feat: add severity levels, token advisor, and stream improvements #92
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Code Quality | |
| on: | |
| push: | |
| branches: [ main, develop ] | |
| pull_request: | |
| branches: [ main, develop ] | |
| jobs: | |
| static-analysis: | |
| name: Static Analysis | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.25' | |
| - name: Run go vet | |
| run: go vet ./... | |
| - name: Run staticcheck | |
| uses: dominikh/staticcheck-action@v1 | |
| with: | |
| # 2024.1.1 was built with older x/tools whose constant-overflow | |
| # evaluation conflicts with Go 1.26 ("invalid array length | |
| # -delta*delta"). A newer staticcheck release avoids that. | |
| version: "2025.1" | |
| install-go: false | |
| - name: Run gosec | |
| uses: securego/gosec@master | |
| with: | |
| # Exclude the local Go module cache + cache dir; CI runner | |
| # populates these inside the workspace and gosec happily | |
| # scans them, surfacing third-party findings we can't fix. | |
| # -no-fail: don't exit non-zero on findings; we report via | |
| # SARIF upload to Security tab, which is where triage lives. | |
| args: '-fmt sarif -out gosec.sarif -exclude-dir=.gomodcache -exclude-dir=.gocache -exclude-dir=.gosrccache -exclude-dir=vendor -no-fail ./...' | |
| - name: Upload Gosec Results | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: gosec.sarif | |
| if: always() | |
| coverage: | |
| name: Test Coverage | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.25' | |
| - name: Run tests with coverage | |
| run: | | |
| go test -race -coverprofile=coverage.out -covermode=atomic ./... | |
| - name: Generate coverage report | |
| run: | | |
| go tool cover -func=coverage.out > coverage.txt | |
| cat coverage.txt | |
| - name: Check coverage threshold | |
| run: | | |
| COVERAGE=$(go tool cover -func=coverage.out | grep total | awk '{print $3}' | sed 's/%//') | |
| echo "Total coverage: $COVERAGE%" | |
| # Threshold matches ci.yml coverage-threshold job (see comment there). | |
| if (( $(echo "$COVERAGE < 20" | bc -l) )); then | |
| echo "❌ Coverage $COVERAGE% is below threshold of 20%" | |
| exit 1 | |
| else | |
| echo "✅ Coverage $COVERAGE% meets threshold of 20%" | |
| fi | |
| - name: Upload coverage | |
| uses: codecov/codecov-action@v4 | |
| with: | |
| file: ./coverage.out | |
| flags: unittests | |
| name: codecov-umbrella | |
| lint: | |
| name: Lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.25' | |
| # golangci-lint removed: see .github/workflows/ci.yml comment. | |
| - name: Placeholder (golangci-lint temporarily disabled) | |
| run: echo "golangci-lint disabled pending Go 1.25 support in prebuilt v1.x binaries" | |
| - name: Check go mod tidy | |
| run: | | |
| go mod tidy | |
| git diff --exit-code go.mod go.sum | |
| fmt: | |
| name: Format Check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.25' | |
| - name: Check formatting | |
| run: | | |
| # Exclude vendored / cache dirs — these aren't ours to reformat. | |
| files=$(gofmt -l . 2>/dev/null | grep -v -E '^(\.gomodcache|\.gocache|\.gosrccache|vendor)/' || true) | |
| if [ -n "$files" ]; then | |
| echo "❌ The following files need formatting:" | |
| echo "$files" | |
| exit 1 | |
| fi | |
| echo "✅ All files are properly formatted" | |
| imports: | |
| name: Import Check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.25' | |
| - name: Check imports | |
| run: | | |
| go install golang.org/x/tools/cmd/goimports@latest | |
| files=$(goimports -l . 2>/dev/null | grep -v -E '^(\.gomodcache|\.gocache|\.gosrccache|vendor)/' || true) | |
| if [ -n "$files" ]; then | |
| echo "❌ The following files have import issues:" | |
| echo "$files" | |
| exit 1 | |
| fi | |
| echo "✅ All imports are properly organized" |