From 63c27e4a23156626298ff3c075761e89d62ec30c Mon Sep 17 00:00:00 2001 From: Ironystock Date: Tue, 28 Apr 2026 07:33:02 -0700 Subject: [PATCH 1/2] ci: harden checks before Blacksmith migration MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Four additions worth bundling now so the YAML migration to Blacksmith.sh runners is a single pass: 1. Tests now run on all 3 platforms (was: ubuntu only). Pair flow touches os.UserHomeDir/filepath.Join — Windows-specific path bugs would have slipped past the prior config. Combined the old `test` and `build-matrix` jobs into a single matrix that does vet + test + build per platform. 2. New `mod-tidy` job catches go.mod/go.sum drift. Today's cellbuf/ ansi version skew (between charmbracelet/log v1 and fang v1) was exactly the failure mode this guards. 3. New `goreleaser-check` job validates .goreleaser.yml syntax on every PR. Cheap (~15s) insurance against shipping a tag that immediately breaks the release pipeline. 4. New .github/dependabot.yml: weekly bumps for gomod (grouped charmbracelet pkgs into one PR to avoid noise) + github-actions ecosystems. Public CLI; dep hygiene matters before strangers start installing. Lint job unchanged. CodeQL stays repo-settings-only. Naming: "Test (ubuntu-latest)" / "Test (macos-latest)" / "Test (windows-latest)" / "Mod Tidy Drift" / "GoReleaser Config" / "Lint" — explicit names so branch protection rulesets can require them by exact match. Co-Authored-By: Claude Opus 4.7 --- .github/dependabot.yml | 33 +++++++++++++++++++++ .github/workflows/ci.yml | 62 +++++++++++++++++++++++++++++----------- 2 files changed, 79 insertions(+), 16 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..a85f039 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,33 @@ +version: 2 + +updates: + - package-ecosystem: gomod + directory: / + schedule: + interval: weekly + day: monday + open-pull-requests-limit: 5 + labels: + - dependencies + - go + commit-message: + prefix: "chore(deps)" + include: scope + groups: + charmbracelet: + patterns: + - "github.com/charmbracelet/*" + - "charm.land/*" + + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + day: monday + open-pull-requests-limit: 5 + labels: + - dependencies + - ci + commit-message: + prefix: "chore(ci)" + include: scope diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 58dc6d2..b22f538 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -13,8 +13,15 @@ permissions: jobs: test: - name: Test - runs-on: ubuntu-latest + name: Test (${{ matrix.os }}) + strategy: + fail-fast: false + matrix: + os: + - ubuntu-latest + - macos-latest + - windows-latest + runs-on: ${{ matrix.os }} steps: - name: Checkout uses: actions/checkout@v4 @@ -34,16 +41,14 @@ jobs: - name: Test run: go test -race -v ./... - build-matrix: - name: Build (${{ matrix.os }}) - runs-on: ${{ matrix.os }} - strategy: - fail-fast: false - matrix: - os: - - ubuntu-latest - - macos-latest - - windows-latest + - name: Build + env: + CGO_ENABLED: "0" + run: go build ./... + + mod-tidy: + name: Mod Tidy Drift + runs-on: ubuntu-latest steps: - name: Checkout uses: actions/checkout@v4 @@ -54,10 +59,35 @@ jobs: go-version-file: go.mod cache: true - - name: Build - env: - CGO_ENABLED: "0" - run: go build ./... + - name: Tidy + run: go mod tidy + + - name: Verify no drift + run: | + git diff --exit-code go.mod go.sum || { + echo "::error::go.mod or go.sum is out of sync. Run 'go mod tidy' locally and commit the result." + exit 1 + } + + goreleaser-check: + name: GoReleaser Config + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Setup Go + uses: actions/setup-go@v5 + with: + go-version-file: go.mod + cache: false + + - name: Validate .goreleaser.yml + uses: goreleaser/goreleaser-action@v6 + with: + distribution: goreleaser + version: "~> v2" + args: check lint: name: Lint From 47d5910785c3c42978ac27f7d2e68277692d2f0d Mon Sep 17 00:00:00 2001 From: Ironystock Date: Tue, 28 Apr 2026 07:36:29 -0700 Subject: [PATCH 2/2] chore(ci): add solo-dev branch protection ruleset MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reference JSON for the GitHub Rulesets API. Solo-dev friendly: - Require PR before merge (0 required reviewers — Brad self-approves) - Require all 7 status checks pass (3 platform tests + mod tidy + goreleaser check + lint + CodeQL) - strict policy: branches must be up to date before merge - Block force-push + deletion (absolute safety, no bypass) - Allow merge + squash methods (rebase off; preserves clear history trail in `git log --merges`) - No bypass actors — rules apply uniformly. If anything ever needs to bypass (hotfix scenario), edit via UI. Apply with: gh api --method PUT \ repos/captured-ventures/rememberize-cli/rulesets \ --input .github/rulesets/main-protection.json Or POST to /rulesets to create new (the above PUT-by-name doesn't exist; use POST then capture the returned ID for future updates). Dashboard alternative: Settings → Rules → Rulesets → Import. Lives in the repo as version-controlled reference. Editing the file does NOT automatically reapply — re-run the API call after edits. Co-Authored-By: Claude Opus 4.7 --- .github/rulesets/main-protection.json | 43 +++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 .github/rulesets/main-protection.json diff --git a/.github/rulesets/main-protection.json b/.github/rulesets/main-protection.json new file mode 100644 index 0000000..a5abea9 --- /dev/null +++ b/.github/rulesets/main-protection.json @@ -0,0 +1,43 @@ +{ + "name": "main branch protection", + "target": "branch", + "enforcement": "active", + "conditions": { + "ref_name": { + "include": ["~DEFAULT_BRANCH"], + "exclude": [] + } + }, + "rules": [ + { "type": "deletion" }, + { "type": "non_fast_forward" }, + { + "type": "pull_request", + "parameters": { + "required_approving_review_count": 0, + "dismiss_stale_reviews_on_push": false, + "require_code_owner_review": false, + "require_last_push_approval": false, + "required_review_thread_resolution": false, + "allowed_merge_methods": ["merge", "squash"] + } + }, + { + "type": "required_status_checks", + "parameters": { + "strict_required_status_checks_policy": true, + "do_not_enforce_on_create": false, + "required_status_checks": [ + { "context": "Test (ubuntu-latest)" }, + { "context": "Test (macos-latest)" }, + { "context": "Test (windows-latest)" }, + { "context": "Mod Tidy Drift" }, + { "context": "GoReleaser Config" }, + { "context": "Lint" }, + { "context": "Analyze (go)" } + ] + } + } + ], + "bypass_actors": [] +}