ci: move to hanzoai/platform (make ci); drop GitHub Actions
Builds/runs/scans on the Hanzo PaaS (Dockerfile/Nixpacks build + scheduled 'make ci' task) instead of GHA. make ci = build + test + govulncheck + gitleaks + CycloneDX SBOM. Platform build env has cross-org (hanzoai+luxfi) git creds, so private modules resolve without the GHA token workaround. Removes .github/workflows. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
hanzo-dev
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
5333f203e0
commit
dd529b4e1c
@@ -1,15 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
echo 'set -eux' > test.sh
|
||||
|
||||
for p in $(go list ./...); do
|
||||
dir=".${p#github.com/ncruces/go-sqlite3}"
|
||||
name="$(basename "$p").test"
|
||||
(cd ${dir}; go test -c ${BUILDFLAGS:-})
|
||||
[ -f "${dir}/${name}" ] && echo "(cd ${dir}; ./${name} ${TESTFLAGS:-})" >> test.sh
|
||||
done
|
||||
|
||||
if [[ -v VMACTIONS ]]; then
|
||||
envsubst < .github/actions/vmactions/template.yml > .github/actions/vmactions/action.yml
|
||||
fi
|
||||
@@ -1,62 +0,0 @@
|
||||
name: Supply Chain Security
|
||||
|
||||
# SOC 2 CC7.x (vulnerability mgmt / monitoring) + CC8.x (change mgmt) evidence:
|
||||
# Go vuln scan, secret detection, and SBOM on every push and PR.
|
||||
|
||||
on:
|
||||
push:
|
||||
pull_request:
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
govulncheck:
|
||||
name: Go Vulnerability Scan
|
||||
runs-on: ubuntu-latest
|
||||
# Best-effort until GO_MODULE_TOKEN (a PAT/App with read access to the private
|
||||
# github.com/luxfi + github.com/hanzoai modules) is set as an org/repo secret.
|
||||
# With it, this gates hard; without it, cross-org private deps can't be built.
|
||||
continue-on-error: true
|
||||
env:
|
||||
GOPRIVATE: github.com/hanzoai,github.com/luxfi
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version-file: go.mod
|
||||
- name: Configure private module access
|
||||
run: git config --global url."https://x-access-token:${{ secrets.GO_MODULE_TOKEN || secrets.GITHUB_TOKEN }}@github.com/".insteadOf "https://github.com/"
|
||||
- name: Install govulncheck
|
||||
run: go install golang.org/x/vuln/cmd/govulncheck@latest
|
||||
- name: Run govulncheck
|
||||
run: govulncheck ./...
|
||||
|
||||
gitleaks:
|
||||
name: Secret Scan
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
- name: Run gitleaks (OSS binary — no org license required)
|
||||
run: |
|
||||
VER=8.21.2
|
||||
curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${VER}/gitleaks_${VER}_linux_x64.tar.gz" -o gl.tgz
|
||||
tar -xzf gl.tgz gitleaks
|
||||
./gitleaks detect --source . --redact --no-banner --exit-code 1
|
||||
|
||||
sbom:
|
||||
name: Generate SBOM
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Generate CycloneDX SBOM
|
||||
uses: anchore/sbom-action@v0
|
||||
with:
|
||||
format: cyclonedx-json
|
||||
output-file: sbom.cyclonedx.json
|
||||
- uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: sbom-cyclonedx
|
||||
path: sbom.cyclonedx.json
|
||||
@@ -1,260 +0,0 @@
|
||||
name: Test
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [ 'main' ]
|
||||
paths:
|
||||
- '**.go'
|
||||
- '**.mod'
|
||||
- '**.wasm'
|
||||
- '**.yml'
|
||||
pull_request:
|
||||
branches: [ 'main' ]
|
||||
paths:
|
||||
- '**.go'
|
||||
- '**.mod'
|
||||
- '**.wasm'
|
||||
- '**.yml'
|
||||
workflow_dispatch:
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
test:
|
||||
strategy:
|
||||
matrix:
|
||||
os: [macos-latest, ubuntu-latest, windows-latest]
|
||||
runs-on: ${{ matrix.os }}
|
||||
permissions:
|
||||
contents: write
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v6
|
||||
- uses: actions/setup-go@v6
|
||||
with: { go-version: stable }
|
||||
|
||||
- name: Format
|
||||
run: gofmt -s -w . && git diff --exit-code
|
||||
if: matrix.os != 'windows-latest'
|
||||
|
||||
- name: Tidy
|
||||
run: go mod tidy && git diff --exit-code
|
||||
|
||||
- name: Download
|
||||
run: go mod download
|
||||
|
||||
- name: Verify
|
||||
run: go mod verify
|
||||
|
||||
- name: Vet
|
||||
run: go vet ./...
|
||||
|
||||
- name: Build
|
||||
run: go build ./...
|
||||
|
||||
- name: Test
|
||||
run: go test ./... -bench . -benchtime=1x
|
||||
|
||||
- name: Test BSD locks
|
||||
run: go test -tags sqlite3_flock ./...
|
||||
if: matrix.os != 'windows-latest'
|
||||
|
||||
- name: Test dot locks
|
||||
run: go test -tags sqlite3_dotlk ./...
|
||||
if: matrix.os != 'windows-latest'
|
||||
|
||||
- name: Test modules
|
||||
shell: bash
|
||||
run: |
|
||||
go work init .
|
||||
go work use -r gormlite
|
||||
go test ./gormlite
|
||||
|
||||
- name: Test GORM
|
||||
shell: bash
|
||||
run: gormlite/test.sh
|
||||
if: matrix.os == 'ubuntu-latest'
|
||||
|
||||
- name: Collect coverage
|
||||
run: |
|
||||
go get -tool github.com/dave/courtney@v0.4.4
|
||||
go tool courtney
|
||||
if: |
|
||||
github.event_name == 'push' &&
|
||||
matrix.os == 'ubuntu-latest'
|
||||
|
||||
- uses: ncruces/go-coverage-report@v0
|
||||
with:
|
||||
coverage-file: coverage.out
|
||||
chart: true
|
||||
amend: true
|
||||
if: |
|
||||
github.event_name == 'push' &&
|
||||
matrix.os == 'ubuntu-latest'
|
||||
|
||||
test-cross:
|
||||
strategy:
|
||||
matrix:
|
||||
os:
|
||||
- name: freebsd
|
||||
version: '15.0'
|
||||
- name: netbsd
|
||||
version: '10.1'
|
||||
- name: openbsd
|
||||
version: '7.9'
|
||||
tflags: '-test.short'
|
||||
- name: dragonfly
|
||||
action: dragonflybsd
|
||||
version: '6.4.2'
|
||||
tflags: '-test.short'
|
||||
- name: illumos
|
||||
action: omnios
|
||||
version: 'r151058'
|
||||
tflags: '-test.short'
|
||||
- name: freebsd
|
||||
arch: arm64
|
||||
version: '15.0'
|
||||
tflags: '-test.short'
|
||||
- name: netbsd
|
||||
arch: arm64
|
||||
version: '10.1'
|
||||
tflags: '-test.short'
|
||||
runs-on: ubuntu-latest
|
||||
needs: test
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v6
|
||||
|
||||
- name: Build
|
||||
env:
|
||||
GOOS: ${{ matrix.os.name }}
|
||||
GOARCH: ${{ matrix.os.arch }}
|
||||
TESTFLAGS: ${{ matrix.os.tflags }}
|
||||
run: .github/workflows/build-test.sh
|
||||
|
||||
- uses: cross-platform-actions/action@v1.2.0
|
||||
with:
|
||||
operating_system: ${{ matrix.os.action || matrix.os.name }}
|
||||
architecture: ${{ matrix.os.arch }}
|
||||
version: ${{ matrix.os.version }}
|
||||
shell: bash
|
||||
sync_files: runner-to-vm
|
||||
|
||||
- name: Test
|
||||
shell: cpa.sh {0}
|
||||
run: . ./test.sh
|
||||
|
||||
test-vm:
|
||||
strategy:
|
||||
matrix:
|
||||
os:
|
||||
- name: solaris
|
||||
action: 'vmactions/solaris-vm@v1'
|
||||
bflags: '-tags sqlite3_dotlk'
|
||||
tflags: '-test.short'
|
||||
runs-on: ubuntu-latest
|
||||
needs: test
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v6
|
||||
|
||||
- name: Build
|
||||
env:
|
||||
GOOS: ${{ matrix.os.name }}
|
||||
BUILDFLAGS: ${{ matrix.os.bflags }}
|
||||
TESTFLAGS: ${{ matrix.os.tflags }}
|
||||
VMACTIONS: ${{ matrix.os.action }}
|
||||
run: .github/workflows/build-test.sh
|
||||
|
||||
- name: Test
|
||||
uses: ./.github/actions/vmactions
|
||||
|
||||
test-wasip1:
|
||||
runs-on: ubuntu-latest
|
||||
needs: test
|
||||
|
||||
steps:
|
||||
- uses: bytecodealliance/actions/wasmtime/setup@v1
|
||||
- uses: actions/checkout@v6
|
||||
- uses: actions/setup-go@v6
|
||||
with: { go-version: stable }
|
||||
|
||||
- name: Setup
|
||||
run: echo "$(go env GOROOT)/lib/wasm" >> "$GITHUB_PATH"
|
||||
|
||||
- name: Test wasmtime
|
||||
env:
|
||||
GOOS: wasip1
|
||||
GOARCH: wasm
|
||||
GOWASIRUNTIME: wasmtime
|
||||
GOWASIRUNTIMEARGS: '--env CI=true --optimize opt-level=0'
|
||||
run: go test -short -tags sqlite3_dotlk -skip Example ./...
|
||||
|
||||
test-qemu:
|
||||
runs-on: ubuntu-latest
|
||||
needs: test
|
||||
|
||||
steps:
|
||||
- uses: docker/setup-qemu-action@v4
|
||||
- uses: actions/checkout@v6
|
||||
- uses: actions/setup-go@v6
|
||||
with: { go-version: stable }
|
||||
|
||||
- name: Test 32-bit
|
||||
run: GOARCH=386 go test ./...
|
||||
|
||||
- name: Test loong64
|
||||
run: GOARCH=loong64 go test -short ./...
|
||||
|
||||
- name: Test riscv64
|
||||
run: GOARCH=riscv64 go test -short ./...
|
||||
|
||||
- name: Test ppc64le
|
||||
run: GOARCH=ppc64le go test -short ./...
|
||||
|
||||
- name: Test s390x
|
||||
run: GOARCH=s390x go test -short ./...
|
||||
|
||||
test-linux-arm:
|
||||
runs-on: ubuntu-24.04-arm
|
||||
needs: test
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v6
|
||||
- uses: actions/setup-go@v6
|
||||
with: { go-version: stable }
|
||||
|
||||
- name: Test
|
||||
run: go test ./...
|
||||
|
||||
- name: Test 32-bit
|
||||
run: GOARCH=arm GOARM=7 go test ./...
|
||||
|
||||
test-os-other:
|
||||
strategy:
|
||||
matrix:
|
||||
os: [macos-15-intel, windows-11-arm]
|
||||
runs-on: ${{ matrix.os }}
|
||||
needs: test
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v6
|
||||
- uses: actions/setup-go@v6
|
||||
with: { go-version: stable }
|
||||
|
||||
- name: Test
|
||||
run: go test ./...
|
||||
|
||||
test-linux-other:
|
||||
strategy:
|
||||
matrix:
|
||||
os: [ubuntu-24.04-riscv, ubuntu-24.04-s390x, ubuntu-24.04-ppc64le-p10]
|
||||
runs-on: ${{ matrix.os }}
|
||||
needs: test-qemu
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v6
|
||||
|
||||
- name: Test
|
||||
run: go test -short ./...
|
||||
@@ -0,0 +1,35 @@
|
||||
# CI/CD for hanzoai/platform (the Hanzo PaaS) — NOT GitHub Actions.
|
||||
# The platform runs `make ci` as a build step and/or a scheduled (cron) task.
|
||||
# Works identically locally and anywhere: `make ci`.
|
||||
SHELL := /usr/bin/env bash
|
||||
export GOPRIVATE := github.com/hanzoai,github.com/luxfi
|
||||
export GOFLAGS := -mod=mod
|
||||
BIN := $(CURDIR)/.bin
|
||||
export PATH := $(BIN):$(PATH)
|
||||
GITLEAKS_VERSION ?= 8.21.2
|
||||
ARCH := $(shell uname -m | sed 's/x86_64/x64/; s/aarch64/arm64/')
|
||||
|
||||
.PHONY: ci build test scan vuln secrets sbom tools clean
|
||||
ci: build test scan ## full pipeline (build -> test -> scan)
|
||||
build:
|
||||
go build ./...
|
||||
test:
|
||||
go test ./...
|
||||
scan: vuln secrets sbom
|
||||
vuln:
|
||||
go install golang.org/x/vuln/cmd/govulncheck@latest
|
||||
govulncheck ./...
|
||||
secrets: $(BIN)/gitleaks
|
||||
gitleaks detect --source . --redact --no-banner --exit-code 1
|
||||
sbom: $(BIN)/syft
|
||||
syft . -o cyclonedx-json=sbom.cyclonedx.json -q
|
||||
tools: $(BIN)/gitleaks $(BIN)/syft
|
||||
clean:
|
||||
rm -rf $(BIN) sbom.cyclonedx.json
|
||||
|
||||
$(BIN)/gitleaks:
|
||||
@mkdir -p $(BIN)
|
||||
curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v$(GITLEAKS_VERSION)/gitleaks_$(GITLEAKS_VERSION)_linux_$(ARCH).tar.gz" | tar -xz -C $(BIN) gitleaks
|
||||
$(BIN)/syft:
|
||||
@mkdir -p $(BIN)
|
||||
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b $(BIN) >/dev/null
|
||||
+15
@@ -0,0 +1,15 @@
|
||||
# CI/CD on hanzoai/platform — no GitHub Actions
|
||||
|
||||
This repo is built, run, and scanned by **hanzoai/platform** (the Hanzo PaaS),
|
||||
not GitHub Actions. `.github/workflows` is intentionally absent.
|
||||
|
||||
- **Build / run** — the platform builds via Dockerfile / Nixpacks / Railpack and
|
||||
runs the result; auto-deploy on push.
|
||||
- **Actions (CI)** — a platform **Scheduled Task** (and/or build step) runs
|
||||
`make ci` = `build → test → scan` (govulncheck + gitleaks + CycloneDX SBOM),
|
||||
on push and on a cron. SOC 2 CC7.x/CC8.x evidence (artifacts to hanzoai/audit).
|
||||
- The platform build env carries Git credentials for `github.com/hanzoai` +
|
||||
`github.com/luxfi`, so cross-org private modules resolve natively — no per-repo
|
||||
token dance (the thing that made GitHub Actions painful).
|
||||
|
||||
Run anywhere: `make ci`.
|
||||
Reference in New Issue
Block a user