improved client.AuditLogMetadata.String #515
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| permissions: | |
| # Least-privilege: CI only needs read access to repository contents. | |
| # Avoid granting write access to the GITHUB_TOKEN to reduce blast radius | |
| # if a step or third-party action is compromised. | |
| contents: read | |
| on: | |
| push: | |
| branches: [ main ] | |
| tags: | |
| # Run on all tags except for release tags (e.g. v1.2.3) | |
| - '!v[0-9]+.[0-9]+.[0-9]+' | |
| pull_request: | |
| branches: [ main ] | |
| jobs: | |
| test: | |
| name: Run tests | |
| runs-on: ubuntu-latest | |
| env: | |
| KEYMASTER_DB_MAX_OPEN_CONNS: '1' | |
| KEYMASTER_DB_MAX_IDLE_CONNS: '1' | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| # Do not persist the automatically-provided GITHUB_TOKEN to the | |
| # checked-out repository. This prevents accidental leakage of the | |
| # token to build artifacts or subprocesses that operate on the repo. | |
| persist-credentials: false | |
| # Fetch full history (tags) for version computations when needed. | |
| fetch-depth: 0 | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: '1.25.8' | |
| - name: Verify Go version | |
| run: go version | |
| - name: Clean Go module cache (prevent partial-restore issues) | |
| run: | | |
| rm -rf ~/go/pkg/mod || true | |
| rm -rf ~/.cache/go-build || true | |
| - name: Cache Go modules | |
| uses: actions/cache@v5 | |
| with: | |
| path: | | |
| ~/.cache/go-build | |
| ~/go/pkg/mod | |
| key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum','**/go.mod') }} | |
| restore-keys: | | |
| ${{ runner.os }}-go-${{ hashFiles('**/go.mod') }} | |
| ${{ runner.os }}-go- | |
| - name: Install tools | |
| run: | | |
| go install github.com/golang-migrate/migrate/v4/cmd/migrate@latest | |
| - name: Check formatting | |
| run: | | |
| echo 'Checking gofmt...' | |
| UNFORMATTED=$(gofmt -s -l .) | |
| if [ -n "${UNFORMATTED}" ]; then | |
| echo "gofmt found unformatted files:" && echo "$UNFORMATTED" | |
| exit 1 | |
| fi | |
| - name: Run golangci-lint | |
| uses: golangci/golangci-lint-action@v9 | |
| # Fail the job if linter reports issues. Continue-on-error masks problems | |
| # and can be abused; require a passing linter in CI for safety. | |
| with: | |
| version: v2.11.4 | |
| # The action already invokes `golangci-lint run`, so pass only targets. | |
| args: ./... | |
| - name: Static vet | |
| run: go vet ./... | |
| - name: Run tests (race on Linux) | |
| run: | | |
| echo "Running tests with race detector on Linux, fallback to non-race on other OS" | |
| if [ "${{ runner.os }}" = "Linux" ]; then | |
| sudo apt-get update && sudo apt-get install -y build-essential | |
| export CGO_ENABLED=1 | |
| go test ./... -v -race | |
| else | |
| go test ./... -v | |
| fi | |
| build: | |
| name: Build binary with version | |
| runs-on: ubuntu-latest | |
| needs: test | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: '1.25.8' | |
| - name: Verify Go version | |
| run: go version | |
| - name: Compute version and git sha | |
| id: ver | |
| run: | | |
| echo "GITHUB_REF=${GITHUB_REF}" | |
| GIT_SHA=$(git rev-parse --short=8 HEAD) | |
| echo "git_sha=$GIT_SHA" >> $GITHUB_OUTPUT | |
| if [[ "${GITHUB_REF}" == refs/tags/* ]]; then | |
| TAG=${GITHUB_REF#refs/tags/} | |
| echo "tag=$TAG" >> $GITHUB_OUTPUT | |
| # Version string: <tag> (sha) | |
| VERSION="$TAG ($GIT_SHA)" | |
| else | |
| VERSION="$GIT_SHA" | |
| fi | |
| echo "version=$VERSION" >> $GITHUB_OUTPUT | |
| - name: Build | |
| run: | | |
| echo "Building with version ${{ steps.ver.outputs.version }} (git ${GITHUB_SHA::8})" | |
| BUILD_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ) | |
| go build -ldflags "-X main.version='${{ steps.ver.outputs.version }}' -X main.gitCommit='${{ steps.ver.outputs.git_sha }}' -X main.buildDate='${BUILD_DATE}'" -o keymaster . | |
| - name: Upload binary | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: keymaster-${{ steps.ver.outputs.version }} | |
| path: keymaster |