lua-pure/.github/workflows/ci.yml at main · htcom-code/lua-pure · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
# GitHub Actions CI — mirrors the Makefile's verification discipline
# (vet → test/race → conformance → build, plus bench) on pull requests and
# pushes to main, and only when source files change (doc-only changes are
# skipped). The Makefile is the single source of truth: jobs call `make <target>`
# where a target exists; the extra hardening steps (gofmt gate, govulncheck,
# cross-platform build, coverage) are CI-only and call `go` directly.
#
# luapure is a zero-dependency pure-Go port, so there is no go.sum: `make test`
# is already race-enabled and `make conformance` runs the official Lua 5.4
# fixtures as a hard gate.

name: CI

on:
  push:
    branches: [main]
    paths:
      - "**/*.go"
      - "go.mod"
      - "Makefile"
      - "conformance/**"
      - "_lua5.4-tests/**"
      - "_glue5.4-tests/**"
      - ".github/workflows/ci.yml"
  pull_request:
    paths:
      - "**/*.go"
      - "go.mod"
      - "Makefile"
      - "conformance/**"
      - "_lua5.4-tests/**"
      - "_glue5.4-tests/**"
      - ".github/workflows/ci.yml"

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # Fast fail on formatting before spending time on the heavier jobs.
  format:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
      - name: gofmt
        run: |
          unformatted=$(gofmt -l .)
          if [ -n "$unformatted" ]; then
            echo "These files are not gofmt-clean:"; echo "$unformatted"
            exit 1
          fi

  # The canonical pre-push gate: vet → race-enabled tests (with coverage) →
  # official Lua 5.4 conformance fixtures. Equivalent to `make check` minus the
  # build step (which the cross-platform build job below proves separately).
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod # tracks the toolchain pinned in go.mod
          cache: true # build cache, keyed on go.mod (no go.sum: zero deps)
      - run: make vet
      # `make test` is `go test -race -count=1 ./...`; add a coverage profile.
      # covermode=atomic is required under -race.
      - name: test (race, with coverage)
        run: go test -race -covermode=atomic -coverprofile=coverage.out -count=1 ./...
      - name: conformance (official Lua 5.4 fixtures)
        run: make conformance
      - name: upload coverage
        uses: actions/upload-artifact@v7
        with:
          name: coverage
          path: coverage.out
          if-no-files-found: warn

  # Scan dependencies and code for known vulnerabilities.
  govulncheck:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: true
      - name: govulncheck
        env:
          # govulncheck@latest requires a newer Go than go.mod pins; allow the
          # toolchain to auto-upgrade for the tool install. setup-go v6 defaults
          # GOTOOLCHAIN to "local", which otherwise blocks this.
          GOTOOLCHAIN: auto
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          govulncheck ./...

  # build runs only after verify passes, mirroring the Makefile's
  # "build only after tests pass", and proves the engine + all `go` targets are
  # cross-platform. `make` isn't assumed on Windows, so call `go` directly.
  build:
    needs: verify
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: true
      - run: go vet ./...
      - run: go build ./...

  # bench is observational, not a gate — a slow/noisy run must not fail CI.
  bench:
    needs: verify
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: true
      - run: make bench