths:
      - "cli/**"
      - ".github/workflows/test-cli.yaml"

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ./cli
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.24.3"
          cache-dependency-path: |
            go.work.sum
            cli/go.sum

      - name: Install dependencies
        run: |
          cd ..
          go work sync
          cd cli
          go mod download
          go mod verify

      - name: Run tests
        run: go test -v -race -coverprofile=coverage.out -covermode=atomic ./pkg/...

  lint:
    name: Lint
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ./cli
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.24.3"
          cache-dependency-path: |
            go.work.sum
            cli/go.sum

      - name: Run golangci-lint
        uses: golangci/golangci-lint-action@v6
        with:
          version: latest
          working-directory: cli
          args: --timeout=5m

  build:
    name: Build
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        arch: [amd64, arm64]
        exclude:
          # Exclude Windows ARM64 as it's not commonly supported
          - os: windows-latest
            arch: arm64
    runs-on: ${{ matrix.os }}
    defaults:
      run:
        working-directory: ./cli
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.24.3"
          cache-dependency-path: |
            go.work.sum
            cli/go.sum

      - name: Build binary
        env:
          GOOS: ${{ runner.os == 'Linux' && 'linux' || runner.os == 'macOS' && 'darwin' || 'windows' }}
          GOARCH: ${{ matrix.arch }}
        run: make build

  security:
    name: Security Scan
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ./cli
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.24.3"
          cache-dependency-path: |
            go.work.sum
            cli/go.sum

      - name: Run gosec Security Scanner
        uses: securego/gosec@master
        with:
          args: "-no-fail -fmt sarif -out results.sarif ./cli/..."

  # Summary job - useful for branch protection rules
  # This job waits for all parallel jobs to complete
  ci-success:
    name: All Checks Pass
    needs: [test, lint, build, security]
    runs-on: ubuntu-latest
    if: always()
    steps:
      - name: Verify all jobs passed
        run: |
          if [[ "${{ contains(needs.*.result, 'failure') }}" == "true" ]]; then
            echo "❌ One or more CI checks failed"
            exit 1
          elif [[ "${{ contains(needs.*.result, 'cancelled') }}" == "true" ]]; then
            echo "⚠️ One or more CI checks were cancelled"
            exit 1
          fi
          echo "✅ All CI checks passed successfully!"