Repository navigation
chore: merge develop → main #490
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main, develop] | |
| permissions: | |
| contents: read | |
| jobs: | |
| build: | |
| name: Build · test · vet | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| go-version: ["1.26.x"] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Go ${{ matrix.go-version }} | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: ${{ matrix.go-version }} | |
| cache: true | |
| - name: Verify module integrity | |
| run: go mod verify | |
| - name: Verify GitHub Action immutable SHA pinning | |
| run: | | |
| # Enforce Hard Rule #7: All GitHub Actions must use 40-character commit SHAs | |
| UNPINNED=$(grep -rn -P "uses:\s*[a-zA-Z0-9_-]+/[a-zA-Z0-9_-]+@(?![a-f0-9]{40}\b)" .github/workflows/ || true) | |
| if [ -n "$UNPINNED" ]; then | |
| echo "ERROR: Unpinned GitHub Action(s) found in workflows. Hard Rule #7 mandates 40-character commit SHAs:" | |
| echo "$UNPINNED" | |
| exit 1 | |
| fi | |
| echo "✓ All GitHub Action references are pinned with 40-character commit SHAs" | |
| - name: Check no local replace directives | |
| run: | | |
| if grep -P "^replace\s+\S+\s+=>\s+\.\." go.mod 2>/dev/null; then | |
| echo "ERROR: Local replace directive found in go.mod" | |
| exit 1 | |
| fi | |
| echo "✓ No local replace directives" | |
| - name: Vet | |
| run: go vet ./... | |
| - name: Build | |
| run: go build ./... | |
| - name: Test (race detector) | |
| run: go test -race -coverprofile=coverage.out ./... | |
| ci-ok: | |
| name: CI OK | |
| runs-on: ubuntu-latest | |
| needs: [build] | |
| if: always() | |
| steps: | |
| - name: Verify all CI jobs succeeded | |
| run: | | |
| # Gate estável para branch protection: o nome deste job não depende da | |
| # matrix, então não quebra quando a versão do Go mudar. | |
| # 'if: always()' é obrigatório — sem ele o job seria "skipped" quando | |
| # 'build' falha, e o GitHub trata skipped como satisfeito. | |
| RESULT="${{ needs.build.result }}" | |
| if [ "$RESULT" != "success" ]; then | |
| echo "ERROR: job 'build' concluiu como '$RESULT'" | |
| exit 1 | |
| fi | |
| echo "✓ Todos os jobs de CI passaram" |